Abstract: The present system includes a system, method and device for inferring connectivity between unconnected network segments. In operation, unconnected network segments are identified. Configuration data related to the unconnected network segments may be examined to facilitate inferring configuration data for an external network connected between the unconnected network segments. The inferred configuration data may be rendered, such as exported or visualized. The inferred configuration data may be related to a communication protocol and/or may be related to network bandwidth. The examined configuration data may be captured directly from one or more of the unconnected network segments and/or may be retrieved from a configuration data file, such as a network configuration model.

Abstract: A security policy database identifies the intended security policies within a network, a traffic generator provides test traffic that is configured to test each defined security policy, and a simulator simulates the propagation of this traffic on a model of the network. The model of the network includes the configuration data associated with each device, and thus, if devices are properly configured to enforce the intended security policies, the success/failure of the simulated test traffic will conform to the intended permit/deny policy of each connection. Differences between the simulated message propagation and the intended security policies are reported to the user, and diagnostic tools are provided to facilitate identification of the device configuration data that accounts for the observed difference. Additionally, if a network's current security policy is unknown, test traffic is generated to reveal the actual policy in effect, to construct a baseline intended security policy.

Abstract: The present system includes a system, method and device for inferring connectivity between unconnected network segments. In operation, unconnected network segments are identified. Configuration data related to the unconnected network segments may be examined to facilitate inferring configuration data for an external network connected between the unconnected network segments. The inferred configuration data may be rendered, such as exported or visualized. The inferred configuration data may be related to a communication protocol and/or may be related to network bandwidth. The examined configuration data may be captured directly from one or more of the unconnected network segments and/or may be retrieved from a configuration data file, such as a network configuration model.

Abstract: The present system includes a system, method and device for inferring connectivity between network devices across a third party network. Configuration data related to the network devices is examined and configuration data about the network is inferred. The inferred configuration data may be related to a communication protocol, network bandwidth, and the like. A model representing the network is then created to indicate inferred interfaces and connections through the external network between network devices. The representation may be rendered in various forms, such as a display or data exported to another system. Various studies may also be performed using the model, such as traffic, routing, or planning studies.

Abstract: The present system includes a system, method and device for inferring connectivity between network devices across a third party network. Configuration data related to the network devices is examined and configuration data about the network is inferred. The inferred configuration data may be related to a communication protocol, network bandwidth, and the like. A model representing the network is then created to indicate inferred interfaces and connections through the external network between network devices. The representation may be rendered in various forms, such as a display or data exported to another system. Various studies may also be performed using the model, such as traffic, routing, or planning studies.

Abstract: The present system includes a system, method and device for inferring connectivity between unconnected network segments. In operation, unconnected network segments are identified. Configuration data related to the unconnected network segments may be examined to facilitate inferring configuration data for an external network connected between the unconnected network segments. The inferred configuration data may be rendered, such as exported or visualized. The inferred configuration data may be related to a communication protocol and/or may be related to network bandwidth. The examined configuration data may be captured directly from one or more of the unconnected network segments and/or may be retrieved from a configuration data file, such as a network configuration model.

Abstract: A network configuration is processed to identify each policy and the criteria associated with each policy. The criteria of the policies are processed to identify a non-overlapping set of ranges of the criteria parameter, each range being associated with a particular policy or set of policies. In a preferred embodiment, the criteria include the protocol, the source and destination IP addresses, and the source and destination ports, and a default range is defined for each criteria parameter.

Abstract: The present system includes a system, method and device for inferring connectivity between unconnected network segments. In operation, unconnected network segments are identified. Configuration data related to the unconnected network segments may be examined to facilitate inferring configuration data for an external network connected between the unconnected network segments. The inferred configuration data may be rendered, such as exported or visualized. The inferred configuration data may be related to a communication protocol and/or may be related to network bandwidth. The examined configuration data may be captured directly from one or more of the unconnected network segments and/or may be retrieved from a configuration data file, such as a network configuration model.

Abstract: A network configuration is processed to identify each policy and the criteria associated with each policy. The criteria of the policies are processed to identify a non-overlapping set of ranges of the criteria parameter, each range being associated with a particular policy or set of policies. In a preferred embodiment, the criteria include the protocol, the source and destination IP addresses, and the source and destination ports, and a default range is defined for each criteria parameter.

Abstract: A security policy database identifies the intended security policies within a network, a traffic generator provides test traffic that is configured to test each defined security policy, and a simulator simulates the propagation of this traffic on a model of the network. The model of the network includes the configuration data associated with each device, and thus, if devices are properly configured to enforce the intended security policies, the success/failure of the simulated test traffic will conform to the intended permit/deny policy of each connection. Differences between the simulated message propagation and the intended security policies are reported to the user, and diagnostic tools are provided to facilitate identification of the device configuration data that accounts for the observed difference. Additionally, if a network's current security policy is unknown, test traffic is generated to reveal the actual policy in effect, to construct a baseline intended security policy.