Abstract: The technology presented herein enables a new network element to be authenticated to other network elements automatically. In a particular embodiment, a method provides determining a current time relative to a first time. The first time is known to the new network element and a provisioning network element. The method further provides generating first beacon data using seed data stored on the new network element and the current time and generating keying data using the first beacon data and identification information associated with the new network element. The method also provides identifying a first one-time pad (OTP) from the keying data and using the first OTP to encrypt an authentication request for transfer from the new network element to the provisioning network element.

Abstract: The technology presented herein enables a new network element to be authenticated to other network elements automatically. In a particular embodiment, a method provides determining a current time relative to a first time. The first time is known to the new network element and a provisioning network element. The method further provides generating first beacon data using seed data stored on the new network element and the current time and generating keying data using the first beacon data and identification information associated with the new network element. The method also provides identifying a first one-time pad (OTP) from the keying data and using the first OTP to encrypt an authentication request for transfer from the new network element to the provisioning network element.

Abstract: A distributed log collector and report generation architecture is disclosed. In some embodiments, a received query to generate a log report is forwarded to each of a plurality of log collector clusters, and responses to the query received from each of at least a subset of the plurality of log collector clusters are aggregated to generate the log report.

Abstract: The technology presented herein enables a new network element to be authenticated to other network elements automatically. In a particular embodiment, a method provides determining a current time relative to a first time. The first time is known to the new network element and a provisioning network element. The method further provides generating first beacon data using seed data stored on the new network element and the current time and generating keying data using the first beacon data and identification information associated with the new network element. The method also provides identifying a first one-time pad (OTP) from the keying data and using the first OTP to encrypt an authentication request for transfer from the new network element to the provisioning network element.

Abstract: Using one or more externally defined objects to at least in part define a security policy is disclosed. In some embodiments, an external object list is obtained from an external list server, and a security policy comprising one or more rules based at least in part on one or more externally defined objects comprising the external object list and based at least in part on one or more locally defined objects is defined. The security policy is enforced with respect to one or more devices and periodically updated as the external object list is updated.

Abstract: Using one or more externally defined objects to at least in part define a security policy is disclosed. In some embodiments, an external object list is obtained from an external list server, and a security policy comprising one or more rules based at least in part on one or more externally defined objects comprising the external object list and based at least in part on one or more locally defined objects is defined. The security policy is enforced with respect to one or more devices and periodically updated as the external object list is updated.

Abstract: Using one or more externally defined objects to at least in part define a security policy is disclosed. In some embodiments, an external object list is obtained from an external list server, and a security policy comprising one or more rules based at least in part on one or more externally defined objects comprising the external object list and based at least in part on one or more locally defined objects is defined. The security policy is enforced with respect to one or more devices and periodically updated as the external object list is updated.

Abstract: Dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions is provided. In some embodiments, dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions includes receiving a network policy that includes a domain name (e.g., the network policy can include a network security rule that is based on the domain name); and periodically updating Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query.

Abstract: Deploying policy configuration across multiple security devices through hierarchical configuration templates is disclosed. In some embodiments, deploying policy configuration across multiple security devices through hierarchical configuration templates for configuring a plurality of security devices includes receiving at a first security device a hierarchy of templates from a central management server, in which the hierarchy of templates includes configuration information for a group of security devices, and in which the first security device is included in the group of security devices; and reconciling on the first security device's configuration information included in the hierarchy of templates and device specific configuration based on local configuration information, in which the first security device performs an object level reconciliation to maintain device configuration consistency.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for managing network devices. A central management system stores shared configuration objects in a central configuration database. A network device stores shared configuration objects and device-specific configuration objects in a local configuration database. The local configuration database's shared configuration objects correspond to shared configuration objects in the central configuration database. The network device can be configured locally or using the central management system.

Abstract: Dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions is provided. In some embodiments, dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions includes receiving a network policy that includes a domain name (e.g., the network policy can include a network security rule that is based on the domain name); and periodically updating Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query.

Abstract: Deploying policy configuration across multiple security devices through hierarchical configuration templates is disclosed. In some embodiments, deploying policy configuration across multiple security devices through hierarchical configuration templates for configuring a plurality of security devices includes receiving at a first security device a hierarchy of templates from a central management server, in which the hierarchy of templates includes configuration information for a group of security devices, and in which the first security device is included in the group of security devices; and reconciling on the first security device's configuration information included in the hierarchy of templates and device specific configuration based on local configuration information, in which the first security device performs an object level reconciliation to maintain device configuration consistency.

Abstract: Dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions is provided. In some embodiments, dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions includes receiving a network policy that includes a domain name (e.g., the network policy can include a network security rule that is based on the domain name); and periodically updating Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query.

Abstract: A distributed log collector and report generation architecture is disclosed. In some embodiments, a received query to generate a log report is forwarded to each of a plurality of log collector clusters, and responses to the query received from each of at least a subset of the plurality of log collector clusters are aggregated to generate the log report.

Abstract: Deploying policy configuration across multiple security devices through hierarchical configuration templates is disclosed. In some embodiments, deploying policy configuration across multiple security devices through hierarchical configuration templates for configuring a plurality of security devices includes receiving at a first security device a hierarchy of templates from a central management server, in which the hierarchy of templates includes configuration information for a group of security devices, and in which the first security device is included in the group of security devices; and reconciling on the first security device's configuration information included in the hierarchy of templates and device specific configuration based on local configuration information, in which the first security device performs an object level reconciliation to maintain device configuration consistency.

Abstract: Using geographical information in policy enforcement is disclosed. A request for a resource is received from a device. A policy to be applied to the request is determined based at least in part on geographical information associated with an IP address. The policy is enforced. The IP address may be either a source IP address or a destination IP address.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for configuring network devices. A central management system stores shared configuration objects in a central configuration database. A network device stores shared configuration objects and device-specific configuration objects in a local configuration database. The local configuration database's shared configuration objects correspond to shared configuration objects in the central configuration database. The central management system determines the network device has received a request to update a shared configuration object, where the request did not originate from the central management system, and updates the central configuration database.

Abstract: Dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions is provided. In some embodiments, dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions includes receiving a network policy that includes a domain name (e.g., the network policy can include a network security rule that is based on the domain name); and periodically updating Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query.

Abstract: Dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions is provided. In some embodiments, dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions includes receiving a network policy that includes a domain name (e.g., the network policy can include a network security rule that is based on the domain name); and periodically updating Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for configuring network devices. A central management system stores shared configuration objects in a central configuration database. A network device stores shared configuration objects and device-specific configuration objects in a local configuration database. The local configuration database's shared configuration objects correspond to shared configuration objects in the central configuration database. The central management system determines the network device has received a request to update a shared configuration object, where the request did not originate from the central management system, and updates the central configuration database.