Towards validated network configurations with NCGuard

Abstract

Abstract-Today, most IP networks are still configured manually on a router-by-router basis. This is error-prone and often leads to misconfiguration. In this paper, we describe the Network Configuration Safeguard (NCGuard), a tool that allows the network architect to apply a safer methodology. The first step is to define his design rules. Based on a survey of the networking literature, we classify the most common types of rules in three main patterns: presence, uniqueness and symmetry and provide several examples. The second step is to write a highlevel representation of his network. The third step is to validate the network representation and generate the configuration of each router. This last step is performed automatically by our prototype. Finally, we describe our prototype and apply it to the Abilene network.

An automated system for emulated network experimentation

“…These could be compared to the created overlay graphs to assert deployment success and validate experimental results. Offline verification systems could be applied prior to deployment, applying static checking [38] or stability detection [16]. Integrating pre-and post-deployment verification systems allows testdriven network development [32].…”

Discovering configuration templates of virtualized tenant networks in multi-tenancy datacenters via graph-mining

“…A few works have developed configuration templates in different networking fields (e.g., ISP [4,6,7]), and the present work shares the spirit of the use of templates. In contrast to those work, an originality of this work is the focus on the fundamental and crucial difficulty in creating appropriate templates.…”

“…Tenant construction in such datacenters still mostly relies on manual configuration because of the lack of tools that generally meet those various requirements. Manual configuration is substantially time-consuming and error-prone in general as claimed over at least a decade [3,4,5,6,7], and the use of multi-tenancy in datacenter context has unfortunately required more careful and sophisticated management processes than ever due to the increase in risks of misconfigurations in such shared environments.…”

“…The use of templates is effective when similar form of configurations are repetitively created (i.e., templates are reusable). According to successful cases in other areas (e.g., ISP [4,6,7]), we expect that templates would also be effective in multi-tenancy datacenter networks.…”

Declarative configuration management for complex and dynamic networks

“…Template-driven approaches [15,12] are commonly used in production environments. A template program extracts parameters from provisioning databases and generates configuration snippets, optionally with some validation [35]. Unfortunately, the dependencies among templates and between the generated snippets and the existing configurations, still need to be resolved manually.…”