Integrating changes to a hierarchical policy model

Cisco's VPN and security management system (VMS) is based on a hierarchical security policy model. Customers have found this hierarchical composition policy model a clear and succinct form for expressing policy enforced by multiple security devices. However, many customers also need to make changes to their Cisco devices directly via command line interface (CLI) to trouble shoot or deal with an immediate problem and then reintegrate the semantic changes back into the VMS policy. This paper outlines techniques for reincorporating such out of band, low level configuration changes back into the common hierarchical policy model.