Patent ID: 7143283

Claim:
A method for simplifying the selection of network paths for implementing and managing security policies on a network, the method comprising the computer-implemented steps of: identifying a plurality of logical nodes that form a model for a network from a plurality of elements on the network, wherein the plurality of logical nodes is fewer than the plurality of elements and the plurality of elements include one or more security devices that are managed by a set of security policies; determining one or more path entries for at least some of the plurality of logical nodes, wherein each path entry is associated with a node in the plurality of logical nodes, and wherein each path entry specifies a set of communication packets and a subsequent node in the plurality of logical nodes to receive, from the node associated with that path entry, a communication packet in the set of communication packets; and using the one or more path entries to characterize at least a substantial portion of a network path that is to carry communication packets in the set of communication packets.