Systems and methods for configuring policy bank invocations
Systems and methods for configuring and evaluating policies that direct processing of one or more data streams are described. A configuration interface is described for allowing users to specify object oriented policies. These object oriented policies may allow any data structures to be applied with respect to a payload of a received packet stream, including any portions of HTTP traffic. A configuration interface may also allow the user to control the order in which policies and policy groups are executed, in addition to specifying actions to be taken if one or more policies are undefined. Systems and methods for processing the policies may allow efficient processing of object-oriented policies by applying potentially complex data structures to unstructured data streams. A device may also interpret and process a number of flow control commands and policy group invocation statements to determine an order of execution among a number of policies and policy groups.
1. A method for configuring flow control among policy groups used in a network device processing a packet stream, the method comprising:
(a) providing a configuration interface, executing on a device, identifying a plurality of policy groups for configuring a network device, each of the plurality of policy groups comprising policies to be processed consecutively;
(b) identifying, by the configuration interface, a first policy of a first policy group of the plurality of policy groups; the first policy of a first policy group specifying a rule comprising an object-oriented expression that evaluates a portion of a network packet;
(c) receiving, via the configuration interface, information identifying a second policy group of the plurality of policy groups to be processed based on an evaluation of the expression of the rule of the first policy in the first policy group;
(d) evaluating the portion of the network packet using the object-oriented expression; and;
(e) processing the second policy group based on the evaluation of the expression of the rule of the first policy in the first policy group.
2. The method of claim 1 , wherein step (a) comprises providing a command-line configuration interface.
3. The method of claim 1 , wherein step (a) comprises providing a configuration interface comprising one or more of a drag-and-drop interface, a list-selection interface, and a syntax-highlighting interface.
4. The method of claim 1 , wherein step (a) comprises executing the configuration interface on a device in communication with the network device.
5. The method of claim 1 , wherein step (a) comprises executing the configuration interface on the device comprising the network device.
6. The method of claim 1 , wherein step (a) comprises creating by a user via the configuration interface the plurality of policy groups.
7. The method of claim 1 , wherein the policy specifies a flow instruction to be taken based on an evaluation of the rule.
8. The method of claim 1 , wherein the policy specifies an action to be taken if the rule evaluates to true, the action comprising performing one of: load balancing, content switching, application security, application delivery, network acceleration, and application acceleration.
9. The method of claim 1 , wherein the policy specifies a second policy of the second policy group to be processed after the first policy group is processed.
10. The method of claim 1 , wherein step (c) comprises receiving, via the configuration interface, information identifying the second policy group to be processed if the expression of the rule evaluates to true.
11. The method of claim 1 , wherein step (c) comprises receiving, via the configuration interface, a label of the second policy group to be processed based on an evaluation of the expression of the rule.
12. A system for configuring flow control among policy groups used in a network device processing a packet stream, the system comprising:
a configuration interface executing on a computing device, the configuration interface to:
identify a first policy of a first policy group of a plurality of policy groups configured for a network device, each of the plurality of policy groups comprising policies to be processed consecutively, the first policy specifying a rule comprising a first object-oriented expression that evaluates a portion of a network packet; and
receive information identifying a second policy group of the plurality of policy groups to be processed based on an evaluation of the first expression of the rule of the first policy group;
the network device to:
evaluate the portion of the network packet using the object-oriented expression;
and;
process the second policy group based on the evaluation of the expression of the rule of the first policy in the first policy group.
13. The system of claim 12 , wherein the configuration interface provides an interface for creating the plurality of policy groups.
14. The system of claim 12 , wherein the configuration interface identifies the first policy specifying an action to be taken based on the evaluation of the first expression of the rule.
15. The system of claim 12 , wherein the configuration interface identifies the first policy specifying an action to be taken if the rule evaluates to true, the action comprising performing one of load balancing, content switching, application security, application delivery, network acceleration, and application acceleration.
16. The system of claim 12 , wherein the first policy specifies a second policy of the second policy group to be processed after the first policy group is processed.
17. The system of claim 12 , wherein the configuration interface receives information identifying the second policy group to be processed if the first expression of the rule evaluates to true.
18. The system of claim 12 , wherein the configuration interface receives a label of the second policy group to be processed based on the evaluation of the first expression of the rule.