RELEASE 7.

Infoblox NIOS Administrator Guide

Copyright Statements
© 2016, Infoblox Inc.— All rights reserved.
The contents of this document may not be copied or duplicated in any form, in whole or in part, without the prior
written permission of Infoblox, Inc.
The information in this document is subject to change without notice. Infoblox, Inc. shall not be liable for any
damages resulting from technical errors or omissions which may be present in this document, or from use of this
document.
This document is an unpublished work protected by the United States copyright laws and is proprietary to Infoblox,
Inc. Disclosure, copying, reproduction, merger, translation, modification, enhancement, or use of this document by
anyone other than authorized employees, authorized users, or licensees of Infoblox, Inc. without the prior written
consent of Infoblox, Inc. is prohibited.
For Open Source Copyright information, see Appendix G, "Open Source Copyright and License Statements", on page
1787.

Trademark Statements
Infoblox, the Infoblox logo, Grid, NIOS, bloxTools, Network Automation and PortIQ are trademarks or registered
trademarks of Infoblox Inc.
All other trademarked names used herein are the properties of their respective owners and are used for identification
purposes only.

Company Information
http://www.infoblox.com/contact/

Product Information
Hardware Models
Infoblox Advanced Appliances: PT-1400, PT-2200, PT-4000, and PT-4000-10GE
Network Insight Appliances: ND-800, ND-1400, ND-2200, and ND-4000
Trinzic Appliances: TE-100, TE-810, TE-820, TE-1410, TE-1420, TE-2210, TE-2220, Infoblox-4010, and Infoblox-4020
All Trinzic Rev-1 and Rev-2 appliances
Cloud Network Automation: CP-V800, CP-V1400, and CP-V2200
Trinzic Reporting: TR-800, TR-1400, TR-2200, and TR-4000
DNS Cache Acceleration Appliances: IB-4030 and IB-4030-10GE
Document Number: 400-0615-000 Rev. A
Document Updated: January 28, 2016

Warranty Information
Your purchase includes a 90-day software warranty and a one year limited warranty on the Infoblox appliance, plus
an Infoblox Warranty Support Plan and Technical Support. For more information about Infoblox Warranty information,
refer to the Infoblox Web site, or contact Infoblox Technical Support.
Contents
Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Document Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Documentation Conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
What’s New . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Related Documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Customer Care . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Software Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Part 1 Appliance GUI

Chapter 1 Infoblox Grid Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Management System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Supported Browsers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Browser Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
About Grid Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Admin Permissions for Grid Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Logging in to the GUI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Setting Login Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Specifying the Grid Name and Hostname . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Creating a Login Banner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Changing the Password and Email Address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Specifying the Table Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Selecting Your Home Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Setting the Browser Time Zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
SSL (Secure Sockets Layer) Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Managing Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
About HTTPS Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
About Client Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
About CA Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Converting CA Certificates to PEM Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
About the Grid Manager Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
System Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Security and Informational Banners. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Breadcrumbs Navigation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Global Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Finder Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Toolbar Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Help Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Wizards and Editors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Tooltips. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Customizing Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Selecting Objects in Tables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Modifying Data in Tables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

NIOS 7.3 NIOS Administrator Guide (Rev. A) 3

Contents

Finding and Restoring Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Using Bookmarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Using the Recycle Bin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Managing Third Party URL Links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Using Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Using Quick Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Using Global Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Using the Go To Function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
About Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Viewing Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Using the Task Manager Action Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Supported Objects for Scheduled and Approval Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Guidelines for Upgrading, Backing Up, and Restoring Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Scheduling Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Scheduling New IPAM/DHCP Objects and Associated Port Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Scheduling Creation of new IPv4/IPv6 Networks and Associated Device Provisioning . . . . . . . . . . . . . . . . . . 88
Scheduling Additions and Modifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Scheduling Appliance Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Scheduling Deletions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Scheduling Recursive Deletions of Network Containers and Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Viewing Scheduled Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Rescheduling Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Canceling Scheduled Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Configuring Approval Workflows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Supported Tasks for Different Admin Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Creating Approval Workflows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Viewing Approval Workflows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Modifying Approval Workflows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Deleting Approval Workflows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Viewing Approval Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Viewing Workflow Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Unsupported Operations for Submitters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
About Long Running Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Running Tasks in the Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Monitoring Long Running Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
About CSV Import . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
CSV Import User Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
CSV Import Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Configuring Import Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Viewing CSV Import Jobs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Modifying CSV Import Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Deleting Uploaded Jobs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Downloading Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Creating a Data File for Import . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Exporting Data to Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Exporting New CSV Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Managing CSV Export Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Modifying CSV Export Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Exporting Displayed Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Printing from Grid Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Multilingual Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
UTF-8 Supported Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
UTF-8 Support Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

4 NIOS Administrator Guide (Rev. A) NIOS 7.3

Support for Internationalized Domain Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Decoding IDNs and Encoding Punycode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
IDN Supported Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
IDN Support Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Chapter 2 Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

About Dashboards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
The Tasks Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
About Task Packs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
The IPAM Task Pack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Enabling the Network Automation Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Registering Network Automation with NIOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
The Network Automation Task Pack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Network Automation Task Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Network Provisioning Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Using the Port Activation Automation Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
VLAN Reassignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Provision Bare Metal Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Rogue DHCP Server Remediation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Using the Task Viewer to View Job Logs and Approve Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
About Dashboard Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Adding Dashboard Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Resetting Dashboard Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Modifying Dashboard Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Deleting Dashboard Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Assigning Dashboard Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Status Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Adding Widgets to Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Grid Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Grid Upgrade Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Member Status (System Status) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
DNS Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Ranges Over Threshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
IPv4 Failover Associations Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
DHCP Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Network Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Network Users - Active Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
IPv4 Networks Over Threshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Port Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Discovery Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Advanced Discovery Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
My Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
DDNS Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
System Activity Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
File Distribution Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Active WebUI Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Microsoft Servers Status Widget . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
CSV Import Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Load Balancer Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Pending Approvals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Infoblox Community . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Mobile Devices Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
DNS Integrity Check. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Cloud Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

NIOS 7.3 NIOS Administrator Guide (Rev. A) 5

Contents

Security Status for Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

Security Status for All Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Threat Protection Status for Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Threat Protection Status for Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Response Policy Zone (RPZ) Status for Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Response Policy Zone (RPZ) Status for Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Pool Licenses Statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
DNS Record Scavenging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

Chapter 3 Smart Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

About Smart Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Global Smart Folders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
My Smart Folders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Predefined Smart Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Creating Smart Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Viewing and Modifying Data in Smart Folders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Modifying Smart Folders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Deleting Smart Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Saving a Copy of a Smart Folder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Printing and Exporting Data in Smart Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Part 2 Appliance Administration

Chapter 4 Managing Administrators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

About Admin Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
About Admin Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Creating Superuser Admin Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Creating Limited-Access Admin Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
About Admin Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Creating Admin Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Managing Admin Groups and Admin Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Modifying Admin Groups and Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Deleting Admin Groups and Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Viewing Admin Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Viewing Admin Roles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Viewing Admin Group Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
About Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Defining Global Permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Defining Object Permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
Defining DNS and DHCP Permissions on Grid Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Applying Permissions and Managing Overlaps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
Managing Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Authenticating Administrators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Creating Local Admins. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Managing Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Modifying and Deleting Admin Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
About Remote Admins. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Authenticating Admins Using RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Authentication Protocols. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Accounting Activities Using RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

6 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Remote RADIUS Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Configuring RADIUS Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Configuring a RADIUS Authentication Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Authenticating Admins Using Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Configuring an Active Directory Authentication Service Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Enabling Active Directory Authentication for Nested Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Authenticating Admin Accounts Using TACACS+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
TACACS+ Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Configuring TACACS+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Configuring a TACACS+ Authentication Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Authenticating Admins Using LDAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Authentication Protocols. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Configuring LDAP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Configuring an LDAP Server Group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Defining the Authentication Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Configuring a List of Authentication Server Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Configuring a List of Remote Admin Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Authenticating Admins Using Two-Factor Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Best Practices for Configuring Two-Factor Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Configuring the OCSP Authentication Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Viewing the OCSP Authentication Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Changing Password Length Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Notifying Administrators. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Administrative Permissions for Common Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Administrative Permission for the Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Administrative Permissions for Grid Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Administrative Permissions for Network Discovery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Administrative Permissions for Scheduling Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Administrative Permissions for Microsoft Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Administrative Permissions for IPAM Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Administrative Permissions for IPv4 and IPv6 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Administrative Permissions for Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Administrative Permissions for DHCP Fingerprint Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Administrative Permissions for Network Insight Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Administrative Permissions for DNS Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Administrative Permissions for DNS Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Administrative Permissions for Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Administrative Permissions for Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Administrative Permissions for Adding Blank A or AAAA Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Administrative Permissions for Shared Record Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Administrative Permissions for DNS64 Synthesis Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
Administrative Permissions for DNS Resources with Associated IP addresses in Networks and Ranges . . . . . . . . 247
Best Practices for Configuring Permissions in Networks and Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Changes to Default Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Enabling Permissions for DNS Resources in Networks and Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Configuring Permissions for DNS Resources in Networks and Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Permission Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Administrative Permissions for DHCP Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Administrative Permissions for Network Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Administrative Permissions for IPv4 and IPv6 Networks and Shared Networks . . . . . . . . . . . . . . . . . . . . . . . 255
Administrative Permissions for IPv4 or IPv6 Fixed Addresses and IPv4 Reservations . . . . . . . . . . . . . . . . . . 257
Administrative Permissions for IPv4 or IPv6 DHCP Enabled Host Addresses. . . . . . . . . . . . . . . . . . . . . . . . . . 258
Administrative Permissions for IPv4 and IPv6 DHCP Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Administrative Permissions for IPv4 or IPv6 DHCP Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

NIOS 7.3 NIOS Administrator Guide (Rev. A) 7

Contents

Administrative Permissions for Roaming Hosts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260

Administrative Permissions for MAC Address Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Administrative Permissions for the IPv4 and IPv6 DHCP Lease Histories . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Administrative Permissions for File Distribution Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Administrative Permissions for Dashboard Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Administrative Permissions for OCSP Server Groups and CA Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Administrative Permissions for Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Administrative Permissions for Named ACLs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Administrative Permissions for DNS Threat Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Administrative Permissions for All Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Administrative Permissions for Cloud Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Administrative Permissions for CSV Import . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Administrative Permissions for Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Chapter 5 Deploying a Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

Introduction to Grids . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Grid Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
NAT Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
Automatic Software Version Coordination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Grid Bandwidth Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
About HA Pairs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
Planning for an HA Pair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
About HA Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
VRRP Advertisements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Creating a Grid Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
Port Numbers for Grid Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Grid Setup Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Creating an HA Grid Master. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Creating a Single Grid Master. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Adding Grid Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Adding a Single Member. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Adding an HA Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
Changing the Communication Protocol for a Dual Mode Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
Joining Appliances to the Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
Grouping Members by Extensible Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
Configuring an IPv6-only Grid. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Transforming to an IPv6-only Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Auto-Provisioning NIOS Appliances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Setting Up Physical Appliances Using Auto-Provisioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Joining Auto-Provisioned Appliances to the Grid. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
Pre-Provisioning NIOS and vNIOS Appliances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Guidelines for Pre-provisioning Offline Grid Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Configuring Pre-Provisioned Members. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
About Provisional Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
Guidelines for Joining Pre-Provisioned Members to the Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Configuration Example: Configuring a Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
Cable All Appliances to the Network and Turn On Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
Create the Grid Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
Define Members on the Grid Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316
Join Appliances to the Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
Import DHCP Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
Import DNS Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

8 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using the Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
After Using the Wizard. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324
Managing a Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
Changing Grid Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
Configuring Security Level Banner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Configuring Notice and Consent Banner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Configuring Informational Level Banner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
Configuring Recursive Deletions of Networks and Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
Setting the MTU for VPN Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328
Removing a Grid Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328
Promoting a Master Candidate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328
Enabling Read-only API Access on the Grid Master Candidate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
About the Master Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330

Chapter 6 Deploying Independent Appliances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

Independent Deployment Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
System Manager GUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
Deploying a Single Independent Appliance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
Method 1 – Using the LCD. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335
Method 2 – Using the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336
Method 3 – Using the Infoblox NIOS Startup Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
Changing the Communication Protocol for a Dual Mode Independent Appliance. . . . . . . . . . . . . . . . . . . . . . 339
Configuration Example: Deploying a NIOS Appliance as a Primary DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340
Cabling the Appliance to the Network and Turning On Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Specifying Initial Network Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Specifying Appliance Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Enabling Zone Transfers on the Legacy Name Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342
Importing Zone Data on an Independent Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
Designating the New Primary on the Secondary Name Server (at the ISP Site) . . . . . . . . . . . . . . . . . . . . . . . 345
Configuring NAT and Policies on the Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346
Deploying an Independent HA Pair. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346
Using the Infoblox NIOS Startup Wizard to Configure an HA Pair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346
Configuration Example: Configuring an HA Pair for Internal DNS and DHCP Services . . . . . . . . . . . . . . . . . . . . . . . 350
Cabling Appliances to the Network and Turning On Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Specifying Initial Network Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352
Specifying Appliance Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352
Enabling Zone Transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354
Importing Zone Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354
Defining Networks, Reverse-Mapping Zones, DHCP Ranges, and Infoblox Hosts . . . . . . . . . . . . . . . . . . . . . . 354
Defining Multiple Forwarders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356
Enabling Recursion on External DNS Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
Modifying the Firewall and Router Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358
Enabling DHCP and Switching Service to the NIOS Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358
Managing and Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359
Verifying the Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360
Single Independent Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360
Independent HA Pair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360
Infoblox Tools for Migrating Bulk Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360

Chapter 7 Deploying Cloud Network Automation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361

Introduction to Cloud Network Automation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362
Cloud Network Automation Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362

NIOS 7.3 NIOS Administrator Guide (Rev. A) 9

Contents

Licensing Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364

Licensing Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365
Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366
Supported Cloud Platform Appliance Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
Setting Up Cloud Network Automation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368
About Cloud API Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368
Starting the Cloud API Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
Monitoring Cloud API Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
About Cloud API Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
Cloud API Request Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
Supported Cloud API Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
Proxying Cloud API Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374
Sample Cloud API Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374
Sample Cloud API Requests for Elastic Scaling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
About Authority Delegation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376
Guidelines for Delegating Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377
Delegating Authority for Cloud Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378
Configuring Grid and Member Cloud API Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
Extensible Attributes for Cloud Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386
Viewing Cloud Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388
Viewing All Tenants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389
Viewing All VPCs (Virtual Private Clouds). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
Viewing All Cloud Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
Viewing All Cloud VMs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392
Viewing All Cloud Platform Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393

Chapter 8 Managing Appliance Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395

Configuring Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Operations that Support Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Defining Named ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400
Managing Named ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401
Applying Access Control to Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403
Managing Time Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
Changing Time and Date Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
Changing Time Zone Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
Monitoring Time Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
Using NTP for Time Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
Authenticating NTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
NIOS Appliances as NTP Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408
Configuring the Grid to Use NTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409
Configuring Grid Members to Use NTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411
NIOS Appliances as NTP Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413
Configuring a NIOS Appliance as an NTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414
Monitoring NTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416
About Extensible Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417
Adding Extensible Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419
Configuring Inheritable Extensible Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421
Viewing Extensible Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
Modifying Extensible Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
Deleting Extensible Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427
Using Extensible Attributes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427
Grouping Results by Extensible Attributes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430

10 NIOS Administrator Guide (Rev. A) NIOS 7.3

Configuration Examples for Inheritable Extensible Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430
Managing Security Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Enabling Support Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Restricting Remote Console Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Enabling Remote Console Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Permanently Disabling Remote Console and Support Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Restricting GUI/API Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Enabling HTTP Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440
Modifying the Session Timeout Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440
Disabling the LCD Input Buttons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440
Configuring Security Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440
Configuring Proxy Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442
Configuring Members and Interfaces for Automatic Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 443
Configuring Ethernet Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 443
Enabling GUI and API Access on the MGMT and LAN1/VIP Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444
About Virtual LANs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444
Implementing Quality of Service Using DSCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447
Ethernet Port Usage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448
Modifying Ethernet Port Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456
Using the LAN2 Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
About Port Redundancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
Configuring the LAN2 Port. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
Enabling DHCP on LAN2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
Enabling DNS on LAN2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460
Using the MGMT Port. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
Appliance Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462
Grid Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
DNS Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
About Lights Out Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467
Enabling LOM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468
Adding LOM User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469
Configuring the IPMI Network Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469
Modifying LOM Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470
Viewing LOM Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470
IPMI Commands and Examples. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470
Setting Static Routes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472
Defining IPv6 Static Routes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476
Enabling DNS Resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477
Managing Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478
License Types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478
Managing Static Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478
Managing Dynamic Licenses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
Adding Permanent Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482
Adding Temporary Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483
Viewing Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483
Backing Up Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485
Removing Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485
About Elastic Scaling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
Using Elastic Scaling to Pre-provision and Launch vNIOS Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
Generating Tokens for Grid Members. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
Configuring Token Usage Timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
Using CLI Commands to Join Grid Members. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
Managing the Order of Match Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
Managing NIOS Appliances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489

NIOS 7.3 NIOS Administrator Guide (Rev. A) 11

Contents

Restarting a Grid Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489

Rebooting a NIOS Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
Shutting Down a NIOS Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
Forcing an HA Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
Restarting GUI Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
Resetting a NIOS Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
Managing the Disk Subsystem on the Infoblox-4010 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
About RAID 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
Evaluating the Status of the Disk Subsystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493
Disk Drive Front Panel LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494
Replacing a Failed Disk Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494
Disk Array Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
Restarting Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
User Permissions for Restarting Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
Restarting Grid Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
Restarting Member Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497
Restarting Services by Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498
Configuring Restart Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501
Canceling a Scheduled Restart Task. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501

Chapter 9 File Distribution Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503

File Distribution Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
File Distribution Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506
Usage Threshold Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506
Modifying File Distribution Storage Limits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506
Managing File Distribution Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507
Configuring the TFTP Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507
Configuring the FTP Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507
Configuring the HTTP Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508
Configuring Access Control for File Distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508
Modifying Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509
Starting and Stopping File Distribution Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510
Monitoring File Distribution Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510
Managing Directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
Adding Directories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
Modifying Directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
Creating a Virtual TFTP Root Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
Viewing Directories From the Files Tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 512
Managing Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
Uploading Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
Enabling Upload to Grid Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
Uploading Files using Grid Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
Uploading Files Using TFTP, FTP, or HTTP File Transfer Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 514
Deleting Files From the Grid Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 514
Deleting Files From a Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 514
Viewing Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515
Viewing Files from the Files Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515
Viewing Files from the Members Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515
Managing Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516
Users Default Home Directory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516
Adding FTP Users through Grid Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 517
Adding FTP Users through CSV Import . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 517
Modifying FTP Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 517

12 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 10 Managing NIOS Software and Configuration Files. . . . . . . . . . . . . . . . . . . . 519
About Upgrades. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
Lite Upgrades. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
Full Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522
Guidelines for Scheduling Full Upgrades. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522
Microsoft Management Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524
Managing Upgrade Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524
Adding Upgrade Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525
Modifying Upgrade Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526
Viewing Upgrade Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526
Deleting Upgrade Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527
Viewing Software Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527
Upgrading NIOS Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527
Uploading NIOS Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528
Distributing Software Upgrade Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528
Managing Distributions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530
Testing Software Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531
Performing Software Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532
Managing Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536
Monitoring Distribution and Upgrade Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537
Downgrading Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 538
Reverting the Grid to the Previously Running Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539
Applying Hotfixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539
Backing Up and Restoring Configuration Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540
Backing Up Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541
Automatically Backing Up Data Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542
Manually Backing Up Data Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 544
Downloading Backup Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545
Restoring Backup Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545
Downloading Backup Files from a Different Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 546
Downloading Support Bundles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547

Chapter 11 bloxTools Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549

About the bloxTools Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550
System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550
Using the bloxTools Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
Configuring the Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
Allocating Memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552
Uploading Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552
Scheduling Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
Moving the bloxTools Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
Monitoring the Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554
Viewing the Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554
Viewing Detailed Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554

Chapter 12 RIR Registration Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555

RIR Address Allocation and Registration Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556
About the RIPE Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556
Requirements and Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556
Configuring RIR Registration Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557
Enabling Support for RIR Registration Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557

NIOS 7.3 NIOS Administrator Guide (Rev. A) 13

Contents

Configuring RIR Communication Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558

Managing RIR Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
Adding RIR Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559
Modifying RIR Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
Deleting RIR Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
Adding and Assigning RIR Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
Viewing RIR networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561
Modifying RIR Network Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561
Deleting RIR Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 562
Managing RIR Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 562
RIR Organizational Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
RIR Network Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565
Monitoring RIR Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 569
Viewing RIR Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 569
Previewing Registration Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 569

Part 3 IP Address Management

Chapter 13 IP Address Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575

About IP Address Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577
About Host Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578
Assigning Multiple IP Addresses to a Host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579
Adding Host Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579
Copying and Modifying Host Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583
About Network Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 584
Adding IPv4 and IPv6 Network Containers and Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585
Modifying IPv4 and IPv6 Network Containers and Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585
Deleting Network Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585
Managing IPv4 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 586
IPv4 Network Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 586
IPAM Home. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590
Resizing IPv4 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591
Splitting IPv4 Networks into Subnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592
Joining IPv4 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592
Discovering Networks (Under Network Insight only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593
Deleting Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593
Viewing and Managing IPv4 Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594
IP Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594
IP Address List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 595
IP List Neighbor Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597
Using the List Panel Action Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597
Additional IP List Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598
Managing IPv4 Addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600
Viewing Router Redundancy Information for Virtual IPs (VIPs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602
Managing IPv6 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602
IPv6 Network Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602
IPv6 Network List. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606
Splitting IPv6 Networks into Subnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606
Joining IPv6 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607
Viewing IPv6 Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607
Managing IPv4 and IPv6 Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608
Converting Objects Associated with IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609

14 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Reclaiming Objects Associated with IPv4 and IPv6 Addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612
Pinging IP Addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612
Clearing Active DHCP Leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612
Configuring Thresholds for IPAM Utilization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 613
About Network Insight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 614
Viewing Identity Mapping Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 614
Enabling Identity Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615
Viewing Active Network Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615
Viewing Network Users Login History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 616
Configuring Active User Timeout Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 616
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 616

Chapter 14 IP Discovery and vDiscovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617

About Discovery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619
Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 620
IP Discovery Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621
Supported IP Discovery Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 622
Guidelines Before Starting a Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
Database Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
Database Capacity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
HA Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
Configuring IP Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
Guidelines for Starting and Scheduling IP Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
Configuring and Starting an IP discovery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627
Defining IP Discovery Method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627
Scheduling IP Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 628
Monitoring IP Discovery Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
Configuring vDiscovery Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
Guidelines for Configuring vDiscovery Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
Selecting the vDiscovery Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632
Selecting the Endpoint Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632
Defining Network Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
Defining Policies for Handling Discovered Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 634
Scheduling vDiscovery Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 640
Managing vDiscovery Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641
Viewing Discovered Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 642
Viewing IPAM Discovered Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 642
Viewing Discovered Data for Cloud VMs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645
Managing Discovered Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645
Managing Unmanaged Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645
Resolving Conflicting Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647
Clearing Discovered Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 649
Clearing All Discovery Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650
Integrating Discovered Data From Trinzic Network Automation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650

Chapter 15 Infoblox Network Insight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653

About Network Insight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656
Supported Appliances for Network Insight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656
Consolidator and Probes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658
Deployment Guidelines for Consolidator and Probes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659
Supported Discovery Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659

NIOS 7.3 NIOS Administrator Guide (Rev. A) 15

Contents

Starting Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 663

Managing Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 664
Discovering VRF Virtual Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665
Special Considerations for Managing VRF Virtual Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665
VRF Deployment Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
Defining Network Views and Discovery Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668
Administrative Permissions for Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673
Starting and Stopping the Discovery Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674
Starting the Discovery Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674
Stopping the Discovery Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674
Defining the Discovery Member Type. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
Mapping Discovery Interfaces to Network Views. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
Configuring Discovery Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676
Defining Basic Polling Settings for the Grid. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677
Defining Advanced Polling Settings for the Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678
Configuring SNMP1/v2 Credentials for Polling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 680
Configuring SNMPv3 Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 680
Configuring CLI Discovery Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 681
Defining CLI Credentials Settings for Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 682
Testing SNMP and CLI Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683
Defining Seed Routers for Probe Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 684
Excluding IP Addresses from Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685
Quick Exclusion of IPs from Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685
Creating a New IPAM Object and Excluding it from Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686
Excluding IP Addresses in Grid Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687
Discovering Devices and Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687
Using Discover Now to Discover an Existing Object. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689
Smart Folders and Discovered Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689
Using the Device Selector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689
Tips for Quick Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691
Managing Discovered Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691
Converting Unmanaged Devices to Managed Devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692
Converting Unmanaged Networks to Managed Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693
Converting Unmanaged Networks under IPAM to Managed Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694
Converting Unmanaged Interfaces to Managed Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 696
Converting Unmanaged IP Addresses to Managed Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 697
Converting Unmanaged Assets to Managed Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 698
Viewing Discovered Devices and their Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 698
Viewing the Complete List of Discovered Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 698
Viewing Discovered VRFs and Mapping Network Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 700
Accessing Detailed Device Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701
Viewing Interface Information for Discovered Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701
Determining Interface Capabilities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 702
Viewing Networks Associated with Discovered Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704
Modifying Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705
Viewing IP Addresses Associated with Discovered Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 706
Viewing Router Redundancy Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707
Viewing Assets Associated with Discovered Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708
Viewing Components of Discovered and Managed Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 710
Viewing Discovery Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 710
Analyzing Discovery Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711
Executing Discovery Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 712
Viewing the Management State of IPs in Discovered Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713
Disabling Discovery for a Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713

16 NIOS Administrator Guide (Rev. A) NIOS 7.3

Adding Discovery Device Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 714
Port Control Features in Network Insight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 714
About Port Reservations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 715
Editing Interfaces in a Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 716
Editing Multiple Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717
Editing Multiple Interfaces from the Devices Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 719
Inline Interface Editing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 719
Provisioning and De-Provisioning Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 720
De-provisioning Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 721
Troubleshooting Port Control Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723
Creating Port Reservations for IPAM Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723
Editing Port Reservation Settings for IPAM Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725
Defining Port Reservations for an Infoblox Grid Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726
Defining Port Reservations for an HA Pair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726
Editing Port Reservation Settings for an Infoblox Grid Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 729
Defining Device Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 729
Defining Blackout Periods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 731
Defining Blackout Periods for the Grid. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 731
Defining Blackout Periods for Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 732
Defining Port Configuration Blackout Periods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733
Defining Port Configuration Blackouts for the Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733
Defining Port Configuration Blackouts for Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734
Conflict Resolution in Network Insight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 736
Resolving Port Reservation Conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 737
Resolving Multiple Conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 738

Part 4 DNS

Chapter 16 Infoblox DNS Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 743

Configuring DNS Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 744
DNS Configuration Checklist. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 745
About Inheriting DNS Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 745
Overriding DNS Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 746
Understanding DNS for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 747
Configuring IPv6 on a Grid Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748
Configuring DNS for IPv6 Addressing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 749

Chapter 17 Configuring DNS Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 751

Configuring DNS Service Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 753
Configuring DNS Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 753
About Time To Live Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 753
Configuring Hostname and Server ID Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756
Enabling and Disabling DNS Health Check Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757
Adding an Email Address to the SOA Record . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757
Notifying External Secondary Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 758
Enabling the Configuration of RRset Orders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759
Specifying Port Settings for DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760
Using Extension Mechanisms for DNS (EDNS0). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761
Deleting PTR Records associated with A or AAAA Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762
Specifying Minimal Responses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763
Starting and Stopping the DNS Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763

NIOS 7.3 NIOS Administrator Guide (Rev. A) 17

Contents

About DNS Cache. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763

Clearing DNS Cache. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763
Clearing Cache for DNS Views. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764
Clearing Domain Names from Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764
Viewing DNS Cache Entries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764
Viewing DNS Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 765
Viewing DNS Cache Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 766
Viewing Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 766
Using Forwarders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767
Specifying Forwarders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767
Controlling DNS Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767
Specifying Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 768
Enabling Recursive Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769
Enabling Recursion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769
Restricting Recursive Client Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 770
Controlling AAAA Records for IPv4 Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 770
Enabling AAAA Filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 771
About NXDOMAIN Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 772
About NXDOMAIN Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773
Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773
NXDOMAIN Redirection Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 774
Configuring NXDOMAIN Redirection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775
Creating Rulesets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775
Enabling NXDOMAIN Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776
Detecting and Mitigating DNS DDoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776
Automated Mitigation of Phantom Domain Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777
Guidelines for Mitigating Phantom Domain Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777
Configuring Parameters for Mitigating Phantom Domain Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777
Detecting NXDOMAIN Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 779
Tracking NXDOMAIN Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 779
Tracking Cache Hit Ratio of Recursive Queries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 782
Tracking Dropped UDP Packets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 783
Mitigating Possible NXDOMAIN Attacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 783
Support for RRL (Response Rate Limiting) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784
About Blacklists. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784
About Blacklist Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 785
Blacklist Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786
Configuring the Blacklist Feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786
Enabling Blacklisting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787
Enabling Zone Transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788
Configuring Zone Transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 789
Configuring Concurrent Zone Transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 791
About Root Name Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792
Specifying Root Name Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792
About Sort Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792
Defining a Sort List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 793
Configuring a DNS Blackhole List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794
Defining a DNS Blackhole List. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794
Specifying Hostname Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795
Defining Grid Hostname Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 796
Defining Hostname Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 797
Obtaining a List of Invalid Record Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 797
About DNS64 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 798
Configuring DNS64 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 799

18 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Synthesis Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 799
DNS Record Scavenging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803
DNS Queries Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 808

Chapter 18 DNS Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811

Using Infoblox DNS Views. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812
About DNS Views and Network Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814
Configuring DNS Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814
Adding a DNS View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815
Defining Match Clients Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815
Defining a Match Destinations List. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817
Enabling the Match Recursive Only Option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818
Copying Zone Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818
Managing the DNS Views of a Grid Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819
Managing Recursive DNS Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820
Managing the Order of DNS Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820
Managing DNS Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 821
Configuration Example: Configuring a DNS View. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 823

Chapter 19 Configuring DNS Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827

About Authoritative Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829
Configuring Authoritative Zones. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829
Creating an Authoritative Forward-Mapping Zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 830
Creating an Authoritative Reverse-Mapping Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 830
Creating a Root Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 832
Adding an Authoritative Subzone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 833
Locking and Unlocking Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 834
Enabling and Disabling Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 834
Configuring Authoritative Zone Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 834
About DNS Integrity Check for Authoritative Zones. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836
Configuring DNS Integrity Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836
Monitoring DNS Data Discrepancies for Authoritative Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837
About Domains and Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 838
IDN Support For DNS Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 838
Assigning Zone Authority to Name Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 839
Best Practices for Defining Multiple Primaries for Authoritative Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 840
Specifying a Primary Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 840
Specifying Secondary Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 843
Configuring Domain Controller List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 846
Configuring Domain Controller List on NIOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 846
Configuring Domain Controller List on the Microsoft Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 847
Using Name Server Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 847
Adding Name Server Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 848
Viewing Name Server Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 848
Applying Name Server Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 849
Importing Zone Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 849
About Importing Data into a New Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 851
About Importing Data into an Existing Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 851
Importing Data into Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 851
Removing Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852
Restoring Zone Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 854
Configuring Delegated, Forward, and Stub Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 857

NIOS 7.3 NIOS Administrator Guide (Rev. A) 19

Contents

Configuring a Delegation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 857

Configuring a Forward Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 860
Configuring Stub Zones. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 864
Viewing Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 873

Chapter 20 DNS Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 875

About Bulk Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876
Specifying Bulk Host Name Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876
Before Defining Bulk Host Name Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876
Adding Bulk Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 879
Managing Resource Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 880
Managing A Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 880
Managing NS Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 882
Managing AAAA Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 883
Managing PTR Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 884
Managing MX Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885
Managing SRV Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886
Managing TXT Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888
Managing CNAME Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889
Managing DNAME Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891
Managing NAPTR Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 896
Managing LBDN Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 898
Viewing Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 898
Modifying, Disabling, and Deleting Host and Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 899
About Shared Record Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 900
Shared Records Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901
Configuring Shared Record Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901
Managing Shared Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 903
Managing Associated Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 906
Configuration Example: Configuring Shared Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 907

Chapter 21 Configuring DDNS Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 909

Understanding DDNS Updates from DHCP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 911
Configuring DHCP for DDNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 915
Enabling DDNS for IPv4 and IPv6 DHCP Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 915
Sending Updates to DNS Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 916
Configuring DDNS Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 919
Resending DDNS Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 919
Generating Host Names for DDNS Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 919
Updating DNS for IPv4 Clients with Fixed Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 919
Configuring DDNS Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 920
Replacing Host Names for DDNS Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 920
About the Client FQDN Option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 923
Enabling FQDN Option Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 924
Sending Updates for DHCP Clients Using the FQDN Option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 924
Configuring DDNS Update Verification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 925
Configuring DNS Servers for DDNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 927
Enabling DNS Servers to Accept DDNS Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 928
Forwarding Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 929
Supporting Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 930
Sending DDNS Updates to a DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 931
About GSS-TSIG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 931

20 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Sending Secure DDNS Updates to a DNS Server in the Same Domain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 933
Configuring DHCP to Send GSS-TSIG Updates in the Same Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 934
Sending Secure DDNS Updates to a DNS Server in Another Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 941
Configuring DHCP to Send GSS-TSIG Updates to Another Domain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 942
Sending GSS-TSIG Updates to a DNS Server in Another Forest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 943
Configuring GSS-TSIG keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 944
Limitations when Using Multiple GSS-TSIG keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 945
Scheduled Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 945
Admin Permissions for Configuring GSS-TSIG keys. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 945
Enabling GSS-TSIG Authentication for DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 945
Deleting GSS-TSIG keys associated with DHCP Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 946
Enabling GSS-TSIG Authentication for DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 947
Deleting GSS-TSIG keys associated with the DNS Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948
Logging Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948
Managing GSS-TSIG keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948
Selecting Keys in the GSS-TSIG Key Selector. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949
Accepting DDNS Updates from DHCP Clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949
Supporting Active Directory and Unauthenticated DDNS Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 950
Accepting GSS-TSIG-Authenticated Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 951
Configuring DNS to Receive GSS-TSIG Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953
Secure Dynamic Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 959
Restricting Updates to Static Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 959
Restricting Updates to Protected Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 960
Restricting Updates Based on GSS-TSIG Principal Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 960
Restricting Updates Based on FQDN Patterns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 962

Chapter 22 DNSSEC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963

About DNSSEC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 965
DNSSEC Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 966
DNSKEY Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 966
RRSIG Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 968
NSEC/NSEC3 Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 969
NSEC3PARAM Resource Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 970
DS Resource Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 970
Configuring DNSSEC on a Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 971
Grid Master as Primary Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 972
Enabling DNSSEC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 973
Setting DNSSEC Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 973
About the DNSKEY Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 974
About Key Rollovers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 974
RRSIG Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 975
Configuring DNSSEC Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 975
Applying the Algorithm Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 977
Deleting the DNSSEC Keys Associated with a Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 977
Signing a Zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 978
Managing Signed Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 981
Importing a Keyset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 981
Exporting Trust Anchors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 981
Checking Key-Signing Keys. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 982
Rolling Key-Signing Keys. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 982
Rolling Zone-Signing Keys. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 983
Best Practices for Configuring Zone Signing Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 983
Unsigning a Zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 983

NIOS 7.3 NIOS Administrator Guide (Rev. A) 21

Contents

Deleting and Restoring Signed Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 984

Configuring Automatic KSK Rollovers and Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 984
Configuring NSEC3 Salt Length and Hashing Iterations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 985
Deleting Server Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 986
Configuring Emergency KSK Rollover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 986
Viewing Scheduled Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 987
About HSM Signing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 987
Configuring a SafeNet HSM Device. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 988
Monitoring the HSM Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 990
Enabling HSM Signing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 991
Testing the HSM Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 991
Synchronizing the HSM Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 991
Configuring Grid Members to Support DNSSEC as Secondary Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 991
Configuring Recursion and Validation for Signed Zones. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 992
Enabling Recursion and Validation for Signed Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 992
Enabling DNSSEC Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993
Defining Negative Trust Anchors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 994
Applying Policies and Rules to DNS Queries that Request DNSSEC Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 995

Chapter 23 Managing DNS Traffic Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 997

About DNS Traffic Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 999
DNS Traffic Control Configuration Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 999
DNS Traffic Control Querying Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1001
Supported DNS Traffic Control Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1002
License Requirements and Admin Permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1002
Limitations of DNS Traffic Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1003
Configuring Topology Rules and Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1003
Defining Topology Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1003
Managing and Viewing Topology Rulesets and Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1005
Importing a Topology Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1006
About Health Monitors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1006
Configuring DNS Traffic Control Health Monitors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1007
Managing Health Monitor Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1007
Modifying Health Monitors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014
Deleting Health Monitors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1015
Viewing Health Monitors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1015
Managing DNS Traffic Control Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016
Configuring DNS Traffic Control Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016
Modifying DNS Traffic Control Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1018
Configuring DNS Traffic Control Pools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1018
Modifying DNS Traffic Control Pools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020
Configuring DNS Traffic Control LBDNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020
Modifying DNS Traffic Control LBDNs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1024
Testing DTC LBDNs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1025
Deleting DNS Traffic Control Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1025
Viewing DNS Traffic Control LBDNs and LBDN Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1026
Viewing DNS Traffic Control Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1026
Viewing Traffic Management Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027
Enabling or Disabling Traffic Management Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1029

22 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 24 Configuring IP Routing Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1031
Using the Loopback Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1032
Configuring IP Addresses on the Loopback Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1032
Advertising Loopback Addresses to the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1034
About Anycast Addressing for DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1035
Configuring Anycast Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1036
Best Practices for Configuring Anycast Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1038
IP Routing Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1038
About OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1039
Anycast and OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1039
Configuring OSPF on the NIOS Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1041
Anycast and BGP4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1043
Configuring BGP in the NIOS Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1045

Part 5 DHCP

Chapter 25 Infoblox DHCP Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1049

About Infoblox DHCP Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1050
IPv4 DHCP Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1050
IPv6 DHCP Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1051
IPv6 Address Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1052
Configuring DHCP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1053
Managing DHCP Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1055
About Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1055
About Shared Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1055
About DHCP Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056
About Fixed Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056
About Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056
DHCP Configuration Checklists. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056
About DHCP Inheritance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1058
Overriding DHCP Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1059
Viewing Inherited Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1059
About Network Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1063
Adding Network Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1065
Modifying Network Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1066
Deleting Network Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1066

Chapter 26 Configuring DHCP Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069

About DHCP Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
Configuring IPv4 DHCP Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
Configuring General IPv4 DHCP Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
Specifying Authoritative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072
Defining Lease Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072
Configuring General IPv4 Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072
Configuring Fixed Addresses without Restarting DHCP Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073
Configuring Ping Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073
Configuring One Lease per Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075
Ignoring DHCP Client Identifiers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075
Limitations of the Ignore Client ID Feature on DHCP Failover Associations . . . . . . . . . . . . . . . . . . . . . . . . . . 1076

NIOS 7.3 NIOS Administrator Guide (Rev. A) 23

Contents

Configuring IPv4 BOOTP and PXE Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076

About IPv4 DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078
DHCP Option Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080
Configuring IPv4 DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1081
Defining IPv4 DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082
Defining IPv4 Option Spaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082
Configuring Custom DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1083
Applying DHCP Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1083
Configuration Example: Defining a Custom Option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1084
Defining Option 60 Match Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1085
About the DHCP Relay Agent Option (Option 82). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1085
Configuring Thresholds for DHCP Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1087
Configuring DHCPv6 Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1089
Defining General IPv6 Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1089
About DHCPv6 Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1090
Configuring DHCPv6 Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1090
Defining IPv6 Option Spaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1091
Configuring Custom IPv6 DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1091
Applying DHCPv6 Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1091
Configuring DHCP IPv4 and IPv6 Common Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1092
Configuring UTF-8 Encoding for Hostnames. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1092
Associating Networks with Zones. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1093
Keeping Leases in Deleted IPv4 and IPv6 Networks and Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1094
Configuring Fixed Address Leases For Display. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095
Scavenging Leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095
Configuring DHCP Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
Configuring the Lease Logging Member. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
About IF-MAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1098
Configuring a Grid to Support IF-MAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
Validating the IF-MAP Server Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
Configuring Members as IF-MAP Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
Creating IF-MAP Client Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100
Overriding IF-MAP Publishing Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
Deleting Data from the IF-MAP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
Starting DHCP Services on a Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
Viewing DHCP Member Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104
Viewing DHCP Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1105

Chapter 27 Managing IPv4 DHCP Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107

Configuring DHCP for IPv4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1109
About the Next Available Network or IP Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1109
Obtaining the Next Available . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1110
Guidelines for the Next Available Network and IP Address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1110
Configuring IPv4 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1111
Adding IPv4 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1111
Viewing Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115
Modifying IPv4 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118
Deleting IPv4 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119
Configuring IPv4 Shared Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119
Adding IPv4 Shared Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119
Viewing Shared Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
Modifying IPv4 Shared Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
Deleting IPv4 Shared Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1121

24 NIOS Administrator Guide (Rev. A) NIOS 7.3

Configuring IPv4 Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1121
Adding IPv4 Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1122
Modifying IPv4 Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123
Controlling Lease Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1124
Deleting IPv4 Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125
Configuring IPv4 Fixed Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125
Adding IPv4 Fixed Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1126
Modifying IPv4 Fixed Addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129
Deleting Fixed Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1130
Configuring IPv4 Reservations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1131
Adding IPv4 Reservations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1131
Modifying IPv4 Reservations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1134
Viewing IPv4 DHCP Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1135
About Roaming Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1136
Configuring Roaming Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1136
Enabling Support for Roaming Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1136
Adding IPv4 Roaming Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1137
Adding IPv6 Roaming Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1137
Adding IPv4/IPv6 Roaming Hosts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1138
Viewing Roaming Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1139
Setting Properties for Roaming Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1139
Deleting Roaming Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1140

Chapter 28 Managing DHCP Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141

About DHCP Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
About IPv4 DHCP Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
About IPv4 Range Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
About IPv4 Fixed Address/Reservation Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144
About IPv4 Network Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146
Configuration Example: Creating an IPv4 Network Using a Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1149
About IPv6 DHCP Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1151
About IPv6 Range Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1151
Adding IPv6 Range Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1151
Modifying IPv6 Range Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1152
About IPv6 Fixed Address Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1153
Adding IPv6 Fixed Address Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1153
Modifying IPv6 Fixed Address Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1153
About IPv6 Network Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1154
Adding IPv6 Network Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1154
Modifying IPv6 Network Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
Viewing Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157
Deleting Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157

Chapter 29 Managing IPv6 DHCP Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1159

Configuring IPv6 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1160
Defining Global IPv6 Prefixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1160
Managing IPv6 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1161
Adding IPv6 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1161
Modifying IPv6 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1165
Deleting IPv6 Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1166
About IPv6 Shared Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1166
Adding IPv6 Shared Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1166

NIOS 7.3 NIOS Administrator Guide (Rev. A) 25

Contents

Modifying IPv6 Shared Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1167

Deleting IPv6 Shared Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1167
Configuring IPv6 Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1168
Adding IPv6 Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1168
Setting the Priority of IPv6 Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1169
Modifying IPv6 Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1169
Deleting IPv6 Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1170
Configuring IPv6 Fixed Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171
Adding IPv6 Fixed Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171
Modifying IPv6 Fixed Addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1174
Deleting IPv6 Fixed Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1175
Viewing IPv6 DHCP Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1175

Chapter 30 DHCP Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1177

About DHCP Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1178
Failover Association Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1178
Configuring Failover Associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1179
Adding Failover Associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1180
Best Practices for Restoring Microsoft DHCP Server Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1182
Managing Failover Associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1182
Modifying Failover Associations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1182
Monitoring Failover Associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1183
Deleting Failover Associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1184
Setting a Peer in the Partner-Down State. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1185
Performing a Force Recovery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1185
Recovering DHCP Failover Associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1186

Chapter 31 Configuring IPv4 DHCP Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1187

About IPv4 DHCP Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1188
IP Address Allocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1188
IP Address Allocation Using Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1191
About MAC Address Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1193
Defining MAC Address Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1194
Adding MAC Address Filter Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1195
About Relay Agent Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1195
Defining Relay Agent Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1196
About Option Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197
DHCP Hardware Operator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198
Defining Option Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198
Using Match Rules in Option Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1200
Configuring User Class Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201
Configuration Example: Using Option Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201
About DHCP Fingerprint Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1202
Defining DHCP Fingerprint Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1204
Applying Filters to DHCP Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1204
Adding Filters to the Class Filter List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1204
Adding Filters to the Logic Filter List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1205
Configuration Example: Using the Class and Logic Filter Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1207
Managing DHCP Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1210
Modifying DHCP Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1210
Viewing DHCP Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1211
Deleting Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1212

26 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 32 Authenticated DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1213
About Authenticated DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1214
DHCP Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1214
Configuring DHCP Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1218
About Authentication Server Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1218
Configuring a RADIUS Authentication Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1218
Configuring an Active Directory Authentication Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1219
About the Captive Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1221
Configuring Captive Portal Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1221
Customizing the Captive Portal Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1222
Managing Captive Portal Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1223
Starting the Captive Portal Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1225
Defining the IPv4 Network and DHCP Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1225
Defining MAC Address Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1226
Using the Captive Portal Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1226
Adding and Modifying the Filters and Associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
Monitoring DHCP Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
Viewing DHCP Ranges and Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
Configuration Example: Configuring Authenticated DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1229
NAC Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1234
Configuring NAC with RADIUS Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235
About Authentication Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1236
Adding a Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1236
Associating a Server Group with a Member. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1237
Managing Server Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1237
Clearing the Authentication Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1237
Configuring DHCP Ranges. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238
Listing DHCP Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238
About NAC Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238
Defining NAC Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1239

Chapter 33 Managing Leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1243

About DHCP Leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1244
Viewing Current Leases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1244
Viewing Detailed Lease Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1246
Viewing Lease History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247
Viewing Lease Event Detailed Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247
Exporting Lease Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1248
Clearing Leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1248

Part 6 Managing Microsoft Windows Servers

Chapter 34 Managing Microsoft Windows Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1251

About Managing Microsoft Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1253
Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1254
Deployment Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1255
Limitations for Scheduling Full Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1256
Configuring Members to Manage Microsoft Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1256
Setting Microsoft Server Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257

NIOS 7.3 NIOS Administrator Guide (Rev. A) 27

Contents

Configuring a Managing Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258

Configuring Grid Properties for Managing Microsoft Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1262
Defining Monitor and Control Settings for DNS and DHCP Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1263
Output Destination for Log Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1263
Maximum Simultaneous Connections for Microsoft Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1263
Configuring RPC Timeout Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1264
Setting Grid Properties for Managing Microsoft Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1264
Viewing DNS and DHCP Service Status on Microsoft Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1265
Managing Microsoft Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1265
Setting Microsoft Server Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1265
Changing the Managing Member or Management Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1266
Backing Up Synchronized Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1266
Disabling Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1266
Removing a Managed Microsoft Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1266
About Active Directory Sites and Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1267
Best Practices for Configuring Active Directory Sites and Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1267
Synchronizing Active Directory Domains on a Domain Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1268
Configuring and Managing Server Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1268
Configuring Active Directory Sites and Associated Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1269
Managing Active Directory Sites. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1269
Viewing Active Directory Domains and Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1270
Modifying Active Directory Sites and Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1270
Deleting Active Directory Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1270
Moving Networks Between Active Directory Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1271
Associating Active Directory Sites with Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1272
Configuring Microsoft Server and LDAP Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1273
Configuring Server Site Links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1273
Managing Active Directory Sites and Associated Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1274
Managing an Active Directory Site from the Microsoft server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1274
Managing an Active Directory Site from NIOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1274
Managing Network Operations from Microsoft server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1274
Converting Unmanaged Networks to Managed Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1275
Managing Network Operations from NIOS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1275
Restoring Server Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1275
Configuring Identity Mapping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1275
Prerequisites on the Microsoft Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1276
Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1276
About User Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1276
Login and Logout Timestamps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1277
Viewing Active Directory User Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1278
Monitoring Managed Microsoft Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1278
Viewing the Status of Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1278
Viewing Detailed Status Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1280
Viewing Synchronization Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1281

Chapter 35 Managing Microsoft DNS Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1283

Managing Microsoft DNS Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1284
Synchronizing DNS Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1284
Enabling and Disabling DNS Zone Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1285
IDN Support for Synchronized DNS Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1286
Synchronizing with Multiple Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1287
Managing Synchronized DNS Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1287
Adding Zones to Microsoft Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1288

28 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Setting Zone Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1288
Deleting and Restoring Synchronized Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1290
Managing Resource Records in Synchronized Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1290
Synchronizing Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1292
Synchronizing Delegations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1295
Synchronizing AD-Integrated Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1297
Resolving Conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1299
Viewing Members and Managed Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1299
Specifying Forwarders for Microsoft Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1300
Disabling and Removing Microsoft DNS Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1300

Chapter 36 Managing Microsoft DHCP Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1301

About Microsoft DHCP Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1302
Synchronizing DHCP Data from Microsoft Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1302
Viewing Synchronized Leases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1304
Synchronizing DHCP Failover Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1304
About Microsoft DHCP Failover Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1305
Admin Permissions for Managing Microsoft DHCP Failover Relationship . . . . . . . . . . . . . . . . . . . . . . . . . . . 1305
Microsoft Failover Relationships for DHCP Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1305
Admin Permissions for Managing Failover Relationships for DHCP Ranges . . . . . . . . . . . . . . . . . . . . . . . . . 1306
Synchronizing IP Addresses with Invalid MAC Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1306
Managing Synchronized DHCP Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1307
Adding and Managing Scopes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1307
Viewing Scopes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1312
Adding Fixed Addresses/Microsoft Reservations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1313
About Superscopes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1315
Synchronizing Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1317
Managing Microsoft DHCP Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1318
Viewing Members and Managed DHCP Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1318
Setting Microsoft DHCP Server Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1319
Controlling the DHCP Service of a Microsoft Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1320
Disabling and Removing Microsoft DHCP Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1320
Modifying DHCP Server Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1320

Part 7 Monitoring and Reporting

Chapter 37 Monitoring the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1325

Viewing Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1326
Grid Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1326
Member Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1326
Viewing the Grid Node Tree. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1332
Enabling Grid Visualization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1332
Monitoring Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1333
Service Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1333
Monitoring Grid Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1333
Monitoring Member Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1334
Using a Syslog Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1334
Specifying Syslog Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1335
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1338
Configuring Syslog Backup Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1339
Configuring Syslog for Grid Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1339

NIOS 7.3 NIOS Administrator Guide (Rev. A) 29

Contents

Setting DNS Logging Categories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1340

Viewing the Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1341
Viewing the RPZ Threat Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1342
Searching in the Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1343
Downloading the Syslog File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1343
Monitoring Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1344
Using the Audit Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1344
Viewing the Replication Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1346
Using the Traffic Capture Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1347
Using the Capacity Report. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1348
Participating in the Customer Experience Improvement Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1349
Monitoring DNS Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1350
Viewing DNS Alert Indicator Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1352
Configuring DNS Alert Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1352

Chapter 38 DHCP Fingerprint Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1357

Infoblox DHCP Fingerprint Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1358
About DHCP Fingerprints. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1359
Standard and Custom DHCP Fingerprints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1359
Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1360
Enabling and Disabling DHCP Fingerprint Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1360
Configuring DHCP Fingerprints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1360
Adding New DHCP Fingerprints. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361
Modifying Custom DHCP Fingerprints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361
Deleting Custom DHCP Fingerprints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1362
Viewing DHCP Fingerprint Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1362

Chapter 39 Monitoring with SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1363

Understanding SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364
About SNMPv1 and SNMPv2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1365
About User-Based Security Model in SNMPv3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1365
Configuring SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1365
Configuring SNMPv3 Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366
Modifying SNMPv3 Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1367
Deleting SNMPv3 Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1367
Accepting Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1367
Adding Trap Receivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1368
Setting SNMP System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1368
Defining Thresholds for Traps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1369
Setting SNMP and Email Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1371
Testing the SNMP Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1375
SNMP MIB Hierarchy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1376
MIB Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1377
System Object IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1377
Infoblox MIBs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1378
Loading the Infoblox MIBs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1379
ibTrap MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1380
ibPlatformOne MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1419
ibDHCPOne MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1434
ibDHCPv6Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1437
ibDNSOne MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1441
IB-DNSSERV-MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1444

30 NIOS Administrator Guide (Rev. A) NIOS 7.3

 IB-DNSHITRATIO-MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1445
IB-DNSQUERYRATE-MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1445
IB-DHCPSERV-MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1445

Chapter 40 Infoblox Reporting and Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1447

Infoblox Reporting and Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1451
Licensing Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1452
Upgrade Implications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1453
Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1454
Granting Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1454
Editing Permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1455
Configuring Server to Export Search Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1455
Supported Reporting Appliances and Storage Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1456
Reporting Categories and Related Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1457
Grid Reporting Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1462
Configuring Grid Reporting Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1463
Reporting (Index) Storage Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1463
Modifying Member Reporting Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1464
Defining Interface for Reporting Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1465
Setting the Network Port for Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1465
Configuring Threat Protection Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1465
Monitoring Client Queries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1466
About IP Blocks and IP Block Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1467
Adding IP Block Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1468
Modifying IP Block Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1468
Adding IP Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1468
Deleting IP Block Groups and IP Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1469
Exporting IP Block Groups and IP Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1469
Printing IP Block Groups and IP Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1469
Reporting User Interface Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1470
Home Dashboards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1471
About Searches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1472
Creating Reports from a Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1473
Saving a Search as a Dashboard Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1474
Exporting Search Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1474
Saving Search as Alerts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1475
About Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1475
Creating Scheduled Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1475
Editing Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1476
Cloning Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1476
Configuring Email Notification Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1476
About Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1477
Reporting Indexes and Update Time Intervals. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1477
Cloning Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1483
Scheduling Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1483
Configuring Logo Image in PDF Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1484
About Dashboards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1485
Creating New Dashboards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1485
Cloning Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1485
Editing Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1486
Editing the XML Source Code of a Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1486
Generate Dashboard PDFs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1487
Scheduling PDF Delivery for Dashboards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1487

NIOS 7.3 NIOS Administrator Guide (Rev. A) 31

Contents

About Dashboard Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1488

Predefined Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1490
IPAMv4 Utilization Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1493
Device (Discovery) Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1496
DHCP Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1498
DNS Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1502
Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1508
Malicious Activity by Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1510
DNS Firewall Executive Threat Report. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1511
Cloud Dashboard. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1515
Ecosystem Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1515
System Utilization Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1516
Internal Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1517
Managing Reporting Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1518
Upgrading Reporting and Analytics App . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1518
Backing Up and Restoring the Infoblox Reporting and Analytics App . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1518
Backing Up Reporting Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1519
Restoring the Reporting Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1520
Infoblox-4030 Supported Dashboards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1521

Part 8 Global Load Balancer Integration

Chapter 41 Managing Global Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1525

Integrating Global Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1526
About Load Balancer Synchronization Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1528
Requirements and Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1529
Deployment Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1530
Configuring the Management of GLBs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1531
Setting Usernames and Permissions on GLBs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1532
Setting the Management Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1532
Configuring the Synchronization Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1532
Assigning Grid Members to Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1533
Validating Load Balancer Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1535
Managing Global Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1535
Setting Load Balancer Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1535
Modifying Load Balancer Synchronization Group Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1536
Setting Priorities for Managed Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1536
Changing the Managing Member or Management Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1537
Replicating DNS Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1537
Backing Up Synchronized Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1537
Disabling Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1538
Removing a Load Balancer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1538
Removing a Load Balancer Synchronization Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1538
Monitoring Global Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1538
Viewing Global Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1539
Viewing Detailed Status Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1540
Viewing Detailed Status Information of a Synchronization Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1540

Chapter 42 Managing Global Load Balancer Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1541

About Global Load Balancer Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1543
Supported Global Load Balancer Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1543

32 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing F5 Global Load Balancer Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1544
Viewing Traffic Management Structures for GLB Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1545
Managing Synchronized DNS Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1546
Mapping DNS Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1546
Resolving DESYNC Conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1547
Configuring Delegations to Zones on Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1547
Modifying Delegations to Zones on Load Balancers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1548
Managing F5 LBDNs on GLBs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1549
Associating GLBs with Authoritative Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1549
Adding F5 LBDNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1549
Modifying F5 LBDNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1550
Viewing F5 LBDNs and LBDN Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1551
Managing F5 Listeners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1551
Adding F5 Listeners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1551
Modifying F5 Listeners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1552
Managing F5 Data Centers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1552
Adding F5 Data Centers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1552
Modifying F5 Data Centers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1553
Managing F5 Global Load Balancing Pools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1553
Creating Pools and Adding Pool Members. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1553
Modifying F5 Load Balancing Pools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1555
Managing F5 Global Load Balancer Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1555
Adding F5 GLB Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1555
Modifying F5 GLB Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1557
Managing F5 Global Load Balancer Virtual Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1557
Adding F5 GLB Virtual Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1557
Modifying F5 GLB Virtual Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1558

Part 9 Infoblox Infrastructure Security

Chapter 43 Infoblox External DNS Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1561

About Infoblox External DNS Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1563
Configuring Infoblox External DNS Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1564
Licensing Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1565
Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1565
Starting and Stopping Threat Protection Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1565
Enabling and Disabling Monitor Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1566
Understanding Threat Protection Rulesets and Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1566
About Ruleset Versions and Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1567
System and Auto Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1568
Custom Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1569
Using the Events Per Second Rule Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1572
Configuring Grid Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1572
Enabling Multiple DNS Requests through a Single TCP Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1573
Configuring NAT Mapping Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1574
Configuring NAT Mapping Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1575
Managing Threat Protection Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1576
Viewing Threat Protection Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1576
Activating a Ruleset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1577
Overriding the Grid Ruleset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1577
Modifying Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1578
Comparing and Merging Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1578

NIOS 7.3 NIOS Administrator Guide (Rev. A) 33

Contents

Manually Uploading Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1579

Publishing Rule Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1580
Delegating Rule Updates to Grid Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1580
Managing Threat Protection Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1581
Viewing Threat Protection Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1581
Enabling and Disabling Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1582
Modifying System and Auto Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1583
Modifying Custom Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1584
Monitoring Threat Protection Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1585
Monitoring through Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1585
Threat Protection Statistics Widget . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1586
Threat Protection Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1586
DNS and Network-Flood Threats. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1586
Internet Control Message Protocol (ICMP) Flood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1586
SYN Flood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1587
UDP DNS Flood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1587
Inside-Out Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1587
DNS Fluxing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1587
DNS Cache Poisoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1587
DNS Reflection and Amplification Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1587
DNS Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1588
DNS Domain Hijacking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1588

Chapter 44 Infoblox Internal DNS Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1589

About Infoblox Internal DNS Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1592
Data Exfiltration Through DNS Tunneling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1593
Licensing Requirements and Admin Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1594
Configuring Infoblox Internal DNS Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1595
About DNS Threat Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1597
Configuring DNS Threat Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1598
Starting and Stopping Threat Protection Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1599
Enabling and Disabling Monitor Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1599
Understanding Threat Protection Rulesets and Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1600
About Ruleset Versions and Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1600
System and Auto Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1601
Custom Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1603
Using the Events Per Second Rule Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1605
Configuring Grid Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1606
Enabling Multiple DNS Requests through a Single TCP Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1607
Configuring NAT Mapping Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1607
Configuring NAT Mapping Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1608
Managing Threat Protection Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1609
Viewing Threat Protection Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1609
Activating a Ruleset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1610
Overriding the Grid Ruleset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1610
Modifying Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1611
Comparing and Merging Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1611
Manually Uploading Rulesets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1612
Publishing Rule Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1613
Managing Threat Protection Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1614
Viewing Threat Protection Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1614
Enabling and Disabling Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1615
Modifying System and Auto Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1616

34 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Modifying Custom Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1617
Monitoring Threat Protection Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1617
Monitoring through Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1617
Threat Protection Statistics Widget . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1618
Threat Protection Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1618
DNS and Network-Flood Threats. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1619
Internet Control Message Protocol (ICMP) Flood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1619
SYN Flood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1619
UDP DNS Flood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1619
Inside-Out Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1619
DNS Fluxing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1619
DNS Cache Poisoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1620
DNS Reflection and Amplification Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1620
DNS Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1620
DNS Domain Hijacking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1620
About Infoblox APT/Malware Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1621
Setting Up Infoblox APT/Malware Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1622
Best Practices for Configuring RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1623
General RPZ Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1623
Best Practices For FireEye Integrated RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1624
Enabling Recursion for RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1625
Configuring RPZs for All Recursive Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1625
Enabling and Disabling RPZ Query Name Recursion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1625
Configuring Local RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1626
Configuring Rules for RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1628
Managing Passthru Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1628
Managing Block (No Such Domain) Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1629
Managing Block (No Data) Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1631
Managing Substitute (Domain Name) Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1632
Managing Substitute (Record) Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1633
Configuring the Infoblox RPZ Feed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1639
Infoblox RPZ feeds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1640
Downloading Rules of an RPZ Feed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1643
Testing RPZ Feed Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1643
About FireEye Integrated RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1644
Configuring FireEye RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1644
Configuring Rules for FireEye RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1647
Configuring the FireEye appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1647
Handling Alerts from the FireEye appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1649
Logging FireEye Integrated RPZ messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1649
Configuration Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1650
Managing RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1651
Viewing RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1651
Modifying RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1652
Reordering RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1653
Locking and Unlocking RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1653
Deleting RPZs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1653
Managing RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1654
Viewing RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1654
Modifying RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1655
Deleting RPZ Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1655
Copying RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1655
Importing RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1656
Disabling NSDNAME and NSIP rules for RPZ zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1656

NIOS 7.3 NIOS Administrator Guide (Rev. A) 35

Contents

Verifying RPZ Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1657

Viewing RPZ in the Syslog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1657
Viewing the Last Updated RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1658
About DNS Threat Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1660
Guidelines for Using DNS Threat Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1660
Supported Appliances for DNS Threat Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1661
Configuring DNS Threat Analytics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1661
Starting and Stopping the Threat Analytics Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1662
Viewing the Analytics Whitelist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1663
Adding Custom Whitelisted Domains. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1664
Configuring a Local RPZ as the Mitigation Blacklist Feed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1664
Viewing Blacklisted Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1665
Moving Blacklisted Domains to the Whitelist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1665
Updating Threat Analytics Module and Whitelist Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1665
Monitoring DNS Tunneling Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1668

Chapter 45 Infoblox DNS Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1669

About Infoblox DNS Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1671
Setting Up Infoblox DNS Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1672
License Requirements and Admin Permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1673
For Local RPZs and RPZ Feeds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1673
For FireEye Integrated RPZs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1673
Best Practices for Configuring RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1674
General RPZ Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1674
Best Practices For FireEye Integrated RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1675
Enabling Recursion for RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1676
Configuring RPZs for All Recursive Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1676
Enabling and Disabling RPZ Query Name Recursion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1676
Configuring Local RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1677
Configuring Rules for RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1679
Managing Passthru Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1679
Managing Block (No Such Domain) Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1681
Managing Block (No Data) Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1682
Managing Substitute (Domain Name) Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1683
Managing Substitute (Record) Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1685
Configuring the Infoblox RPZ Feed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1691
Infoblox RPZ feeds. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1693
Downloading Rules of an RPZ Feed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1695
Testing RPZ Feed Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1695
About FireEye Integrated RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1696
Configuring FireEye RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1696
Configuring Rules for FireEye RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1699
Configuring the FireEye appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1699
Handling Alerts from the FireEye appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1701
Logging FireEye Integrated RPZ messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1701
Configuration Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1701
Mitigating Cyber Threats using TAXII . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1704
Supported Appliances for TAXII Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1704
Licensing Requirements and Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1704
Mapping RPZs with TAXII Collections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1704
Starting and Stopping the TAXII Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1706
Extensible Attributes for TAXII Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1706
Monitoring TAXII Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1706

36 NIOS Administrator Guide (Rev. A) NIOS 7.3

Managing RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1706
Viewing RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1707
Modifying RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1708
Reordering RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1708
Locking and Unlocking RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1709
Deleting RPZs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1709
Managing RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1709
Viewing RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1709
Modifying RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1710
Deleting RPZ Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1711
Copying RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1711
Importing RPZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1711
Disabling NSDNAME and NSIP rules for RPZ zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1712
Configuring Prefix Length Limit for RPZ-IP Triggers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1712
Configuring Thresholds for RPZ Hit Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1713
Verifying RPZ Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1714
Viewing RPZ in the Syslog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1714
Viewing the Last Updated RPZs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1715

Chapter 46 Infoblox DNS Firewall Custom Feed Zones Tool . . . . . . . . . . . . . . . . . . . . . 1717

Configuring Custom RPZ Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1719
Accessing Infoblox DNS Firewall Custom Feed Zones Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1719
User defined Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1720
Creating User Defined Lists. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1721
Viewing User Defined Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1722
Modifying User Defined Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1722
User defined Domains. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1724
Creating User Defined Domain Lists. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1725
Viewing User Defined Domain Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1726
Modifying User Defined Domain Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1726
About RPZ Behaviors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1727
Creating RPZ Behaviors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1727
Modifying and Deleting RPZ Behaviors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1728
RPZ Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1729
Creating RPZ policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1729
Modifying and Deleting RPZ Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1730

Chapter 47 Cisco ISE Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1733

Integrating Cisco ISE into NIOS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1734
NIOS Licensing Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1734
Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1734
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1735
Generating Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1735
Configuring Cisco ISE on NIOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1736
Configuring Notification Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1737
Modifying Cisco ISE Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1739
Overriding Subscription Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1740
Viewing Identity Mapping Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1740
Deleting Cisco ISE Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1740

NIOS 7.3 NIOS Administrator Guide (Rev. A) 37

Contents

Part 10 Reference

Appendix A Glossary of Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1743

Appendix B Grid Manager Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1751

Appendix C Guidance Documentation Supplement. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1757

Pre-Requisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1758
Verifying the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1758
Security Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1758
Installation and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1758
Administration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1759
Setting Password Restrictions for Local Admins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1759
Enabling/Disabling Common Criteria Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1760
Using the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1760
Licenses and Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1761
WebUI Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1761
Creating a Login Banner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1761
Modifying the Session Timeout Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1761
Managing Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1761
DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1762
Backing Up and Restoring the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1762
Audit Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1762
Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1766
Secure Syslog Transport . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1771

Appendix D Regular Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1773

Supported Expressions for Search Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1773

Appendix E vNIOS Appliances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1775

vNIOS for Riverbed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1777
vNIOS for VMware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1777
vNIOS for Hyper-V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1778
vNIOS for Xen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1778

Appendix F Product Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1779

Power Safety Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1780
AC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1780
DC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1780
Agency Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1781
FCC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1781
Canadian Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1781
VCCI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1782
RFC Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1782
DNS RFC Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1782
DHCP RFC Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1785

38 NIOS Administrator Guide (Rev. A) NIOS 7.3

 DHCPv6 RFC Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1785
IDN (Internationalized Domain Names) RFC Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1786

Appendix G Open Source Copyright and License Statements . . . . . . . . . . . . . . . . . . . 1787

GNU General Public License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1789
GNU Lesser General Public License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1792
Apache Software License, Version 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1798
perl Artistic License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1803
ISC BIND Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1804
ISC DHCP Copyright. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1805
Julian Seward Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1805
Carnegie Mellon University Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1806
Thai Open Source Software Center Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1807
Ian F. Darwin Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1807
Lawrence Berkeley Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1808
MIT Kerberos Copyright. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1808
BSD License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1809
David L. Mills Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1810
OpenLDAP License. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1810
OpenSSL License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1811
VIM License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1812
ZLIB License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1814
Wietse Venema Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1814
ECLIPSE SOFTWARE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1814
Eclipse Public License - v 1.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1815
AOP Alliance (Java/J2EE AOP standards) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1819
OpenJDK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1819
TASM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1827
Distributed Computing Laboratory, Emory University . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1828
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1828
The FreeType Project LICENSE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1832
The Independent JPEG Group's JPEG software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1836
Net-SNMP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1838
The PHP License, version 3.01 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1843
INFO-ZIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1845
MIT License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1846
Ehcache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1847
Cybox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1847
Dateutil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1848
Importlib . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1849
Libtaxii . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1849
Mixbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1850
Stix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1850
PSF License Agreement for Python 2.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1851
PSF License Agreement for Python 3.5.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1852

Appendix H Configuration Requiring Service Restart . . . . . . . . . . . . . . . . . . . . . . . . . . 1853

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1857

NIOS 7.3 NIOS Administrator Guide (Rev. A) 39

Contents

40 NIOS Administrator Guide (Rev. A) NIOS 7.3

Preface
This preface describes the document conventions of this guide, and provides information about how to find
additional product information, including accessing Infoblox Technical Support. It includes the following sections:
• Document Overview on page 42
— Documentation Conventions on page 42
• What’s New on page 44
• Related Documentation on page 48
• Customer Care on page 48
— User Accounts on page 48
— Software Upgrades on page 48
— Technical Support on page 49

NIOS 7.3 NIOS Administrator Guide (Rev. A) 41

Preface

Document Overview
This guide describes how to configure and manage NIOS appliances using the NIOS 7.3 Alpha release. It was last
updated on January 28, 2016. For updated documentation, visit our Support site at https://support.infoblox.com.

Documentation Conventions
The text in this guide follows the following style conventions.

Style Usage
bold • Indicates anything that you input in the user interface, by clicking, choosing,
selecting, typing, or by pressing on the keyboard.
• Indicates the field names in the user interface.
input Signifies command line entries that you type.
variable Signifies variables typed into the user interface that you need to modify specifically for your
configuration. These can be command line variables, file names, and keyboard characters.
Indicates the names of the wizards, editors, and dialog boxes in Grid Manager, such as the
Add Network wizard or the DHCP Network editor.

Variables
Infoblox uses the following variables to represent values that you type, such as file names and IP addresses.

Variable Value
a_record A record
aaaa_record AAAA record
admin_group Name of a group of administrators
admin_name Name of the appliance administrator
addr_range IP address range
dhcp_template DHCP template
domain_name Domain name
directory Directory name
failover_association Failover association
filter_name Name of a DHCP filter
fingerprint DHCP fingerprint
fixed_address Fixed address
fixed_address_template Fixed address template
glb Global Load Balancer
Grid Grid name
Grid_master Grid Master
Grid_member Grid Member

42 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Document Overview

Variable Value
hostname Host name of an independent appliance
host_record Host record
ifmap_client IF-MAP client
ip_addr IPv4 address
lease IP address of a lease
mac_filter Name of a MAC filter
match_rule Name of a match rule
member Grid member name
ms_server Microsoft server
named_acl Named ACL (access control list)
netmask Subnet mask
network IP address of a network
network_access_server Name of a NAS
network_template Network template
network_view Network view
option_space DHCP option space
policy Name of a policy on RADIUSone
policy_group Name of a Policy Group
port Number of a port; predefined for certain protocols
ptr_record PTR record
reservation Reservation
roaming_host Roaming host
scheduled_task Scheduled task
server_group Name of a group of servers
shared_network Shared network
service One of the services available from Grid Manager
template DHCP template
dns_view DNS view
zone DNS zone

Navigation
Infoblox technical documentation uses an arrow “->” to represent navigation through the user interface. For example,
to edit a fixed address, the description is as follows:
From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> fixed_address
check box, and then click the Edit icon.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 43

Preface

What’s New
This NIOS release includes the following new features and enhancements:
• Amazon Route 53 Integration
Infoblox DDI for AWS integrates the AWS Route 53 DNS service, providing a unified DNS view across AWS and
hybrid cloud deployments through a centralized console that improves visibility and performance. Without
Infoblox, AWS deployments utilizing Route 53 have limitations with private hosted zones, which restrict DNS
resolution from outside AWS and hinder hybrid cloud deployments. For information about the Infoblox AWS
solution, refer to the Installation Guide for vNIOS for AWS.
• Enhancements for Cloud Network Automation
This NIOS release adds the following enhancements for Cloud Network Automation:
— Delegated objects: You can now add, modify, and delete fixed addresses and reservations in delegated
networks and address ranges through the Grid Manager UI in addition to using cloud API calls.
— vDiscovery: vDiscovery now automatically removes unmanaged and discovered data for VMs that have
been deleted in vSphere, OpenStack, and/or AWS EC2. Clear all discovered data; remove discovered data
from vDiscovery tasks; perform vDiscovery jobs directly in the Cloud tab.
— Visibility: A new report and dashboard widget to show dynamic license utilization has been added.
For more information, see Deploying Cloud Network Automation on page 361.
• Infoblox Reporting and Analytics
Infoblox Reporting and Analytics delivers an enhanced reporting interface so you can now create custom
dashboards, reports, and alerts. You can continue to use the traditional NIOS reports in the new interface and
customize them to meet your specific requirements, or you can create new custom dashboards and reports from
the ground up using a powerful search and visualization language or a simple graphical interface. For more
information, see Infoblox Reporting and Analytics on page 1447.
• Cisco ISE Integration
Infoblox integration with Cisco pxGrid (Cisco Platform Exchange Grid) enables Network Insight and Cisco ISE
(Cisco Identity Services Engine) to exchange valuable networking, user, device, and security-event information,
enriching both Infoblox DDI and ISE data. The pxGrid publish/subscribe architecture enables users to combine
pxGrid ecosystem products into a unified solution that enhances security-response accuracy and timeliness;
expands visibility of networks, users, and devices; and improves overall IT operations by sharing information
between network and security teams. Infoblox participation in the pxGrid community makes Infoblox data
indispensable for Cisco ISE customers. For more information, see Cisco ISE Integration on page 1733.
• STIX/TAXII Support
This release adds the TAXII (Trusted Automated eXchange of Indicator Information) service that enables NIOS to
integrate with other security software using the TAXII/STIX protocol for cyber threat mitigation. In this release,
the TAXII server is able to receive a mitigation request from a STIX/TAXII enabled third-party security platform
that adds to the DNS Firewall (RPZ) an IP address or domain that is deemed malicious. This enables the
third-party security platform to use the Infoblox Grid to apply a distributed mitigation policy. For more
information, see Mitigating Cyber Threats using TAXII on page 1704.
• Infoblox DNS Threat Analytics
DNS Threat Analytics mitigates DNS data exfiltration by employing analytics algorithms to detect DNS tunneling
traffic. When you enable the analytics service, NIOS starts analyzing incoming DNS data and applying
algorithms to detect security threats. Once threats are detected, NIOS blacklists the domains and transfers
them to the designated mitigation RPZ (Response Policy Zone), and traffic from offending domains is blocked.
DNS Threat Analytics also includes a whitelist that contains trusted domains on which NIOS allows DNS traffic.
These are known good domains that carry legitimate DNS tunneling traffic for tools such as Avast, Sophos,
McAfee, Boingo, Barracuda, and others. The whitelist is extensible so new whitelisted domains can be added
and rolled out accordingly. This release provides automatic updates for Threat Analytics modules through Grid
Manager. When you configure automatic updates for Threat Analytics modules, NIOS automatically download
the module set periodically. You can also view the current whitelist version and module set version in the
Updates tab in the Grid Threat Analytics Properties editor.

44 NIOS Administrator Guide (Rev. A) NIOS 7.3

 What’s New

NOTE: Infoblox highly recommends that you run the analytics service for a limited time to monitor and preview
what has been detected before actually blocking any domains. To do so, set Policy Override to Log Only
(Disabled) when you create the designated local RPZ. You can carefully review the list of detected domains and
decide which domains you want to continue blocking and which domains you want to add to the analytics
whitelist. You should review the blacklisted domains on a regular basis to make sure that no legitimate use of
DNS tunneling is blocked. You can update the analytics whitelist by adding new custom whitelisted domains,
moving legitimate domains from the blacklisted domain list, or using CVS import and export. Due to memory
and capacity required to perform analytics, ensure that you install the Threat Analytics and RPZ licenses and
enable the threat analytics service on an appliance that has big enough capacity. Following are the supported
Infoblox appliance models on which you can run the threat analytics service: IB-4010, IB-4030, IB-4030-10GE,
TE-2210, TE-2220, PT-2200, PT-4000, PT-4000-10GE, IB-VM-2220, and IB-VM-4010. Using unsupported
appliance models for DNS Threat Analytics might cause performance issues.
For more information, see About DNS Threat Analytics on page 1660.
• VRF Integration for Network Insight
Through Infoblox Network Insight, the NIOS appliance is now able to discover network devices that are
configured or deployed within virtual networks, such as VRF-based (Virtual Routing and Forwarding) networks.
You now have visibility of your complete virtual network infrastructure, which allows you to view and manage
overlapping IP addresses, VRF-specific data from VRF-enabled devices, and discovered end host data. For more
information, see Discovering VRF Virtual Networks on page 665.
• Security Visibility
Grid Manage now provides the following features to increase visibility of your Infoblox security infrastructure:
— A comprehensive Security dashboard that displays the current security data, including Threat Protection
events and RPZ hits. You can view information such as the top N Grid members by events, top N rules by
volume, and more. To ensure that the Security dashboard displays correct data, use NTP to synchronize the
time of the Grid members with that of the Grid Master.
— Threat Protection widgets that display security data based on the new “grouping” feature.
— New reports that display security information related to Infoblox External DNS Security and Infoblox Internal
DNS Security.
For more information, see Status Dashboards on page 138.
• Infoblox Security Infrastructure Enhancements
This release adds a few enhancements to the Infoblox Security Infrastructure features, as follows:
— Ability to reset the appliance to use the default Threat Protection ruleset.
— Specify the interface for downloading the latest ruleset.
— Configure the MGMT port as the interface for Reporting traffic.
— Display FQDN information for Threat Protection rule match the syslog.
— Display the current active ruleset version in Grid Manager
For more information, see Infoblox External DNS Security on page 1561.
• Data Collection Virtual Appliances
Infoblox introduces phase one of the Data Collection feature in this release. You can set up a newly developed
Data Collection appliance as the data collector to work with the Infoblox Reporting member for report
generation. The purpose is to enhance the collector in a future release to enable scalable distribution of Grid
data to the Reporting server and other third-party destinations. For more information, refer to the Installation
Guide for Data Collector, when it becomes available.
• DNS Record Scavenging
The DNS record scavenging feature allows you to remove stale DNS resource records from zone data to prevent
the accumulation of invalid records. A scavenging operation determines, based on predefined rules, which
records became stale, i.e. reclaimable, and removes them. For more information, see DNS Record Scavenging
on page 803.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 45

Preface

• Secure Dynamic DNS Updates

The secure DDNS updates feature provides the following mechanisms to restrict DDNS updates:
— Protecting specific resource records so that clients cannot update them.
— For authenticated updates, tracking the Kerberos GSS-TSIG principal that created a record and preventing
DDNS updates to the record created by a different GSS-TSIG principal.
— Defining FQDN patterns for domain names that prevent DDNS updates to matching FQDNs.
— To handle principal authentication-based secure updates even more flexibly, you can create dynamic
update groups.
For more information, see Secure Dynamic Updates on page 959.
• Elastic Scaling for vNIOS for KVM and vNIOS for VMware Appliances
This release adds Elastic Scaling support for the following vNIOS virtual appliances: vNIOS for KVM and vNIOS
for VMware. You can now provision and deploy Trinzic virtual appliances for these hypervisors as the Grid
Master or Grid members using Elastic Scaling. For information about supported vNIOS models, see the table on
page 4.
• Improved Support for vNIOS for KVM on OpenStack
Issues with deploying vNIOS for KVM on certain OpenStack distributions (e.g., Red Hat Enterprise Linux
OpenStack Platform 6) have been resolved. Property injection through cloud-init and ability to assign IP
addresses and network properties via OpenStack DHCP for vNIOS for KVM network interfaces is now supported.
Qcow2 images are now available in addition to OVA images.
• Auto-creation of DNS Records for Discovered VMs
When you configure a vDiscovery job, you can now enable the appliance to automatically create or update Host
records or A/AAAA or PTR records for discovered VM instances in authoritative zones. You can also enter a
formula that NIOS uses to create the DNS names for the discovered IP addresses based on their VM parameters
such as vm_name or discovered_name. By doing so, NIOS is able to automatically create and update DNS
records for private and public IPs discovered through vDiscovery. For more information, see Creating DNS
Records for Newly Discovered VMs on page 636.
• Support for HTTP or HTTPS Proxy Servers
NIOS now supports the configuration of HTTP or HTTPS proxy servers for automatic updates. You can use this
feature to download automatic updates for Threat Protection rulesets and Threat analytics bundles. For an AWS
cloud deployment, you can configure a proxy server for vDiscovery or use it as the AWS API Proxy. For more
information, see Configuring Proxy Servers on page 442.
• Enhancements for DNS Traffic Control
By adding support for the NAPTR record type to the DTC (DNS Traffic Control) solution, DTC is now in compliant
with the 3GPP standards. You can also add an SNMP health monitor to track server availability and define the
load balancing method for a DTC LBDN (Load Balancing Domain Name) record. DTC now responds to queries
containing the EDNS0 (Extension Mechanisms for DNS) Client Subnet option by leveraging that address
information in performing geographic load balancing.
• Support for match-recursive-only BIND option
You can now enable the match-recursive-only option for the DNS view. When you enable this option, only
recursive queries from matching clients match the selected DNS view. This option can be used in conjunction
with the match client list and match destination list.
• Replication of syslog Rotated Files to External Servers
You can configure the appliance to back up rotated syslog files to external servers through FTP or SCP. When you
do so, the appliance forwards the rotated syslog files to the external servers that you configure. Configuring
syslog external backup servers helps you conveniently send (archive) syslog files to different destinations by
their logging categories. This allows you to split syslog files based on the service and efficiently perform
troubleshooting.
• Shared Record Support for CNAMES
This release adds support for CNAME records to shared record groups.

46 NIOS Administrator Guide (Rev. A) NIOS 7.3

 What’s New

• NIOS Audit Log Reporting

The newly added Audit Log Events report provides information about the administrator-initiated events,
including login events, logout events, service restarts, appliance reboots, and write operations such as the
addition, modification, and deletion of objects.
• Support for ‘posixGroup’ in LDAP Authentication
This release enhances LDAP authentication to include the support for group attributes and allow groups from
the ‘posixGroup’ object class.
• Enabling Active Directory Authentication for Nested Groups
Windows servers support nesting groups in which you can add a group of admin users as a member of another
group. Nested groups consolidate admin accounts and help reduce the number of permissions required for
individual users or groups. In NIOS, you can now enable nested group query so the appliance can recursively
look up and use AD authentication service to authenticate members or admin accounts that are part of a nested
group.
• Remote Authentication for Local Groups
Depending on where admin user credentials are stored, you can configure the NIOS appliance to authenticate
admins locally or remotely. When you configure the authentication type as "local," NIOS authenticates admins
against its local database. When you configure the authentication type as "remote," NIOS authenticates admins
whose user credentials are stored remotely on authentication servers, such as RADIUS servers, AD domain
controllers, LDAP servers, or TACACS+ servers.
• Hostname and server-id Options
When you configure DNS anycast, more than one DNS name servers share a single IP address. To identify which
DNS name server is answering queries, you can configure the hostname and server ID options so the NIOS
appliance returns the hostname of the DNS name server that is currently answering queries.
• Controlling NS Records for AD-replicated Zones (RFE-6268)
When you have assigned a Microsoft server as the primary server for a DNS zone and if the zone is
AD-integrated (Active Directory), you can now configure a list of domain controllers that are allowed to add NS
records to the zone.
• DHCP Lease Scavenging
This release supports DHCPv6 lease scavenging.
• DHCP Failover Recovery
You can now perform a DHCP recovery for failover associations through Grid Manager. As result of the recovery,
all conflicts are resolved on the passive node after a restart.
• DHCP Options at the Network Container Level
This release introduces DHCP option support in a network container. In previous releases, you were only able to
override a DHCP option defined for networks and shared networks at the Grid or member level. You can now
define DHCP options at the network container level. In the inheritance hierarchy, the network container is
anchored between the shared network and member.
• Microsoft User Mapping
The Microsoft User Mapping feature integrates with Microsoft’s Active Directory to intelligently discover the
relationship of network devices and their users (Network Users). This feature empowers DDI administrators with
a new level of understanding of how network users consume and interact with the network. For more
information, see Configuring Identity Mapping on page 1275.
• DNS Cache Acceleration Enhancements
The DNS Cache Acceleration servers (IB-4030 or IB-4030-10GE) now support the following features: Stub Zone,
Clear Cache, VLAN2, and NAT Mapping for Port Block Allocation. For more information, refer to the Infoblox DNS
Cache Acceleration User’s Guide.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 47

Preface

Related Documentation
Other Infoblox appliance documentation:
• Infoblox CLI Guide
• Infoblox API Documentation
• Infoblox CSV Import Reference
• Infoblox Installation Guide for the Trinzic 100 Appliance
• Infoblox Installation Guide for the 800 Series Platforms
• Infoblox Installation Guide for the 1400 Series Platforms
• Infoblox Installation Guide for the 2200 Series Platforms
• Infoblox Installation Guide for the 4000 Series Platforms
• Infoblox Installation Guide for the Infoblox-4010 Appliance
• Infoblox Installation Guide for the IB-4030 and IB-4030-10GE Appliances
• Infoblox DNS Cache Acceleration Administrator Guide
• Infoblox Installation Guide for vNIOS Software on Riverbed Services Platforms
• Infoblox Installation Guide for Installing vNIOS Software on Cisco Platforms
• Infoblox Installation Guide for vNIOS Software on VMware
• Infoblox Installation Guide for vNIOS on Microsoft 2008 R2 for Hyper-V
• Infoblox Installation Guide for Installing vIBOS Software on VMware Platforms
• Infoblox Installation Guide for vNIOS for KVM Hypervisor and KVM-based OpenStack
• Infoblox IBOS Administrator Guide
• Infoblox Safety Guide
To provide feedback on any of the Infoblox technical documents, please e-mail [email protected].

Customer Care
This section addresses user accounts, software upgrades, licenses and warranties, and technical support.

User Accounts
The Infoblox appliance ships with a default user name and password. Change the default admin account password
immediately after the system is installed to safeguard its use. Make sure that the NIOS appliance has at least one
administrator account with superuser privileges at all times, and keep a record of your account information in a safe
place. If you lose the admin account password, and did not already create another superuser account, the system will
need to be reset to factory defaults, causing you to lose all existing data on the NIOS appliance. You can create new
administrator accounts, with or without superuser privileges. For more information, see Managing Administrators on
page 183.

Software Upgrades
Software upgrades are available according to the Terms of Sale for your system. Infoblox notifies you when an
upgrade is available. Register immediately with Infoblox Technical Support at
http://www.infoblox.com/support/customer/evaluation-and-registration to maximize your Technical Support.

48 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Customer Care

Technical Support
Infoblox Technical Support provides assistance via the Web, e-mail, and telephone. The Infoblox Support web site at
https://support.infoblox.com provides access to product documentation and release notes, but requires the user ID
and password you receive when you register your product online at:
http://www.infoblox.com/support/customer/evaluation-and-registration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 49

Preface

50 NIOS Administrator Guide (Rev. A) NIOS 7.3

Part 1 Appliance GUI
This section introduces you to Grid Manager, the web interface through which you can manage your DNS, DHCP and
IP address management (IPAM) infrastructure. It also describes the Task and Status Dashboards, your home page on
Grid Manager, and Smart Folders, which you can use to organize your data.
It includes the following chapters:
• Chapter 1, Infoblox Grid Manager, on page 53
• Chapter 2, Dashboards, on page 117
• Chapter 3, Smart Folders, on page 173

NIOS 7.3 NIOS Administrator Guide (Rev. A) 51

52 NIOS Administrator Guide (Rev. A) NIOS 7.3
Chapter 1 Infoblox Grid Manager
This chapter lists requirements for the management system you use to access the NIOS appliance. It also explains
how to access the Grid Manager web interface and describes its major components. This chapter includes the
following sections:
• Management System Requirements on page 56
— Supported Browsers on page 56
— Browser Limitations on page 57
• About Grid Manager on page 57
— Admin Permissions for Grid Manager on page 58
— Logging in to the GUI on page 58
• Setting Login Options on page 59
— Specifying the Grid Name and Hostname on page 59
— Creating a Login Banner on page 59
— Changing the Password and Email Address on page 59
— Specifying the Table Size on page 60
— Selecting Your Home Page on page 60
— Setting the Browser Time Zone on page 61
• SSL (Secure Sockets Layer) Protocol on page 61
• Managing Certificates on page 63
— About HTTPS Certificates on page 63
— About Client Certificates on page 65
• About the Grid Manager Interface on page 67
— System Messages on page 67
— Security and Informational Banners on page 67
— Breadcrumbs Navigation on page 68
— Global Search on page 68
— Finder Panel on page 68
— Toolbar Panel on page 68
— Help Panel on page 68
— Wizards and Editors on page 68
— Tooltips on page 69
— Customizing Tables on page 69

NIOS 7.3 NIOS Administrator Guide (Rev. A) 53

Infoblox Grid Manager

— Selecting Objects in Tables on page 69

— Modifying Data in Tables on page 70
• Finding and Restoring Data on page 72
— Using Bookmarks on page 72
— Using the Recycle Bin on page 73
— Managing Third Party URL Links on page 75
— Using Filters on page 76
— Using Quick Filters on page 77
— Using Global Search on page 78
— Using the Go To Function on page 81
• About Tasks on page 81
— Viewing Tasks on page 82
— Supported Objects for Scheduled and Approval Tasks on page 84
— Guidelines for Upgrading, Backing Up, and Restoring Data on page 85
• Scheduling New IPAM/DHCP Objects and Associated Port Configurations on page 86
— Scheduling Creation of new IPv4/IPv6 Networks and Associated Device Provisioning on page 88
• Scheduling Tasks on page 85
— Scheduling Additions and Modifications on page 89
— Scheduling Appliance Operations on page 90
— Scheduling Deletions on page 90
— Scheduling Recursive Deletions of Network Containers and Zones on page 90
— Viewing Scheduled Tasks on page 91
— Rescheduling Tasks on page 92
— Canceling Scheduled Tasks on page 94
• Configuring Approval Workflows
— Creating Approval Workflows on page 95
— Viewing Approval Workflows on page 97
— Modifying Approval Workflows on page 97
— Deleting Approval Workflows on page 98
— Viewing Approval Tasks on page 98
— Viewing Workflow Notifications on page 98
— Unsupported Operations for Submitters on page 99
• About Long Running Tasks on page 100
— Running Tasks in the Background on page 100
— Monitoring Long Running Tasks on page 101
• About CSV Import on page 101
— CSV Import User Permissions on page 102
— CSV Import Limitations on page 103
— Configuring Import Options on page 104
— Viewing CSV Import Jobs on page 106
— Modifying CSV Import Jobs on page 107
— Deleting Uploaded Jobs on page 107
— Downloading Files on page 107
— Creating a Data File for Import on page 108
— Exporting Data to Files on page 108

54 NIOS Administrator Guide (Rev. A) NIOS 7.3

• Exporting Displayed Data on page 111
• Printing from Grid Manager on page 111
• Multilingual Support on page 111
— UTF-8 Supported Fields on page 112
— UTF-8 Support Limitations on page 112
— Support for Internationalized Domain Names on page 113
— Decoding IDNs and Encoding Punycode on page 113
— IDN Supported Fields on page 113
— IDN Support Limitations on page 114

NIOS 7.3 NIOS Administrator Guide (Rev. A) 55

Infoblox Grid Manager

Management System Requirements

The management system is the computer from which you configure and manage the NIOS appliance. The
management system must meet the following requirements.

Figure 1.1 Software and Hardware Requirements for the Management System

Management System Software Requirements Management System Hardware Requirements

GUI ACCESS • Minimum System:
• See Supported Browsers on page 56 for 1.4 GHz CPU with 1 GB RAM available to the
details. product GUI, and 256 Kbps connectivity to
CLI ACCESS NIOS appliance
• Secure Socket Shell (SSH) client that • Recommended System:
supports SSHv2 2.0 GHz (or higher) dual core CPU with 2 GB
• Terminal emulation program, such as RAM available for the product GUI, and
minicom or Hilgraeve Hyperterminal® network connectivity to NIOS appliance
• Monitor Resolution:
1024 x 768 (minimum)
1280 x 800 or better (recommended)

Supported Browsers
Grid Manager supports the following operating systems and browsers. You must install and enable Javascript for Grid
Manager to function properly. Grid Manager supports only SSL version 3 and TLS version 1 connections.
Infoblox recommends that you use a computer that has a 2 GHz CPU and at least 1 GB of RAM.
Infoblox supports the following browsers for Grid Manager:

OS Browser
Microsoft Windows 8.0 and 8.1® Microsoft Internet Explorer® 11.x*, 10.x*
Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x
Microsoft Windows 7® Microsoft Internet Explorer® 11.x*, 10.x*, 9.x, and 8.x
Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x
Microsoft Windows XP® (SP2+) Microsoft Internet Explorer 7.x and 8.x
Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x
Red Hat® Enterprise Linux® 7.x Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x
Red Hat® Enterprise Linux® 6.x Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x
Red Hat® Enterprise Linux 5.x Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x

56 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Grid Manager

Apple® Mac OS X 10.9.x Safari 7.x

Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x
Apple® Mac OS X 10.8.x Safari 6.x
Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x
Apple® Mac OS X 10.7.x Safari 5.x
Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x
Apple® Mac OS X 10.6.x Safari 5.x
Mozilla Firefox 32.x, 31.x, 25.x, 21.x, 16.x, and 10.x
Google Chrome 37.x, 36.x, 30.x, 27.x, 22.x, and 16.x

Note: * Grid Manager fully supports Microsoft Internet Explorer® 11.x and 10.x when you enable compatibility view
in the browser. Features in the Reporting tab may not function properly if you disable compatibility view. In the
browser, go to Tools -> Compatibility View to enable the feature.

Infoblox recommends using the latest release of the supported versions of Internet Explorer, Mozilla Firefox or Google
Chrome for best performance.

Browser Limitations
• When you use Internet Explorer 7 or 8 without installing the latest updates, Grid Manager may stop loading a
page when you navigate from one tab to another or when you use the back navigation button to go back to a
previous page. To solve this problem, you can press Ctrl+F5 to refresh the browser or install the latest updates.
• When you use the zoom function in Internet Explorer 7 running on Microsoft Windows XP, Grid Manager may not
properly display some pop up windows. This is a known issue in Internet Explorer 7.
• In Internet Explorer 8, Grid Manager does not display the directory path of an uploaded file. Instead, it displays
“fakepath” in place of the directory path. To resolve this issue, you can add Grid Manager as a trusted site or
enable the “Include local directory path when uploading files to a server” feature in the browser. For
information, refer to the MSDN documentation at http://msdn.microsoft.com/en-us/library/ms535128.aspx.
• When you use FireFox to access Grid Manager, tooltips do not display for disabled drop-down menu items. In
addition, when you run a large query of smart folders, Grid Manager may display a warning message about
“Unresponsive Script”. Click Continue to proceed.
• Depending on the browser you use, Grid Manager may display a dialog box that indicates the system is
unavailable during a system restart or reboot.
• Infoblox strongly recommends that you do not log in to Grid Manager from different browser windows using the
same user account. Depending on the browser you use, it may cache user information in one session and apply
it to another session. This can cause inconsistent behaviors within the browser sessions.

About Grid Manager

Grid Manager is the web interface that provides access to your appliance for network and IP address management. It
provides a number of tools that you can use to effectively manage your appliance and IP address space.
• Use Smart Folders to organize your data based on criteria you specify. For information, see Smart Folders on
page 173.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 57

Infoblox Grid Manager

• The network and IP address maps and lists provide views of your networks and IP addresses, so you can quickly
evaluate IP address usage and understand how your network resources are being utilized. You can quickly
determine which IP addresses are in use, when they were allocated, and to which devices they were assigned.
For information, see Chapter 13, IP Address Management, on page 575.
• Customize the Dashboard to monitor your Grid and networks. The Dashboard also provides access to
frequently-used commands and the network discovery feature. You can run network discoveries to identify IP
address conflicts and troubleshoot network issues. For information, see Dashboards on page 117.
• Tools such as the Finder panel, filters, and global search help you quickly find the information you need. For
information, see About the Grid Manager Interface on page 67.
• Use wizards to quickly create new networks and resource records. Editors allow you to configure additional
operational parameters. For information, see Wizards and Editors on page 68.
Before you can use Grid Manager, you must install and configure the NIOS appliance as described in the installation
guide that shipped with your product. You can then access Grid Manager using one of the supported browsers. For
information, see Supported Browsers on page 56.

Admin Permissions for Grid Manager

You can log in to Grid Manager as long as you have permission to log in to the NIOS appliance. Superusers have
unrestricted access to Grid Manager. Limited-access users though, require read-only or read-write permission to the
data that they want to manage through Grid Manager. Grid Manager allows limited-access users to view and manage
only the data for which they have permission. For example, to view IPv4 networks, you must have at least read-only
permission to IPv4 networks. To run a discovery, you must have read/write permission to the Network Discovery
feature.
Note that superusers must configure admin groups and accounts in the Grid Manager application of the NIOS
appliance. In Grid Manager, superusers can set and change permissions for specific objects, such as IPv4 networks,
IPv6 networks, and resource records. For information about user accounts and administrative permissions, see
Managing Administrators on page 183.

Logging in to the GUI

Before you log in to Grid Manager, ensure that you have installed your NIOS appliance as described in the installation
guide or user guide that shipped with your products and configured it accordingly. You must upload the CA
certificate(s) that issued the client certificate to ensure a successful SSL/TLS connection to the appliance.
To log in to Grid Manager:
1. Open an Internet browser window and enter https://<IP address or hostname of your NIOS appliance>. The Grid
Manager login page appears. For information, see Supported Browsers on page 56.
2. Enter your user name and password, and then click Login or press Enter. The default user name is admin and the
default password is infoblox. Note that if your password expired or was reset by a superuser, you may be required
to enter a new password.
If you are a smart card user and two-factor authentication is enabled on the appliance, your user name, which is
the same as your CN (common name) in the client certificate, appears automatically. Enter the password you
use to log in to the user account. For information about two-factor authentication, see Authenticating Admins
Using Two-Factor Authentication on page 228.
3. Read the Infoblox End-User License Agreement. If you want to participate in the Infoblox Customer Experience
Improvement Program, complete the following:
— Participate in the Infoblox Customer Experience Improvement Program: Select the check box to send
product usage data to Infoblox on a periodic basis. Infoblox uses this data to improve product functionality.
For more information about the program, see Participating in the Customer Experience Improvement
Program on page 1349.
— Support ID (optional): Enter the Infoblox Support ID that was assigned to your account. It must be a number
with four to six digits. The value you enter here is also displayed in the Customer Improvement tab in the
Grid Properties editor. Infoblox includes this ID in the data report.

58 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Setting Login Options

— Infoblox Privacy Policy: Click here to view the Infoblox privacy policy. The appliance displays the policy in a
new browser tab.
Click I Accept. The Grid Setup wizard appears.

Setting Login Options

Grid Manager provides several options that you can set to facilitate the login process. Additionally, you can manage
CA (Certificate Authority) and server certificates on the NIOS appliance. You can import certificates, select and view
their details, or remove them. To manage certificates, see Managing Certificates on page 63.

Specifying the Grid Name and Hostname

To define the default hostname that appears when the login prompt displays:
1. From the Grid tab, select the Grid Manager tab, and then click Grid Properties -> Set up (Grid Setup Wizard) from
the Toolbar.
2. On the Welcome page, select Configure a Grid Master, and then click Next.
3. Enter the Grid name in the Grid Name field and the hostname in the Host Name field.

Creating a Login Banner

You can create a statement that appears at the top of the Login screen (a banner message). This function is useful for
posting security warnings or user-friendly information well above the user name and password fields on the Login
screen. A login banner message can be up to 3000 characters long. In a Grid, perform this task on the Grid Master.
To create a login banner:
1. From the Grid tab, select the Grid Manager tab, and then click Grid Properties -> Edit from the Toolbar.
2. In the Grid Properties editor, select the Security tab, and then select Enable Login Banner. In the text field, enter
the text that you want displayed on the login screen.
3. Save the configuration and click Restart when it appears at the top of the screen.

Changing the Password and Email Address

Grid Manager creates and stores a user profile for each admin user. Each user profile contains information about the
admin group and admin type assigned to the user. You can modify certain information in your user profile any time
after the initial login. You can change your password to facilitate future logins and add your email address for
reference.
Note that when multiple users log in to Grid Manager using the same admin account, they share the same user profile
and preference settings, such as the widget, table size and column settings, independent of their browser settings.
Instead of using the same admin account for multiple users, you can add multiple users to the same admin group so
they can share the same permissions. For information about configuring admin accounts and admin groups, see
Managing Administrators on page 183.
If you can access only the Tasks Dashboard, you may not see or configure certain fields in the User Profile editor.
To change your password and email address:
1. At the top right corner of the navigation bar, click the Admin name and select Profile from the drop-down menu.
2. In the User Profile editor, complete the following:
— Name: Displays your user name.
— Last Login: Displays the timestamp of your last login.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 59

Infoblox Grid Manager

— Type: Displays your user type. There are two user types: Local and Remote. The local admin accounts are
stored in the database of the appliance, and the remote admin accounts are stored on another server, such
as a RADIUS server. Grid Manager automatically deletes remote user profiles if the users have not logged in
for more than six months.
— Group: Displays the admin group to which your account belongs. The admin group determines your
administrative permissions. Only superusers can define admin groups through Grid Manager.
— Password: You can set a new password according to the requirements that are displayed.
— Set Password: If you are a local user, select this check box to set a new password for your account. If
you are a remote user, this field does not appear.
— Old Password: Enter your current password.
— New Password: Enter the new password, and then re-enter it in the Retype Password field.
— Email Address: Enter your email address. Note that this address simply provides contact information. By
default, this field is blank.
3. Save the configuration and click Restart if it appears at the top of the screen.

Specifying the Table Size

You can specify the amount of data Grid Manager can display in a table or a single list view. You can improve the
display performance by setting a smaller table size. The setting you specify here applies to all tables in Grid Manager.
Note that if you can access only the Tasks Dashboard, you cannot configure table size.
To specify table size:
1. At the top right corner of the navigation bar, click the Admin name and select Profile from the drop-down menu.
2. In the User Profile editor, complete the following:
— Table Size: Specify the number of lines of data you want a table or a single list view to contain. You can set
the number of lines from 10 to 256. The default is 20.
3. Save the configuration and click Restart if it appears at the top of the screen.

Selecting Your Home Page

When you first log in to Grid Manager, the Tasks Dashboard is your home page. You can change your home page for
subsequent logins. You can specify the maximum number of widgets that can be configured per dashboard. You can
set up to 20 widgets per dashboard. You can also set the auto refresh rate for the dashboard widgets. This interval
tells how often the content of the dashboard widgets are refreshed.
To change your home page:
1. At the top right corner of the navigation bar, click the Admin name and select Profile from the drop-down menu.
2. In the User Profile editor, complete the following:
— Default Dashboard: Select Status or Task from the drop-down list.
— Maximum Widgets per Dashboard: Specify the maximum number of widgets that can be configured per
Dashboard. You can enter a value between 1 and 20. The default value is 10. This limit does not apply to
the default dashboard.
— Auto-refresh rate: Specify the time interval in seconds the appliance refreshes the content of the widget
automatically. The default auto-refresh rate is 10 seconds.
3. Save the configuration and click Restart if it appears at the top of the screen.
Grid Manager displays the selected dashboard as your home page when you log in the next time.

60 NIOS Administrator Guide (Rev. A) NIOS 7.3

 SSL (Secure Sockets Layer) Protocol

Setting the Browser Time Zone

You can specify the time zone Grid Manager uses to convert all displayed time values such as the last discovered and
last login time. Grid Manager sets the time zone based on the time zone of your browser when you set the time zone
to auto-detect in the User Profile editor. When you set the time zone of your browser to auto-detect and Grid Manager
cannot automatically determine the time zone when you log in, the time zone is set to UTC (Coordinated Universal
Time) standard. In this case, you can manually change the time zone in the User Profile editor.
To manually set the time zone of your browser:
1. At the top right corner of the navigation bar, click the Admin name and select Profile from the drop-down menu.
The User Profile editor displays your user name, user type, and admin group.
2. In the User Profile editor, complete the following:
— Time Zone: Select the time zone Grid Manager uses to convert all displayed time values. The default is
Auto-detect time zone. You must select a specific time zone when Grid Manager cannot automatically
detect the time zone of your browser.
3. Save the configuration and click Restart if it appears at the top of the screen.

SSL (Secure Sockets Layer) Protocol

When you log in to the NIOS appliance, your computer makes an HTTPS (Hypertext Transfer Protocol over Secure
Sockets Layer protocol) connection to the NIOS appliance. HTTPS is the secure version of HTTP, the client-server
protocol used to send and receive communications throughout the Web. HTTPS uses SSL (Secure Sockets Layer) to
secure the connection between a client and server. SSL provides server authentication and encryption. The NIOS
appliance supports SSL versions 2 and 3.
When a client first connects to a server, it starts a series of message exchanges, called the SSL handshake. During
this exchange, the server authenticates itself to the client by sending its server certificate. A certificate is an electronic
form that verifies the identity and public key of the subject of the certificate. (In SSL, the subject of the certificate is
the server.) Certificates are typically issued and digitally signed by a trusted third party, the Certificate Authority (CA).
A certificate contains the following information: the dates it is valid, the issuing CA, the server name, and the public
key of the server. For information about certificates, see Managing Certificates on page 63.
A server generates two distinct but related keys: a public key and a private key. During the SSL handshake, the server
sends its public key to the client. Once the client validates the certificate, it encrypts a random value with the public
key and sends it to the server. The server decrypts the random value with its private key.
The server and the client use the random value to generate the master secret, which they in turn use to generate
symmetric keys. The client and server end the handshake when they exchange messages indicating that they are
using the symmetric keys to encrypt further communications.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 61

Infoblox Grid Manager

Figure 1.2 SSL Handshake

Client contacts the NIOS appliance and recommends

certain parameters, such as SSL version, cipher
settings, and session-specific data.

The appliance either agrees or recommends

other parameters. It also sends its certificate
which contains its public key.

Plain Client encrypts random number with the public Cipher

Text key and sends it to the appliance. The appliance Text
uses its private key to decrypt the message.

Cipher The client and the appliance generate the Cipher

Text master secret, and then the symmetric keys. Text

The client and the appliance agree to encrypt

all messages with symmetric keys.

The client and the appliance send all their messages through the SSL tunnel
which uses the cipher settings and encryption to secure their connection.
Public Key

Private Key

To avoid possible attacks in which HTTP or HTTPS connections are made to a web server and stay open much longer
than they should be, Infoblox provides the set connection_limit and show connection_limit CLI commands
that you can use to mitigate these attacks. In general, these attacks can result in the web server reaching its maximum
number of concurrent connections, and thus denying connections from legitimate sources. You can use the CLI
commands to limit the number of concurrent HTTP and HTTPS connections from a given client that corresponds to a
particular IP address. For information about the CLI commands and how to use them, refer to the Infoblox CLI Guide.

62 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Certificates

Managing Certificates
About HTTPS Certificates
The NIOS appliance generates a self-signed certificate when it first starts. A self-signed certificate is signed by the
subject of the certificate, and not by a CA (Certificate Authority). This is the default certificate. When your computer
first connects to the NIOS appliance, it sends this certificate to authenticate itself to your browser.
Because the default certificate is self-signed, your browser does not have a trusted CA certificate or a cached NIOS
appliance server certificate (saved from an earlier connection) to authenticate the NIOS appliance certificate. Also,
the hostname in the default certificate is www.infoblox.com, which is unlikely to match the hostname of your NIOS
appliance. Consequently, messages appear warning that the certificate is not from a trusted certifying authority and
that the hostname on the certificate is either invalid or does not match the name of the site that sent the certificate.
Either accept the certificate just for this session or save it to the certificate store of your browser.
To eliminate certificate warnings, you can replace the default self-signed certificate with a different certificate that has
the hostname of your NIOS appliance. The NIOS appliance supports X.509 certificates in .PEM format. After the initial
login, you can do one of the following:
• Generate another self-signed certificate with the correct hostname and save it to the certificate store of your
browser.
• Request a CA-signed certificate with the correct hostname and load it on the NIOS appliance. For more
information, see Generating Certificate Signing Requests on page 64.
• When you receive the certificate from the CA, import it to the appliance, as described in Uploading Certificates
on page 64.
• Download the certificate from a trusted CA, as described in Downloading Certificates on page 64.

Generating Self-Signed Certificates

You can replace the default certificate with a self-signed certificate that you generate. When you generate a
self-signed certificate, you can specify the correct hostname and change the public/private key size, enter valid dates
and specify additional information specific to the NIOS appliance. If you have multiple appliances, you can generate
a certificate for each appliance with the appropriate hostname. You can generate a self-signed certificate using either
the SHA-1 or SHA-256 (SHA-2) hash algorithm.
To generate a self-signed certificate:
1. Grid: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click
Certificates -> HTTPS Cert -> Generate Self-signed Certificate from the Toolbar. In a Grid, ensure that you select the
Grid Master when generating a self-signed certificate.
2. In the Generate Self-Signed Certificate dialog box, complete the following:
— Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256
(SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
— Days Valid: Specify the validity period of the certificate.
— Common Name: Specify the domain name of the NIOS appliance. You can enter the FQDN (fully qualified
domain name) of the appliance.
— Organization: Enter the name of your company.
— Organizational Unit: Enter the name of your department.
— Locality: Enter a location, such as the city or town of your company.
— State or Province: Enter the state or province.
— Country Code: Enter the two-letter code that identifies the country, such as US.
— Admin E-mail Address: Enter the email address of the appliance administrator.
— Comment: Enter information about the certificate.
3. Click OK.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 63

Infoblox Grid Manager

4. If the appliance already has an existing HTTPS certificate, the new certificate replaces the existing one. In the
Replace HTTPS Certificate Confirmation dialog box, click Yes. The appliance logs you out, or you can manually log
out. When you log in to the appliance again, it uses the new certificate you generated.

Generating Certificate Signing Requests

You can generate a CSR (certificate signing request) that you can use to obtain a signed certificate from your own
trusted CA. Once you receive the signed certificate, you can import it in to the NIOS appliance, as described in
Uploading Certificates on page 64.
To generate a CSR:
1. Grid: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click
Certificates -> HTTPS Cert -> Create Signing Request from the Toolbar.
2. In the Create Certificate Signing Request dialog box, enter the following:
— Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256
(SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
— Common Name: Specify the domain name of the NIOS appliance. You can enter the FQDN of the appliance.
— Organization: Enter the name of your company.
— Organizational Unit: Enter the name of your department.
— Locality: Enter a location, such as the city or town of your company.
— State or Province: Enter the state or province.
— Country Code: Enter the two-letter code that identifies the country, such as US.
— Admin E-mail Address: Enter the email address of the appliance administrator.
— Comment: Enter information about the certificate.
3. Click OK.

Uploading Certificates
When you receive the certificate from the CA, and import it to the appliance, the NIOS appliance finds the matching
CSR and takes the private key associated with the CSR and associates it with the newly imported certificate. The
appliance then automatically deletes the CSR.
If the CA sends an intermediate certificate that must be installed along with the server certificate, you can upload
both certificates to the appliance. The appliance supports the use of intermediate certificates to complete the chain
of trust from the server certificate to a trusted root CA. This eliminates intermediate certificate security warnings that
appear when you open a web browser and try to connect to an Infoblox appliance.
To import a certificate:
1. Grid: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click
Certificates -> HTTPS Cert -> Upload Certificate from the Toolbar.
2. Navigate to where the certificate is located and click Open.
3. If the appliance already has an existing HTTPS certificate, the new certificate replaces the existing one. In the
Replace HTTPS Certificate Confirmation dialog box, click Yes.
The appliance imports the certificate and logs you out. When you log in to the appliance again, it uses the
certificate you imported.

Downloading Certificates
You can download the current certificate or a self-signed certificate, as described in Generating Self-Signed
Certificates on page 63.
To download a certificate:
1. Grid: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click
Certificates -> HTTPS Cert -> Download Certificate from the Toolbar.

64 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Certificates

2. Navigate to where you want to save the certificate, enter the file name, and then click Save.

About Client Certificates

You can generate client certificates for a Grid Master or a Grid Master candidate, and then send it to another server,
such as a Hardware Security Module (HSM).

Generating a Client Certificate

To generate a client certificate:
1. Grid: From the Grid tab, select the Grid Manager tab.
Grid Master Candidate: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box.
2. From the Toolbar, click Certificates -> Client Cert -> Generate Client Certificate, and select either RSASHA1 or
RSASHA256.
— If you are generating a certificate for an HSM group with SafeNet Luna SA 4 devices, you must select
RSASHA1; and if the certificate is for an HSM group with SafeNet Luna SA 5 devices, select RSASHA256.
The appliance displays a confirmation dialog after it generates the certificate. If a certificate had been previously
generated, the appliance displays a dialog warning that if the previous certificate was registered with a server, then
the new certificate must be registered with the server.

Viewing Client Certificates

To view the client certificates that were generated:
1. Grid: From the Grid tab, select the Grid Manager tab.
Grid Master Candidate: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box.
2. From the Toolbar, click Certificates -> Client Cert -> View Client Certificate, and select either RSASHA1 or
RSASHA256.
The appliance displays the selected certificate.

Downloading Client Certificates

To download a client certificate:
1. Grid: From the Grid tab, select the Grid Manager tab.
Grid Master Candidate: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box.
2. From the Toolbar, click Certificates -> Client Cert -> Download Client Certificate, and select either RSASHA1 or
RSASHA256.
3. Save the certificate.

About CA Certificates
If the CA sends an intermediate certificate that must be installed along with the server certificate, you can upload
both certificates to the appliance. The appliance supports the use of intermediate certificates to complete the chain
of trust from the server certificate to a trusted root CA. This eliminates intermediate certificate security warnings that
appear when you open a web browser and try to connect to an Infoblox appliance.
When you configure two-factor authentication for smart card users, ensure that you upload the required CA
certificates before you enable the OCSP service. For information about two factor authentication and how to configure
it, see Defining the Authentication Policy on page 227. Only superusers and limited-access users with the required
permissions can manage CA certificates. For information about admin permissions, see Administrative Permissions
for OCSP Server Groups and CA Certificates on page 264.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 65

Infoblox Grid Manager

Uploading CA Certificates
To upload a CA-signed certificate:
1. Grid: From the Grid tab, select the Grid Manager tab.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box.
2. Select Certificates -> Manage CA Certificates from the Toolbar.
3. In the CA Certificates editor, click the Add icon.
4. In the Upload dialog box, click Select and navigate to the certificate you want to upload.
5. Select the file and click Upload.

Note: NIOS can only upload certificates that are in PEM format. A.PEM file can contain more than one certificate.
For information about how to convert CA certificates to .PEM format, see Converting CA Certificates to PEM
Format on page 66.

Repeat the steps to add additional CA-signed certificates.

The CA Certificates dialog box displays the following information about the intermediate certificates:
• Issuer: The name of the trusted CA that issued the certificate.
• Valid From: The date from which the certificate becomes valid.
• Valid To: The date until which the certificate is valid.
• Subject: The name of the certificate.
You can also do the following:
• Select a certificate and click the Delete icon to delete it.
• Print the data or export it in .csv format.

Converting CA Certificates to PEM Format

NIOS can only upload certificates that are in PEM format. PEM files are Base64 encoded ASCII files. You can use
OpenSSL to convert other certificate formats, such as P7B and DER, into PEM format.
You can run OpenSSL on Linux and Windows systems. For Linux, OpenSSL is pre-installed. For Windows, you can
manually install an OpenSSL for Windows. For information about OpenSSL, visit its web site at
http://www.openssl.org/.
To convert a P7B file to PEM format using OpenSSL:
1. Download and unzip the CA certificate file in P7B format.
2. Navigate to the directory where you unzip the CA certificate file.
3. Identify the PKCS7 directory.
4. Use the following OpenSSL command to convert the P7B file to PEM format:
$ openssl pkcs7 -in xxxx.p7b -print_certs -out yyyy.pem
where xxxx is the name of the P7B file and yyyy is the name of the converted PEM file.
To convert a DER file to PEM format using OpenSSL:
1. Download and unzip the CA certificate file in DER format.
2. Navigate to the directory where you unzip the CA certificate file.
3. Use the following OpenSSL command to convert the DER file to PEM format:
$ openssl x509 -inform DER -outform PEM -in xxxx.cer -out yyyy.pem
where xxxx is the name of the DER file and yyyy is the name of the converted PEM file.

66 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About the Grid Manager Interface

About the Grid Manager Interface

Grid Manager provides an easy-to-use interface that simplifies core network services management. Its navigational
tools enable you to quickly move through the application and retrieve the information you need. You can customize
different elements in your workspace, and hide and display panels as you need them. It also provides different types
of Help, so you can immediately access the information you need to complete your tasks.
Figure 1.3 illustrates the typical layout of Grid Manager. It identifies common elements of the interface and features
that you can use:

Figure 1.3 Grid Manager Interface

System Messages Banner Messages Breadcrumbs Navigation Long Running Task Global Search

Finder Panel Workspace Toolbar Help Panel

System Messages
Grid Manager displays system messages at the top of the screen. In wizards and editors, it displays messages at the
top as well.

Note: Some configuration changes require a service restart. Grid Manager displays a message whenever you make
such a change. Click the Restart icon that appears in the message to restart services.

Security and Informational Banners

Grid Manager displays banner messages on the header and footer of the screen. Only superusers can publish the
informational and security banner. There are two types of banners:
• Security Banner - Security banner indicates the security level of the Infoblox Grid. There are five security levels
to choose from the Security list box. The available security levels are Top Secret, Secret, Confidential, Restricted,
and Unclassified.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 67

Infoblox Grid Manager

• Informational Banner - You can use the informational banner for multiple uses, such as to indicate whether the
Infoblox Grid is in production or a lab system. You can also publish messages of the day.
For more information, see Configuring Security Level Banner on page 326 and Configuring Informational Level Banner
on page 327.

Breadcrumbs Navigation
Breadcrumbs navigation displays your path to the current page. It helps you keep track of your location in Grid
Manager. You can click any of the links to get back to a previous page.

Global Search
Use Global Search to find data. Grid Manager searches the entire NIOS database for data that matches the criteria
you specify. For additional information on Global Search, see Using Global Search on page 78.

Finder Panel
The Finder panel appears on all pages in Grid Manager. It provides the following tools:
• Smart Folders: Use smart folders to organize your data according to criteria that you specify.
• Bookmarks: Stores data that you have marked for easy retrieval.
• Recycle Bin: Stores deleted objects that you can either restore or permanently remove.
• URL Links: You can add, modify, and delete third party URL links of frequently used portals and destination
pages.
You can resize, collapse, and expand the Finder panel.

Toolbar Panel
The vertical Toolbar panel provides easy access to commands. The Toolbar is available in all pages, except the
Dashboard. Its content changes depending on the type of data displayed in the work area. You can resize, collapse,
and expand the Toolbar panel.

Help Panel
The Help panel provides the following types of Help:
• Help: Expand this section to view information about the window currently displayed.
• Documentation: Expand this section to download the latest versions of the Infoblox Administrator Guide and
Infoblox API Documentation.
• Support: Expand this section to view links to the Infoblox web site and Technical Support site.
• About: Expand this section to view information about the NIOS software version.
You can resize, collapse, and expand the Help panel. In addition, each dialog box also provides a Help panel that
contains information specific to the dialog box. You can expand and collapse the Help panel in dialog boxes as well.

Wizards and Editors

Grid Manager provides a wizard for every object that you can create. You use wizards to enter basic information
required to create an object. If you want to configure additional parameters, you can then save the object and edit it.
Note that all required fields are denoted by asterisks.
Your connection to Grid Manager may time out if a save operation takes longer than 120 seconds to complete. This
can occur when multiple, complex operations are initiated by several users. It does not result in any data loss.

68 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About the Grid Manager Interface

Tooltips
Tooltips display the function of each button. Hover your mouse over a button or icon to display its label.

Customizing Tables
Grid Manager uses dynamic tables to display information. You can customize tables by resizing columns, sorting the
data, and selecting certain columns for display. Your settings remain active until you log out.
To resize columns in a table:
1. In the table, place your pointer on the right border of the header of the column you want to resize.
2. Drag the border to the desired width.
To sort the data displayed in a table, click the header title. You can click the header title again to reverse the sort order.
Alternatively, you can do the following:
1. In the table, mouse over to a header title and click the down arrow key.
2. Select Sort Ascending or Sort Descending.
To edit columns:
1. In the table, mouse over to a header title and click the down arrow key.
2. Select Columns > Edit Columns.
3. Do the following:
— Width: Specify the width of the column in pixels. The minimum is five and the maximum is 999.
— Sorted: Indicates whether the data in the column can be sorted
— Visible: Click the check boxes of the columns you want to display, and clear the check boxes of those you
want to hide.
4. Do one of the following:
— Click Apply to apply your settings to the column.
— Click Cancel to close the editor without saving your settings.
— Click Reset to reset the settings to the default.
Grid Manager displays the selected column in the table.
To reorder columns in a table, drag and drop the columns to the desired positions.

Selecting Objects in Tables

In a table, Grid Manager displays data on multiple pages when the number of items to be displayed exceeds the
maximum number of items that can be displayed on one page. Use the navigational buttons at the bottom of the table
to page through the display.
You can select multiple rows in a table. For example, in a Windows browser, you can do the following to select multiple
rows:
• Use SHIFT+click to select multiple contiguous rows.
• Use CTRL+click to select multiple non-contiguous rows.
• Click the check box in the table header to select all rows on a page, as shown in Figure 1.4.
When you click the select all check box in a table that contains multiple pages, only the rows on the current page are
selected. Grid Manager displays a message that indicates the total number of selected rows on the page. You can
click Select all objects in the dataset to select all rows in the entire table. When you select all rows in the table, Grid
Manager displays a message to indicate that. You can then click Clear Selection to deselect the rows.
After you select all rows on a page, you can deselect a specific row by clearing the check box of the row. You can also
click a row (not the check box) in the table to select the item and deselect the others.
In a table, when you select all the objects for deletion, the objects that are not deleted from the database remain in
the table after the operation is completed.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 69

Infoblox Grid Manager

Figure 1.4 Select All in a Table

Click this link to

select all rows on
all pages.

Click this check

box to select all
rows on this page
only.

Use these
navigational
buttons to page
through the display.

Modifying Data in Tables

Infoblox provides inline editing for certain fields in some tables. You can use this feature to modify data directly in a
table instead of going through an editor.
To update information in a table, you must have read/write permission to the data. When you enter or select a new
value, the appliance validates the data format before saving the updated data.
To modify data in a table:
1. From any panel that supports inline editing, double click the row of data that you want to modify. The appliance
displays the inline editing editor in the selected row, as shown in Figure 1.5.
2. Depending on the data type, enter the new data in the field or select an item from the drop-down list. Note that
some fields are read-only.
3. Click Save to save the changes, or click Cancel to discard them.

70 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About the Grid Manager Interface

Figure 1.5 Inline Editing

NIOS 7.3 NIOS Administrator Guide (Rev. A) 71

Infoblox Grid Manager

Finding and Restoring Data

Grid Manager provides tools for organizing and quickly retrieving your DNS, DHCP and IP address management data.
The Finder panel, which appears on all pages in Grid Manager, provides tools for organizing your data. The Finder
panel provides easy access to the following:
• Smart Folders: Contains a hierarchical list of smart folders that are available in My Smart Folders. For
information, see My Smart Folders on page 175.
• Bookmarks: Contains bookmarked objects, such as networks and IP addresses. For information, see Using
Bookmarks.
• Recycle Bin: Contains deleted objects that can be restored or permanently removed. For information, see Using
the Recycle Bin on page 73.
• URL Links: Contains a list of third party URLs that you previously added. You can add more URL links, and modify
and delete existing URL links. For information, see Managing Third Party URL Links on page 75.
In the Finder panel, you can expand and collapse these sections. To expand a section, click the + icon next to the
header. To collapse a section, click the - icon.
In addition, Grid Manager also provides the following:
• Filters to customize data displays. For more information, see Using Filters on page 76 and Using Quick Filters
on page 77.
• Global Search to search the NIOS database for objects that match your criteria. For more information, see Using
Global Search on page 78.
• Go To function to quickly locate an object. For more information, see Using the Go To Function on page 81.

Using Bookmarks
The Bookmarks section displays objects for which you have created bookmarks. You can create bookmarks for
objects such as networks, DNS zones, and admin groups. To bookmark an object, navigate to its page and click the
Bookmark icon at the top of the page. If you have more than one network view, Grid Manager displays the name of
the bookmark with the network view to which the object belongs. For example, when you bookmark IP address
10.128.0.10 in the default network view, Grid Manager displays the bookmark as default > 12.128.0.10.
However, if you have only one network view, Grid Manager displays only the object name 12.128.0.10. If you create
a bookmark before adding more network views, the bookmark name (without the network view) remains the same.
You can rename the bookmark at anytime. You can create only one bookmark for each object, up to 500 objects. When
your bookmarks are close to 500, you may want to remove some to create room for new ones.
You can do the following in Bookmarks:
• Access a bookmarked object
• Edit the name of a bookmark
• Delete a bookmark
To access a bookmarked object, click the name of the bookmark. Grid Manager displays the network view to which
the bookmarked object belongs. For example, clicking on the bookmark of network 10.0.1/24 takes you to the
network list view. You cannot access an object that has been deleted.
You can arrange the order of the bookmarked objects by dragging and dropping the objects in the Finder panel.
To edit the name of a bookmark:
1. Mouse over to the bookmark.
2. Click the Edit icon.
3. Modify the name of the bookmark. Note that you cannot create multiple bookmarks with the same name.
To delete a bookmark:
1. Mouse over to the bookmark.
2. Click the Delete icon. Grid Manager removes the bookmark.

72 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Finding and Restoring Data

Using the Recycle Bin

The Recycle Bin section contains objects that you deleted. It provides a way to restore data where the deletion of the
object (such as a network) could result in a major data loss.
You must enable the Recycle Bin in Grid Manager to store and restore deleted objects. For information about how to
enable and disable the Recycle Bin, see Enabling and Disabling the Recycle Bin. When you use the Recycle Bin, you
can restore deleted objects to the active configuration. You can also permanently remove the objects from the Recycle
Bin. If you do not enable the Recycle Bin, the appliance immediately removes objects from the database when you
delete them using Grid Manager.

Note: When you upgrade to a new NIOS release, the appliance permanently deletes the objects from the Recycle Bin.

On a NIOS appliance, only superusers have permissions to fully manage the Recycle Bin. If you have limited-access
permissions, you can view, restore, and permanently remove only the objects that you deleted.
For Cloud Network Automation, the Recycle Bin is not supported on the Cloud Platform Appliance. Only deletions
perform on the Grid Master are stored in the Recycle Bin. Deleted objects can only be restored from the Grid Master.
For information about Cloud Network Automation, see Deploying Cloud Network Automation on page 361.
You can do the following in the Recycle Bin:
• View deleted objects
• Restore deleted objects
• Remove deleted objects
• Empty the Recycle Bin

Enabling and Disabling the Recycle Bin

To enable or disable the Recycle Bin:
1. From the Grid tab, select the Grid Manager tab, and then click Grid Properties -> Edit from the Toolbar.
2. In the Grid Properties Editor, select the General tab, and then complete the following:
Select Enable Recycle Bin to enable the Recycle Bin
or
Deselect Enable Recycle Bin to disable the Recycle Bin.
3. Save the configuration and click Restart if it appears at the top of the screen.

Viewing Objects in the Recycle Bin

Grid Manager displays the short name of all deleted objects in the Recycle Bin. For example, the short names for hosts
and resource records are their domain names, and the short names for fixed addresses and reservations are their IP
addresses.
The Recycle Bin does not display all deleted objects; it can display up to 15 of the most recently deleted objects.
When the Recycle Bin contains objects that are not displayed in the Finder panel or multiple objects that have the
same name, the Show All button appears. Click the button to display the Recycle Bin dialog box that contains detailed
information about each deleted object. When you have multiple deleted objects that use the same name, you may
want to view detailed information about the deleted objects before taking any action. You can remove and restore
selected objects and empty the Recycle Bin in the Recycle Bin dialog box.
You can do the following in the Recycle Bin dialog box:
• Sort the data in ascending or descending order by column.
• Use filters and the search function to look for specific objects. For information about filters, see Using Filters on
page 76.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Use the Go To function to quickly find the data in the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 73

Infoblox Grid Manager

To view detailed information about deleted objects:

1. In the Finder panel, expand Recycle Bin.
2. Click Show All.
Grid Manager displays the Recycle Bin dialog box that contains the following information for each object:
— Name: The short name of the object. For example, the short names for fixed addresses and reservations are
their IP addresses.
— Type: The object type.
— Parent/Container: The parent object or parent container to which the object belongs.
— Admin: The admin name of the user who deleted the object.
— Data: The data that the object contains, if any.
— Network View: The network view to which the object belongs.
— Time: The time stamp when the object was deleted.
To close the dialog box, click Close.

Restoring Objects from the Recycle Bin

You can restore deleted objects from the Recycle Bin only if you enable the Recycle Bin, and only if you select an
object in the panel. You can restore only one object at a time. Deleted objects are stored in the Recycle Bin until you
delete them or empty the bin.
To restore items from the Recycle Bin:
1. In the Finder panel, expand Recycle Bin.
2. Select the object you want to restore.
3. Click the Restore icon.
Grid Manager restores the object to its corresponding container or configuration. You can confirm the restoration by
checking that the object does not appear in the Recycle Bin any longer, and that it is reestablished in the appropriate
panel in the GUI.

Deleting Objects in the Recycle Bin

You can permanently delete individual objects in the Recycle Bin only if the Recycle Bin is enabled.
To delete objects in the Recycle Bin:
1. In the Finder panel, expand Recycle Bin.
2. Select the object you want to delete.
3. Click the Delete icon.
Grid Manager displays the Confirm Delete dialog box.
4. Click Yes to delete the object.

Emptying the Recycle Bin

You can permanently delete the contents of the Recycle Bin, if enabled. Only superusers can empty the Recycle Bin.
Because the Recycle Bin can grow large, you can periodically empty the Recycle Bin to free up disk space.
To empty the Recycle Bin:
1. In the Finder panel, expand Recycle Bin.
2. Click Empty.
Grid Manager displays the Confirm Empty Recycle Bin dialog box to confirm that you wish to empty the Recycle
Bin.
3. Click Yes.

74 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Finding and Restoring Data

Managing Third Party URL Links

In the URL Links section, you can add the URL links of frequently used third party portals and destination pages. For
example, you can add the URL of a trouble ticket system and quickly access the portal once you are logged in to the
Infoblox GUI. When you click an existing URL link, Grid Manager displays the destination page in a new browser
window. You can also modify and delete existing URL links in this section.
On the appliance, only superusers have permissions to fully manage the URL links. Superusers can create URL links
and make them globally available to all users. If you have limited-access permissions, you can only add URL links for
your own use. You cannot share the links with other users.
You can do the following in the URL Links section:
• Add new URL links, as described in Adding URL Links.
• Modify URL links, as described in Modifying URL Links.
• Delete URL links, as described in Deleting URL Links.

Adding URL Links

1. In the Finder panel, expand URL Links.
2. Click Add.
3. In the URL Configuration dialog box, complete the following:
— URL: Enter the URL of the destination page you want to add. The appliance supports valid URL entries that
contain up to 2000 characters. When you enter the URL, the appliance validates the entry. You cannot save
the entry if the URL is not in a valid format.
— Name: Enter a name that represents the portal or site of the URL.
— Set as global parameter: This field appears only if you log in as a superuser. Select this check box to make
the URL link globally available to all users.
— Logo: Click Upload to add a logo to the URL. The appliance displays the logo in 16x16 pixels. Click Reset to
Default to use the default logo.
4. Save the configuration.

Modifying URL Links

To modify the information you entered for an existing URL link:
1. In the Finder panel, expand URL Links.
2. Hover your mouse over the URL you want to modify, and then click the Edit icon.
3. In the URL Configuration dialog box, modify the information as described in Adding URL Links.

Deleting URL Links

To permanently delete an URL link:
1. In the Finder panel, expand URL Links.
2. Hover your mouse over the URL you want to delete, and then click the Delete icon.
3. In the Delete URL Link dialog box, click Yes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 75

Infoblox Grid Manager

Using Filters
You can control the amount and the kind of data displayed in a specific panel by adding filter criteria. When you add
filter criteria, the appliance screens the data based on your filter rules and displays only the information that matches
the rules. To narrow your search for specific information, you can add up to 10 filter rules. In some panels, such as
the DHCP Networks tab, you can switch between viewing information with and without the filter criteria by toggling
the filter on and off. You can save filter criteria as quick filters so you can reuse the same filter rules to obtain updated
information without redefining them each time you log in to the appliance. For information about quick filters, see
Using Quick Filters on page 77.
You can also use filters to find objects that have failed an operation. When you try to modify multiple objects with the
same extensible attribute, the appliance may not modify all of the selected objects. For information, see About
Extensible Attributes on page 417. For example, after you modify the extensible attribute “Building” with new value
“West”, you can find the objects that are not updated by defining a filter with “Building” “does not equal” “West”.
Depending on the filter criteria, you can use different filter operations to narrow down your search results. Grid
Manager supports the following filter operations based on your selected filter criteria:
• equals: Defines a specific value for a selected filter criterion
• does not equal: Defines a selected filter criterion that does not equal a specific value
• begins with: Specifies a beginning value for a selected filter criterion
• does not begin with: Specifies a selected filter criterion that does not begin with a specific value
• has a value: Specifies a selected filter criterion that contains a value
• does not have a value: Specifies a selected filter criterion that does not contain a value
• belongs to: Defines a selected filter criterion that belongs to a specific parent object
• Inheritance State equals: Specifies a specific inheritance state
To use a filter:
1. In a panel, click Show Filter to enable the function.
2. In the filter section, complete the following:
— In the first drop-down list, select a field such as an object name, comment, or an extensible attribute (fields
with a gray background) as the filter criterion. Grid Manager displays only the supported fields.
— In the operator drop-down list, select an operator for the filter criterion. Depending on what you select in
the first filter field, this list displays the relevant operators for the selection. The operator Inheritance State
equals is displayed only when you select an inheritable extensible attribute from the Type drop-down list.
This operator is not displayed if the extensible attribute is not inheritable.
— In the value field, enter or select the attribute value for the first filter field. Depending on what you select for
the first two filter fields, you can either enter a value or select an attribute from a drop-down list. For
example, if you select an extensible attribute in the first filter field, you can enter the attribute value here. If
you select an inheritable extensible attribute from the Type drop-down list, and select Inheritance State
equals in the operator drop-down list, the value field displays a drop-down list with these values: Inherited
and Overridden/No Parent. When you select Inherited, extensible attributes that are inherited by the
descendants are listed. When you select Overridden/No Parent, extensible attributes which are overridden
or do not have a parent are listed.
3. Optionally, click the + icon to add another filter rule. You can add up to 10 filter rules.
4. Click Apply to apply the rules
or
Click Reset to clear the filter criteria.
To view information with or without the filter criteria:
• Click Toggle Filter On to apply filter criteria to the displayed data. Grid Manager displays only the filtered data in
the panel.
or
Click Toggle Filter Off to have the appliance list all data without applying filter criteria.

76 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Finding and Restoring Data

Using Quick Filters

A quick filter saves filter rules that you define in a specific panel. You can reuse a quick filter to find updated
information in a panel without specifying the same rules each time. Superusers can define quick filters and share
them with local users. Limited-access users can only create quick filters for their own use. You can create up to 10
global and 10 local quick filters in each panel that supports filters. For information about filters, see Using Filters on
page 76.
The appliance supports the following quick filters:
• System quick filters: These are predefined filters. You cannot modify the criteria of these filters. System quick
filters are prefixed with [S] in the quick filter list. Infoblox currently supports the following system quick filters in
the DNS data panels:
— All Forward Mapping Zones: This quick filter displays all forward mapping zones in lexicographical order.
— All Reverse Mapping Zones: This quick filter displays all IPv4 and IPv6 reverse mapping zones in numerical
order. The appliance displays IPv4 zones before IPv6 zones.
— All IPv4 Reverse Mapping Zones: This quick filter displays only the IPv4 reverse mapping zones in numerical
order.
— All IPv6 Reverse Mapping Zones: This quick filter displays only the IPv6 reverse mapping zones in numerical
order.
— RPZ Logs: This quick filter displays only the RPZ syslog messages in CEF format. This option is displayed
only in the Syslog when RPZ license is enabled.

Note: In the default DNS zone view, the appliance displays forward mapping zones first, followed by IPv4 reverse
mapping zones, and then IPv6 reverse mapping zones.

• Global quick filters: Only superusers can define global quick filters. You can make global filters available to all
users. Limited-access users can use global quick filters, but they cannot modify them. Global filters are prefixed
with [G] in the filter list.
• Local quick filters: Limited-access users can create local quick filters for their own use. You cannot share local
quick filters with other users in the Grid. Local filters are prefixed with [L] in the filter list.

Adding Quick Filters

1. In a panel that supports filters, click Show Filters.
2. In the filter section, define filter criteria for the quick filter, as described in Using Filters on page 76.
3. Click Save.
4. In the Save Quick Filter dialog box, complete the following:
— Name: Enter a name for the quick filter. The name must be 20 characters or longer. Ensure that you use a
unique name for each quick filter in a particular filter category. For example, you can use the same filter
name for both a global and local filter, but you cannot do so for two local filters.
— Set as a global quick filter: This displays only if you log in as a superuser. Select this check box to make the
quick filter globally available to all users.
5. Save the configuration.
The appliance adds the quick filter to the quick filter drop-down list in the specified panel.

Modifying Quick Filters

1. In a panel that supports filters, click Show Filters, and then select the quick filter you want to modify from the
Quick Filter drop-down list.
2. In the filter section, click the Edit icon next to the filter name.
3. Modify the filter criteria, as described in Using Filters on page 76.
4. Click Save.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 77

Infoblox Grid Manager

5. In the Save Quick Filter dialog box, you can click Save to save the modified filter criteria under the same quick
filter name. You can also modify the quick filter name, as described in Modifying Quick Filters on page 77, and
save the entry as a new quick filter.
6. Save the configuration.

Applying Quick Filters

1. In a panel that supports filters, click Show Filters, and select the quick filter from the Quick Filter drop-down list.
2. Based on the filter criteria, the appliance displays the filtered information in the panel. The selected quick filter
remains active in the panel until you select another quick filter.

Turning Off Quick Filters

You can do one of the following to turn off a quick filter:
• Select None from the quick filter drop-down list.
• Click Toggle Filter Off or Reset in the filter section.
• Delete a quick filter, as described in Deleting Quick Filters.

Deleting Quick Filters

1. In a panel that supports filters, click Show Filters, and then select the quick filter you want to delete from the
Quick Filter drop-down list.
2. In the filter section, click the Delete icon next to the filter name.
3. In the Delete Quick Filter dialog box, click Yes to permanently delete the quick filter.

Using Global Search

You can use the global search function to search the entire NIOS database for data that matches a specific value and
filter criteria. You can define filter criteria and enter applicable search values to refine the search. Grid Manager
supports regular expressions in global search. Grid Manager can display up to 500 search results. When search
results exceed 500, a warning message appears and you may want to refine your search. Search results remain in the
Search dialog box until you reset the search parameters or log out of Grid Manager. You can search for DNS zones and
resource records that contain IDNs. For information about IDNs, see Support for Internationalized Domain Names on
page 113.
Based on your search requirements, you can choose to perform a basic search or an advanced search.
A basic global search provides a faster way to locate frequently searched results using one specific filter criterion. It
is designed to handle a large amount of data in an efficient manner. Supported filtering objects are DNS name (FQDN
or CNAME only), DUID, IP address and MAC address. This is the recommended global search method if you have a
large data set and only need to search by a single filter criterion.
An advanced global search allows you to perform complex searches by defining multiple filter criteria. You can add
up to 10 filtering rules. You can also include existing extensible attributes for the matching objects.
Note that if a search result contains duplicate records, the appliance displays only one record and discards others.
For example, if the canonical name matches an alias name, the appliance displays only one CNAME record in the
result.

Note: Depending on the size of your database, global search may take a long time to complete. Grid Manager times
out when queries or searches take longer than 120 seconds. To expedite searches, use filters to refine the
search criteria. You can also use basic global searches if you have a large data set and you only need to search
by a single filter criterion.

78 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Finding and Restoring Data

You can also do the following in the Results table:

• Click the Open icon to view detailed information of the matching object.
• Click the Edit icon to edit the matching object information. For information, see Editing Matching Objects in
Search Results on page 80.
• Click the Extensible Attributes icon to edit the value of the respective extensible attribute. For information, see
Editing Multiple Extensible Attributes in Search Results on page 81.
• Click the Export icon to export the data displayed in the Results table.
• Click the Print icon to print the data displayed in the Results table.
To perform a global search:
1. Click the Global Search icon on the navigation bar.
By default, the appliance opens the Basic tab of the Search dialog box.
2. Do one of the following:
— If you want faster search results and you can search by DNS name, DUID, IP address, or MAC address, do the
following in the Basic tab:
— Include Network Insight Devices and Interfaces: This appears only when you have the Network Insight
license installed. Select this check box to include devices and interfaces discovered through Network
Insight. Note that it might take longer than expected for the appliance to return results for these
objects. The setting is saved between user sessions.
— Choose Filter: Select a value from the drop-down list. You can explicitly search by DNS name (FQDN or
CNAME only), DUID, IP address, or a MAC address. Note that you can apply only one filter at a time.
— Choose Operator: Select an operator for the filter criterion. Depending on what you select in the first
filter field, this list displays the relevant operators for the selection. Possible values include equals,
begins with, and contains. For example, if you choose a DNS Name filter, contains is the only applicable
operator.
— In the value field, enter the value for the filter field. For example, if you select DUID in the first filter
field, you can enter the DUID of the client’s device in the value field.
— If you have a more complex search requirement and need to include multiple filter criteria, do the following
in the Advanced tab:
— In the first field, enter the value that you want your search results to match. For example, if you want to
search for hostnames that contain “Infoblox,” enter Infoblox in this field. You can also specify the value
of an inheritable extensible attribute. You can use regular expressions in the search value. For
information, see Regular Expressions on page 1773.
— In the Type drop-down list, select an object type, comment, or an extensible attribute (fields with a gray
background) as the filter criterion. Grid Manager displays all the supported fields in the drop-down list.
The default is Type. Grid Manager searches all objects when you use the default. You can narrow down
the search and improve the search performance by selecting an object type. Extensible attributes are
displayed with a gray background.
— In the operator drop-down list, select an operator for the filter criterion. Depending on what you select
in the first filter field, this list displays the relevant operators for the selection. The operator Inheritance
State equals is displayed only when you select an inheritable extensible attribute from the Type
drop-down list. This operator is not displayed if the extensible attribute is not inheritable.
— In the value field, enter or select the attribute value for the first filter field. Depending on what you
select for the first two filter fields, you can either enter a value or select an attribute from a drop-down
list. For example, if you select an extensible attribute in the first filter field, you can enter the attribute
value here. If you use the default Type in the first filter field, you can select an object or record type from
the drop-down list. The default is ALL. Grid Manager searches all object types when you use the default.
If you select an inheritable extensible attribute from the Type drop-down list, and select Inheritance
State equals in the operator drop-down list, the value field displays a drop-down list with these values:
Inherited and Overridden/No Parent. When you select Inherited, extensible attributes that are inherited
by the descendants are listed. When you select Overridden/No Parent, extensible attributes which are
overridden or do not have a parent are listed.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 79

Infoblox Grid Manager

— Optionally, click the + icon to add another filter. You can add up to 10 filter rules.
— Include Extensible Attributes Values: Select this check box to include extensible attributes in the
search results for the matching objects. Once selected, this configuration affects all future searches for
the current user. Note that it might take longer for the search results to appear if there are a large
number of extensible attributes associated with the matching objects.

Note: You can save each search that contains multiple filter criteria as a quick filter for future use. For information
about quick filters, see Using Quick Filters on page 77.

3. Optionally, you can click Reset to clear the search results and start a new search. You can also click the Refresh
icon to refresh the search results.
Grid Manager stores the search results until you reset the search parameters or log out.
4. After you finish defining filters, click Search or press Enter.
In the Results table, Grid Manager displays the following information:
• Name: The name of the matching object. This field displays the name of the matching object and the path to the
matching object if the object is a network or an IP address. You can click the link to open, view, and edit the
object.
• Type: The type of the matching object. For example, bulk host, NS record, forward-mapping authoritative zone,
or network container.
• Matched Property: The attribute or property of the matching object. For example, if the search value matches the
email address that corresponds to a hostname, this field displays Email. If the search value matches the DNS
view of a resource record in a DNS zone, this field displays DNS View/FQDN.
• Matched Value: The value of the matching object. For example, if an IP address contains the search value, this
field displays the IP address. If a hostname contains the search value, this field displays the hostname.
• IP Address: The IP address of the matching object. When you click the IP address link, Grid Manager displays the
corresponding IP address panel from which you can view detailed information.
• Comment: Comments that were entered for the matching object.
• Site: Values that were entered for the matching object.

Note: If you have selected to include extensible attribute values, you can select the corresponding columns to be
displayed in the search results. Extensible attribute columns are hidden by default.

Editing Matching Objects in Search Results

Grid Manager displays search results in the Results table. You can open and view detailed information about an
object. You can also edit the properties of a selected object.
To edit an object in the Results table:
1. In the Results table, select the object check box.
2. Click the Open or Edit icon. You can also click the link of an object if Grid Manager displays the path.
Grid Manager displays the object in the corresponding editor depending on the type of object you selected.
3. Edit the properties of the object in the editor.
4. Save your changes.

Deleting Matching Objects in Search Results

You can delete one or multiple matching objects in the search Results table.
To delete a matching object:
1. In the Results table, select the object check box. You can delete multiple objects.
2. Click the Delete icon.
3. In the Delete Confirmation dialog box, click Yes.

80 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Tasks

Grid Manager deletes the selected objects from the database. Most deleted objects are stored in the Recycle
Bin. For information, see Using the Recycle Bin on page 73.
You can print search results. You can also export search results in CSV (comma separated value) format. For
information, see About CSV Import on page 101 and Exporting Displayed Data on page 111.

Editing Multiple Extensible Attributes in Search Results

You can edit one or multiple extensible attributes of the matching objects in the search Results table using the
Multi-Select Edit Extensible Attributes editor. When you change multiple extensible attribute values for selected
objects, the values of all selected extensible attributes will be updated.
To edit multiple extensible attributes:
1. In the Results table, select the object check box. You can edit multiple extensible attribute values.
2. Click the Extensible Attributes icon.
3. In the Multi-Select Edit Extensible Attributes editor, click on the Value column to edit the value of the respective
extensible attribute. For information about which values you can edit, see Editing Multiple Extensible Attribute
Values on page 428.

Using the Go To Function

You can use the Go To function to quickly locate an object, such as a network or a DNS zone. With the autocomplete
feature, you can just type the first few characters of an object name in the Go to field and select the object from a list
of possible matches. You can also enter the entire object name, and then click Go to locate a specific object.
To use the Go to function:
1. From a selector, enter the first few characters of the object name in the Go to field. Grid Manager displays up to
ten possible matches in a drop-down list.
2. Click the object from the drop-down list, or use the up and down arrow keys to select the object and then press
Enter. Grid Manager completes the operation based on the selected object.

About Tasks
When you perform a task, such as adding a DNS zone or modifying a DHCP range, you can execute it immediately or
schedule it for a future date and time, depending on your permissions. For information about how to schedule a task,
see Scheduling Tasks on page 85.
Certain tasks, scheduled or not, may be subject to approvals if approval workflows are defined for specific admin
groups. For information about how to define submitters and approvers for an approval workflow, see Configuring
Approval Workflows on page 94.
Note that not all tasks can be scheduled or routed for approval. For a list of supported objects, see Supported Objects
for Scheduled and Approval Tasks on page 84.
When you schedule a task or submit it for approval, consider the following:
• The appliance cannot execute a scheduled or approval task that is associated with an extensible attribute, if
you delete the extensible attribute after you have scheduled the task or submitted it for approval. For
information about extensible attributes, see About Extensible Attributes on page 417.
• The appliance cannot execute, reschedule, or delete a task that is associated with a child object (such as a
DHCP range) if you delete the parent object (such as a network) after you have scheduled the task or submitted
it for approval.
• There are certain guidelines about scheduled and approval tasks when you upgrade the software, back up the
database, and restore data. For information, see Guidelines for Upgrading, Backing Up, and Restoring Data on
page 85.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 81

Infoblox Grid Manager

Viewing Tasks
The appliance displays scheduled tasks and approval tasks in the Task Manager tab of Grid Manager. Scheduled
tasks are those with scheduled time listed and approval tasks contain approval status. A task can also be scheduled
and queued for approval at the same time. By default, all completed and rejected tasks are displayed in Task Manager
for up to 14 days before they are removed from the list. You can configure how long the completed and rejected tasks
are displayed in Task Manager using the CLI command set delete_tasks_interval. For more information about
the CLI command, refer to the Infoblox CLI Guide.
The appliance logs all tasks in the audit log and associates each with a task ID. By default, Grid Manager sorts tasks
by Task ID in Task Manager. You can view tasks that you are allowed to see based on your permissions. For information
about admin permissions, see About Administrative Permissions on page 195.
To view tasks:
1. From the Administration tab, select the Workflow tab -> Task Manager tab.
2. Grid Manager displays the following information for each task:
— Task ID: The ID associated with the task. The appliance assigns an ID to a task in chronological order. By
default, the appliance sorts tasks by Task ID.
— Type: Indicates key information about certain types of executing/executed jobs. The Type column lists
values for Port Control and for Object Change tasks undertaken by Grid Manager or submitted by Grid
Manager for approval by the administrator.
— Affected Object: The name or value of the object that is associated with the task. For example, if the task
involves an A record, this field displays the domain name of the record. If it is a fixed address, it displays
the IP address of the fixed address.
— Scheduled Time: The date, time, and time zone when the appliance executes the task.
— Submitted Time: The date, time, and time zone when the task was submitted.
— Submitter: The username of the admin who scheduled or submitted the task.
— Ticket Number: For an approval workflow, this number may be entered by the submitter to associate the
task with a help desk ticket number or a reference number.
— Submitter Comment: Comments entered by the submitter.
— Approval Status: The current approval status. Possible values are Approved, Not Applicable, Pending, and
Rejected.
— Execution Status: The execution status of the task. Possible values are Completed, Failed, Pending, and
Executing.
— Executed Time: The date, time, and time zone the task was executed.
— Associated Task: (hidden by default) Applies to Port Configuration tasks. If a port configuration task is
dependent on an object change task (such as a new Fixed Address or an edit to an existing object), this
could will show the Task ID value for the associated object change task.
— Action: The operation the appliance performs in this task. The can be: Add, Modify, Delete, Network
Discovery, Lock/Unlock Zone, or Restart Services.
— Task Details: Detailed information about the task. This message also appears in the audit log.
— Approver: The username of the admin who has approved this task.
— Approver Comment: Comments entered by the approver.
— Object Type: The object type. For example, the appliance can display A Record or Fixed Address.
You can do the following in the Task Manager tab:
• Sort the tasks in ascending or descending order by column, except for Task Details.
• Use filters and the search function to look for specific values.

Note: You cannot use the search function to search for approval or execution status. Use filters to search for
these values.

82 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Tasks

• Create a quick filter to save frequently used filter criteria. Grid Manager provides the following default quick
filters that you can select from the Quick Filter drop-down list: Pending Approvals, Rejected Tasks, and
Scheduled Tasks. For more information, see Using Quick Filters on page 77.
• Export and print the information in the table.
• Control the display of information in the panel by toggling between a single-line view and a multi-line view.
• Reschedule a task, cancel a scheduled task, or execute a task immediately.
• For approvers, select a task and click the Approve icon to approve the task, or click the Reject icon to disapprove
the task. You can also reschedule the task while approving it.

Note: If you have multiple pages of tasks in Task Manager, you can select multiple tasks on the current page for
approval or disapproval. If you click the Select all objects in this dataset link to select all the tasks in the
dataset, the Approve and Reject icons are disabled and you cannot approve or reject any task.

Using the Task Manager Action Menu

The Task Manager page provides an Action icon column with a series of menu options for features related to grid
Manager tasks to manage task execution, scheduling and approval. Menu choices change based upon the context
and the current state of tasks in the table; features available in the Action menu include the following:

Figure 1.6 Task Manager Action menu

• (Applies only with Network Insight) Approve and Reject: Enables admins to approve or reject a pending job;
rejecting a job immediately cancels it.
• Associated Task (applies only with port configuration tasks): Choosing this option opens the object change
task, if any, for the currently selected port configuration task.
• Execution Log: Opens a completed task’s execution log window. the Execution Log lists the complete
communications sequence sent to a device to perform a port control task.
• Execute Now: Force a selected pending task to execute immediately.
• Re-execute: Allows you to re-run the selected task. Combined with the Execution Log, this process can aid in
troubleshooting a failed port control task.
• Reschedule: Opens the Reschedule window for the selected task. To immediately execute this task, click Now.
Or, in the Reschedule panel, click Later, and then specify a date, time, and time zone. You can reschedule the
task if you have the applicable permissions. Click Save to commit the changes.
• Delete: Deletes the pending task.
• View: Opens the Task Viewer to the currently selected task. For related information, see Using the Task Viewer to
View Job Logs and Approve Jobs on page 135.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 83

Infoblox Grid Manager

Supported Objects for Scheduled and Approval Tasks

• DNS zones (authoritative, forward, stub, and delegated)
• DNS views
• DNS resource records (except SOA records)
• Import resource records to DNS zones
• Lock and unlock DNS zones
• Hosts
• Bulk hosts
• Roaming hosts
• Shared records
• Shared record groups
• IPv4 and IPv6 networks
• IPv4 and IPv6 network containers
• IPv4 and IPv6 shared networks
• IPv4 and IPv6 DHCP ranges
• IPv4 and IPv6 reserved ranges
• IPv4 and IPv6 fixed addresses
• IPv4 reservations
• DHCP fingerprints
• IPv4 DHCP filters (MAC, option, NAC, relay agent, and DHCP Fingerprint)

Note: Only IPv4 MAC filters support approval workflows.

• IPv4 MAC address filter items

• Conversion of IPv4 and IPv6 static and dynamic leases
• Microsoft objects that are supported by NIOS
• Load balancer related objects
• DNS64 Synthesis Groups
• All IPAM tasks except CSV imports
• Response Policy Zones
• Response Policy records
You can also schedule the following operations or create approval workflows for them:
• Network Discovery
• Device Discovery
• VM Discovery
• Port Control provisioning tasks for setting Admin Status, VLAN assignments, and a Description;
• Defining infrastructure device port reservations for the following IPAM/DHCP objects:
— IPv4 Reservations
— IPv4/IPv6 Fixed Addresses
— Hosts
— Grid Members
— IPv4 and IPv6 Networks
• Service restarts (for scheduled tasks only)

Note: Service restarts are not subject to approvals.

84 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Scheduling Tasks

Guidelines for Upgrading, Backing Up, and Restoring Data

You should take into consideration the impact on scheduled and approval tasks when you perform any of the
following:
• When you upgrade from previous releases to NIOS 6.7 and later, the appliance converts all valid punycode data
to IDNs for DNS resource records and DNS zones. When you have a fresh installation of NIOS 6.7 and later, the
appliance converts all valid punycode data to IDNs for DNS zones only. It retains punycode data for resource
records.
• Upgrade the NIOS software: In a full upgrade, all scheduled and approval tasks are deleted. In a lite upgrade,
scheduled and approval tasks are not deleted.
• Back up the NIOS database: All scheduled and approval tasks are backed up for troubleshooting purpose.
• Restore the database: Scheduled and approval tasks are not restored.
• Promote a Grid member to a Grid Master: After the promotion, all scheduled and approval tasks that are past
due are executed immediately.
• Revert the NIOS software image: After the revert, all scheduled and approval tasks that are past due are
executed immediately.
• Restore data from the Recycle Bin: To restore a deleted parent object (such as a network) that contains a child
object (such as a DHCP range) associated with a scheduled or approval task, you must first delete the
scheduled or approval task for the child object.

Scheduling Tasks
You can schedule tasks, such as adding DNS zones, modifying fixed addresses, and restarting services, for a future
date and time. The scheduling feature is useful when you want to add, modify, or delete a record, or schedule a
network discovery at a desired date and time. Using this feature, you can streamline your day-to-day operations. For
example, you can schedule the deletion of records that you use for testing when the test time is up. You can also
reassign an IP address to a fixed address when the location of the server to which the fixed address is assigned
changes from one network to another.
You can schedule the addition, modification, and deletion of certain objects. For a list of the supported objects, see
Supported Objects for Scheduled and Approval Tasks on page 84.
Depending on your permissions and the admin group to which you belong, your scheduled tasks may be subject to
approvals by other admins in your organization. You may or may not receive email notifications about the status of
your scheduled tasks depending on the configuration of the approval workflows. Approvers can reschedule your
tasks after they have approved the tasks, if they have scheduling permissions. When you schedule and submit a task,
you may need to enter a ticket number associated with the task or a comment about the task. For more information
about approval workflows, see Configuring Approval Workflows on page 94.
Only superusers can view, reschedule, and delete all scheduled tasks. Limited-access admins can reschedule and
delete only their scheduled tasks. If your scheduled tasks require approvals, the approvers who have scheduling
permissions may reschedule your tasks to a different date and time after they have approved the tasks. Depending
on your admin permissions, there are certain scheduled and approval tasks that you may or may not be able to
perform. For more information, see Supported Tasks for Different Admin Groups on page 95.
The appliance sends email notifications to local admins, except for those who do not have email addresses, when
email notification is enabled for the admins and any of the following happens:
• A superuser schedules a task, and another superuser reschedules or deletes the task.
• A limited-access admin schedules a task, and a superuser reschedules or deletes the task.
• A superuser or a limited-access admin schedules a task, and the task fails.
• An admin is configured to receive notifications based on the configuration of an approval workflow. For
information about approval workflows, see Configuring Approval Workflows on page 94.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 85

Infoblox Grid Manager

Superusers can also grant scheduling permissions to other admin groups. When the scheduling permission is added
or inherited from an admin role, limited-access admin groups can schedule tasks. For information, see Administrative
Permissions for Network Discovery on page 238.

Scheduling New IPAM/DHCP Objects and Associated Port

Configurations
Specific IPAM/DHCP object types support scheduling of Port Configuration tasks as part of their object definition:
• New IPv4 and IPv6 Networks;
• IPv4 Reservations;
• Fixed IPv4 Addresses;
• Fixed IPv6 Addresses;
• Hosts;
• Infoblox Grid Members (including HA Pairs; discussed in the sections beginning in Adding Grid Members on
page 297).
For all of these object types, you can click a Schedule for Later button at any step in the Wizard to commit the currently
defined settings for the new object to a new Grid Manager task. For example, consider creating a new IPv4 network.
After defining the IP address for the new network, you simply wish to create it and not to define any further
configurations. Click Schedule for Later to skip the intervening Wizard steps and display the final Scheduling page of
the Wizard, an example of which appears in Figure 1.7.

Figure 1.7 Create Network Schedule for Later page

1. To create the new object immediately, select Now and click Save & Close.
2. You can choose to have Grid Manager create the object at a later time. To do so, select Later. Choose a Selected
time by entering or selecting a Start Date (click the calendar icon to choose a calendar date) and a Start Time
(click the clock icon to choose a specific time in fifteen minute increments), and choose a Time Zone.
When you step through the entire Wizard process (without clicking Schedule for Later) and if you also define port
configuration settings, the object creation wizards provide a final Scheduling page with separate scheduling
definitions, for the object and for the object’s port configuration, as shown in Figure 1.8:

86 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Scheduling New IPAM/DHCP Objects and Associated Port Configurations

Figure 1.8 Scheduling Create Object and Port Configuration

The final step for creating the Network, Fixed Address, Host, or IP reservation is to define when the task executes,
including associated port control definitions. The port configuration is performed in a separate task, defined on the
same wizard page. The port configuration task can be done at the same time that Grid Manager provisions the object,
or may be scheduled for a later time.
1. To create the new object immediately, select Now.
By selecting Now, no task is created by Grid Manager and it simply creates the object. The completed object
creation appears in the audit log (for related information, see the Viewing Tasks on page 82). Grid Manager
creates a task for object creation only when you use Schedule for Later. Also, all port configuration and network
provisioning instances create a new task under the Task Manager.
2. You can instruct Grid Manager to create the network at a later time. To do so, select Later. Choose a Selected time
by entering or selecting a Start Date (click the calendar icon to choose a calendar date) and a Start Time (click
the clock icon to choose a specific time in fifteen minute increments), and choose a Time Zone.
3. Port configuration and network provisioning tasks can be synchronized to take place at the same time as the
creation of the new object under IPAM/DHCP; if so, keep the At same time as above option.
a. You can also schedule the task at a different time. To do so, select Later (under Port Configuration). Choose
a Selected time by entering or selecting a Start Date (click the calendar icon to choose a calendar date) and
a Start Time (click the clock icon to choose a specific time in fifteen minute increments), and choose a Time
Zone.
The Port Configuration provision cannot take place at a schedule time or date before the associated object
creation.
Object creation must successfully complete before its associated port configuration task begins.
4. Click Save & Close to complete the configuration.

Note: Port configuration tasks (or any operation that queries for or changes device configurations through Grid
Manager, including Discovery) are subject to a feature called Blackout Periods, which are defined elsewhere
in Grid Manager. Blackouts are a scheduled feature that instructs Grid Manager not to perform Discovery
operations and Port Control/provisioning operations on the managed network at specified times, days and
dates. See the section Defining Blackout Periods on page 731 for details.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 87

Infoblox Grid Manager

Scheduling Creation of new IPv4/IPv6 Networks and Associated Device

Provisioning
Defining new IP networks in Grid Manager supports scheduled Network Provisioning tasks on discovered and
managed infrastructure devices as part of their object definition:
• Provisioning IPv4 networks
• Provisioning IPv6 networks
These networks are managed on the IPAM and DHCP pages (unless the network is excluded from DHCP), with the
difference that Network Insight provisions the network directly on the specified router or switch-router. You may
define new networks under IPAM and under DHCP as one scheduled task, and may provision those networks on
devices that are discovered and managed under Network Insight, as another scheduled task.
Both tasks may be separately scheduled. They can take place immediately: the network is created first, then the
network is provisioned on the device, along with the necessary device configuration, which Grid Manager also
handles using the required CLI credentials; or either or both tasks may be scheduled for a later time.
The scheduled IPv4 or IPv6 network must be created under IPAM or DHCP in Grid Manager before scheduled device
configuration or provisioning of networks on those devices can take place.
When you define a new network under IPAM or DHCP, you can click Schedule for Later in any Wizard page to skip
further configuration in the Wizard and commit the network settings to Grid Manager. If you do not want to provision
the network, clicking Schedule for Later will display a shorter scheduling page:

Figure 1.9 Create Network Schedule page (After clicking Schedule for Later)

In cases of this type, you schedule or execute only a single task: creating the new network under DHCP/IPAM. No
network provisioning task takes place.
When you provision the network without clicking Schedule for Later, the wizard provides a final Scheduling page with
an expanded set of two task schedules as shown in Figure 1.10:

88 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Scheduling New IPAM/DHCP Objects and Associated Port Configurations

Figure 1.10 Scheduling Add Network and Network Provisioning Tasks

1. To immediately create the new network, you can select Now.

2. You can choose to have Grid Manager create the network at a later time. To do so, select Later. Choose a Selected
time by entering or selecting a Start Date (click the calendar icon to choose a calendar date) and a Start Time
(click the clock icon to choose a specific time in fifteen minute increments), and choose a Time Zone.
3. The Network Provisioning task can be synchronized to take place at the same time as the creation of the new
network under IPAM/DHCP; if so, keep the At same time as above option.
4. You can also provision the network onto the device at a differently scheduled time. To do so, select Later (under
Network Provisioning). Choose a Selected time by entering or selecting a Start Date (click the calendar icon to
choose a calendar date) and a Start Time (click the clock icon to choose a specific time in fifteen minute
increments), and choose a Time Zone.

Note: Network provisioning tasks (or any operation that queries for or changes device configurations through Grid
Manager, including Discovery) are subject to a feature called Blackout periods, which are defined elsewhere
in Grid Manager. Blackouts are a scheduled feature that instructs Grid Manager not to perform Discovery
operations and Port Control/provisioning operations on the managed network at specified times, days and
dates. See the section Defining Blackout Periods on page 731 for details.

Scheduling Additions and Modifications

You can schedule the addition and modification of an object. For example, you can schedule the addition of a DNS
forward zone or the modification of a fixed address. After you schedule a task, administrators cannot modify the
object associated with the scheduled task until after the appliance executes the task. However, the object can still
be updated with DHCP leases and other system services.
To schedule an addition or a modification:
1. Add or modify a record following the instructions described in this guide.
2. Click the Schedule icon at the top of the corresponding wizard or editor.
3. In the Schedule Change panel, complete the following:
— Now: Select this to have the appliance perform the task when you save the entry. This is selected by default
when there is no scheduled task associated with the object.
— Later: Select this to schedule the task for a later date and time. Complete the following:
— Date: Enter a date in YYYY-MM-DD (year-month-day) format. The appliance displays today’s date. You
can also click the calendar icon to select a date from the calendar widget.
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also select
a time from the drop-down list by clicking the time icon.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 89

Infoblox Grid Manager

— Time Zone: Select a time zone for the scheduled date and time from the drop-down list. This field
displays the time zone of the browser that the admin uses to log in to Grid Manager.
4. Save the configuration and click Restart if it appears at the top of the screen.

Scheduling Appliance Operations

The appliance supports the scheduling of the following operations:
• IP discoveries—For information, see IP Discovery and vDiscovery on page 617.
• Service restarts—For information, see Restarting Services on page 496.

Scheduling Deletions
You can schedule the deletion of an object or an operation for a later date and time. However, you cannot schedule
the deletion of a previously scheduled task.
To schedule a deletion:
1. Navigate to the object.
2. Select Schedule Deletion from the Delete drop-down menu.
3. In the Schedule Deletion dialog box, complete the following:
— Delete Now: Select this to delete the object upon clicking Delete Now.
— Delete Later: Select this to schedule the deletion at a later date and time. Complete the following:
— Date: Enter the date in YYYY-MM-DD (year-month-day) format. The appliance displays today’s date. You
can also click the calendar icon to select a date from the calendar widget.
— Time: Enter the time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also
select a time from the drop-down list by clicking the time icon.
— Time Zone: Select a time zone for the scheduled date and time from the drop-down list. This field
displays the time zone of the browser that the admin uses to log in to Grid Manager.
4. Click Schedule Deletion.
The appliance performs the deletion at the scheduled date and time.

Scheduling Recursive Deletions of Network Containers and Zones

Superusers can determine which group of users are allowed to schedule the deletion of a network container and its
child objects as well as a zone and its child objects. For information about how to configure the recursive deletion of
network containers and zones, see Configuring Recursive Deletions of Networks and Zones on page 327.
To schedule the recursive deletion of network containers and zones:
1. Navigate to the object.
2. Select Schedule Deletion from the Delete drop-down menu.
3. In the Schedule Deletion dialog box, complete the following:
— Delete Now: Select this to delete the object upon clicking Delete Now.
— Delete Later: Select this to schedule the deletion at a later date and time. Complete the following:
— Date: Enter the date in YYYY-MM-DD (year-month-day) format. The appliance displays today’s date. You
can also click the calendar icon to select a date from the calendar widget.
— Time: Enter the time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also
select a time from the drop-down list by clicking the time icon.
— Time Zone: Select a time zone for the scheduled date and time from the drop-down list. This field
displays the time zone of the browser that the admin uses to log in to Grid Manager.Select one of the
following:

90 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Scheduling New IPAM/DHCP Objects and Associated Port Configurations

• Delete only the parent container: Select this to delete only the parent objects and re-parent the
child objects.
• Delete the parent container and its children: Select this to delete the parent objects and all its
child objects.
4. Click Schedule Deletion.
The appliance performs the deletion at the scheduled date and time.

Viewing Scheduled Tasks

After you schedule a task, you can view the pending task in the Administration tab -> Workflow tab -> Task Manager
tab. For more information, see Viewing Tasks on page 82. Superusers can view all scheduled tasks, and
limited-access admins can view their own scheduled tasks.
In certain panels such as the Network list panel and Smart Folders, Grid Manager displays a calendar icon next to
objects that are associated with scheduled tasks, except for the addition of an object. You can click the icon to view
the configuration and schedule. You can also reschedule the task if you are the owner of the task, a superuser, or an
approver of the task (after you have approved it). In the corresponding editor, the Schedule icon is green when there
is a pending scheduled task. For information, see Icons for Scheduled Tasks on page 91.

Icons for Scheduled Tasks

Grid Manager displays a scheduled task icon next to an object that is associated with a scheduled task (except for
the addition of an object), as shown in Figure 1.11. When you mouse over the icon, an informational dialog box
appears displaying the type of action, the date and time of the scheduled task, and the person who scheduled the
task.
You can click the icon and Grid Manager displays the corresponding editor (for modification) or the Scheduled
Deletion dialog box (for deletion) in the read-only mode. If you are viewing a task that you scheduled, you can modify
and save the schedule, but you cannot modify the configuration of the object. If you are not the owner of a scheduled
modification or a superuser, you can only view the information. You cannot reschedule the task. If you are not the
owner of a scheduled deletion or a superuser, Grid Manager does not display the Scheduled Deletion dialog box
when you click the icon.

Figure 1.11 Icon for a Scheduled Task

Schedule Icon

In the editor, Grid Manager displays the Schedule icon in green to indicate a pending scheduled task associated with
the corresponding object, as shown in Figure 1.12. You can click the Schedule icon to view the date and time of the
scheduled task. You can also reschedule the task if you have the applicable permissions. For information, see
Rescheduling Tasks on page 92.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 91

Infoblox Grid Manager

Figure 1.12 Scheduling Icon Indicating a Pending Task

Green icon
indicates
pending
scheduled
tasks.

Pending Tasks for Operations

You can view all pending tasks for a network discovery or service restart in Task Manager if you have the applicable
permissions. For information, see Viewing Tasks on page 82. You can also view the pending tasks in their
corresponding dialogs.
To view the pending tasks in an editor:
1. Network Discovery: From the Data Management tab, select the IPAM tab, and then click Discovery from the
Toolbar.
Service Restarts for the Grid: From the Data Management tab, select the IPAM, DHCP or DNS tab, and then click
Restart Services from the Toolbar, or from the Grid tab, click Restart Services from the Toolbar.
Service Restarts for Grid members: From the Data Management tab, select the DHCP or DNS tab -> Members tab,
select a member check box, and then click Restart Services from the Toolbar.
2. Click the Schedule icon at the top of the wizard, and then select Click here to view/manage the scheduled items.
Note that this link appears only when you have one or more scheduled tasks.
3. Grid Manager displays the following information in the Scheduled Tasks:
— Scheduled Time: The date, time, and time zone when the appliance executes the task.
— Submitted Time: The date, time, and time zone when the task was submitted.
— Submitter: The admin who scheduled the task.
— Task Details: The message that appears in the audit log.
By default, the appliance sorts the tasks by Scheduled Time starting with the earliest scheduled start time.
You can do the following in this viewer:
• Sort the tasks in ascending or descending order by column, except for Task Details.
• Reschedule a selected task. For information, see Rescheduling Tasks Associated with Operations on page 94.
• Delete a selected task by selecting the task check box and clicking the Delete icon.
• Export and print the information in the table.

Rescheduling Tasks
Superusers can reschedule any scheduled task. Limited-access admins can reschedule only the tasks that they
scheduled, depending on their permissions. Approvers can reschedule tasks that they have approved, if they have
the scheduling permission. You can reschedule a task from different panels of Grid Manager, depending on your
permissions. When you reschedule a task from the object list panel, Grid Manager displays the object or operation
configuration in a read-only mode. You can modify the date and time to reschedule the task. However, you cannot
modify the configuration of the object or operation. You can also reschedule your own task or a task you have
approved from Task Manager.

92 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Scheduling New IPAM/DHCP Objects and Associated Port Configurations

To reschedule tasks associated with objects, see Rescheduling Tasks Associated With Objects.
To reschedule tasks associated with operations, see Rescheduling Tasks Associated with Operations.

Rescheduling Tasks Associated With Objects

You can reschedule a task associated with an object from the Scheduled Tasks viewer or in an editor if you have the
applicable permissions.
To reschedule a task from Task Manager:
1. From the Administration tab, select the Workflow tab -> Task Manager tab -> scheduled_task check box, and then
click the Reschedule icon.
2. In the Reschedule dialog box, modify the date and time when you want the appliance to execute the task. You
can select Now to execute the task when you save the entry.
3. Save the configuration and click Restart if it appears at the top of the screen.
To reschedule a task in an editor:
1. Navigate to the object with a scheduled task that you want to reschedule.
2. Click the scheduled task icon next to the object.
3. For modification: In the editor, click the Schedule icon at the top of the editor. In the Schedule Change panel,
modify the date, time, and time zone. You can also select Now to execute the task upon saving the entry.
For deletion: In the Schedule Deletion dialog box, modify the date, time, and time zone. You can also select
Delete Now to delete the object upon clicking Delete Now. The appliance puts the deleted object in the Recycle
Bin, if enabled.
4. Save the configuration and click Restart if it appears at the top of the screen.
Rescheduling object change tasks and associated port control tasks is a special case allowing for rescheduling of
both tasks in the same editor:

Figure 1.13 Rescheduling an object change task and a port control task

NIOS 7.3 NIOS Administrator Guide (Rev. A) 93

Infoblox Grid Manager

Rescheduling Tasks Associated with Operations

To reschedule a network discovery or a service restart:
1. From the Administration tab, select the Workflow tab -> Task Manager tab -> scheduled_task check box, and then
click the Reschedule icon.
or
Navigate to the operation and click the Schedule icon at the top of the wizard. In the Schedule Change panel,
select Click here to view/manage the scheduled items. Grid Manager displays all scheduled tasks related to the
operation in the Scheduled Tasks viewer. Select the task check box, and then click the Reschedule icon.
2. Grid Manager displays detailed information about the task in the Reschedule dialog box.
3. Modify the date and time when you want the appliance to execute the task. You can also select Now to execute
the task when you save the entry.
4. Save the configuration and click Restart if it appears at the top of the screen.

Canceling Scheduled Tasks

To cancel a scheduled task:
1. From the Administration tab, select the Workflow tab -> Task Manager tab -> scheduled_task check box, and then
click the Delete icon.
2. In the Confirm Delete Request dialog box, click Yes.
The appliance deletes the scheduled task and does not perform the scheduled operation. Therefore, no change
is made to any record after you delete a scheduled task.

Configuring Approval Workflows

Approval workflows support routing certain core network service tasks submitted by an admin group to another for
approval. You can add an admin group to an approval workflow and define the group as a submitter or approver
group. Note that only superusers can create approval workflows. For information about how to set up admin groups,
see About Admin Groups on page 188.
In an approval workflow, you can add a submitter group and an approver admin group that you have previously
defined. You can also define when and to whom email notifications are sent, and configure options such as whether
submitters or approvers must enter a comment or a ticket number when they submit tasks for approval. Approval
workflows are useful when you want to control tasks that require reviews. For example, if you have a group of help
desk users who can add, modify, and delete hosts and you want members of an operation group to review these
tasks, you can define the help desk users as submitters, and then set up members of the operation group as
approvers. You can then add the submitter and approver groups to an approval workflow and configure notifications
options and other configurations, such as allowing the approvers to reschedule the submitted tasks.
Not all core network service tasks can be routed for approval. You can configure approval tasks associated with
certain objects. For a list of supported objects, see Supported Objects for Scheduled and Approval Tasks.

Note: When an admin group is defined as a submitter group, there are certain operations the submitters cannot
perform even though they may have the permissions to do so. For information about such operations, see
Unsupported Operations for Submitters on page 99.

To create an approval workflow, complete the following:

1. If you have not already done so, set up admin groups that you can configure as submitter groups and approver
groups in an approval workflow, as described in About Admin Groups on page 188.
2. Create an approval workflow and configure email notifications and other options, as described in Creating
Approval Workflows on page 95.

94 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Approval Workflows

You can do the following after you have created approval workflows:
• View a list of approval workflows, as described in Viewing Approval Workflows on page 97.
• Modify approval workflows, as described in Modifying Approval Workflows on page 97.
• Delete approval workflows, as described in Deleting Approval Workflows on page 98.
• View a list of approval tasks, as described in Viewing Approval Tasks on page 98.
• View approval notifications, as described in Viewing Approval Tasks on page 98.

Supported Tasks for Different Admin Groups

Depending on your admin permissions, you may or may not be able to perform certain tasks that are subject to
approvals. Table 1.1 lists specific tasks and indicates which admin group can perform the tasks.

Table 1.1 Supported Tasks for Admin Groups

Admin groups that can perform the task

Tasks related to approval workflows Submitters Approvers Superusers

Change the schedule of a task when it is pending Yes No Yes
approval
Change the schedule of a task after it has been approved Yes (Task is Yes Yes
re-submitted for
approval)
Execute the task now when it is pending approval No No No
Execute the task after it has been approved No Yes Yes
Delete a task when it is pending approval Yes No Yes
Delete a task after it has been approved but pending No No Yes
execution
Delete a task after it failed or has been executed No No Yes
Delete tasks by selecting the Select all objects in this Yes Yes Yes
dataset option

Note: Not all tasks are deleted, depending on the task

status and the admin who performs the deletion.

Creating Approval Workflows

Before you create an approval workflow, ensure that you have admin groups that you can define as submitters and
approvers. Note that a submitter group can be added to only one approval workflow, and approver groups can be
added to multiple workflows. An approver can choose to approve a task and either keep or change the date and time
when the task is executed. For information about scheduling and rescheduling tasks, see Scheduling Tasks on page
85. An approver can also reject a submitted task.
All submitted tasks are executed based on submitter permissions. When an admin submits a task, the appliance logs
the task in the audit log and associates it with a task ID. You can view your tasks in Task Manager, as described in
Viewing Tasks on page 82. Depending on your configuration, you can control when and to whom email notifications
are sent. For example, you can configure the appliance to send notifications to only the approver each time when a
task requires approval, or send notifications to both the submitter and approver group each time when a task is
disapproved.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 95

Infoblox Grid Manager

To create an approval workflow:

1. From the Administration tab, select the Workflow tab -> Approval Workflows tab, and then click the Add icon.
2. In the Add Approval Workflow wizard, complete the following:
— Submitter Group: From the drop-down list, select the admin group whose submitted tasks require
approvals. Note that performing CSV imports do not require approvals. If there is a warning that the
submitter group has CSV import permission, you may want to remove the permission.
— Approver Group: From the drop-down list, select the group that can approve tasks submitted by admins of
the submitter group. If the approver group you select does not have the permission to schedule tasks, the
approvers cannot reschedule the execution dates and times of the tasks when they approve them.
— Ticket Number: From the drop-down list, select one of the following to determine whether a ticket number is
required when a submitter submits a task for approval.
— Required: The submitter must enter a ticket number when submitting a task.
— Optional: The submitter can choose to enter a ticket number or not when submitting a task.
— Not Used: The Ticket Number field does not appear when the submitter creates a task.
— Submitter Comment: From the drop-down list, select whether the submitter must enter a comment or not
when submitting a task for approval. You can select Required, Optional, or Not Used.
— Approver Comment: From the drop-down list, select whether the approver must enter a comment or not
when approving a task. You can select Required, Optional, or Not Used.
3. Click Next and complete the following to specify notification options for the workflow:
— Approver Notification Address(es): Select one of the following to specify to which approver email addresses
the appliance sends workflow notifications. The default is Group Email Address(es).
— Group Email Address(es): Select this if you want the appliance to send notifications to the list of email
addresses configured for the admin group. For information about how to configure this list, see About
Admin Groups on page 188.
— User Email Address(es): Select this if you want the appliance to send notifications to individual email
addresses of the admin group.
— Notifications sent on: Select the operations that can trigger email notifications. When you select an
operation, the appliance sends a notification each time that operation occurs. By default, all operations are
selected.
— Approval Required: The appliance sends an email notification each time an approval is required.
— Task Approved: The appliance sends an email notification each time a task is approved.
— Task Rejected: The appliance sends an email notification each time a task is rejected.
— Task Succeeded: The appliance sends an email notification each time a task is completed successfully.
— Task Failed: The appliance sends an email notification each time the execution of a task fails.
— Task Rescheduled: The appliance sends an email notification each time a task is being rescheduled.
— Notifications sent to: For each operation, select whether the Approver, Submitter, or Both are notified when
the operation occurs. The default value is Both for all operations. For information about email notifications,
see Viewing Approval Tasks on page 98.
4. Optionally, click Next to add extensible attributes to the approval workflow. For information, see About Extensible
Attributes on page 417.
5. Save the configuration.

96 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Approval Workflows

Viewing Approval Workflows

Grid Manager lists all approval workflows in the Approval Workflows tab. Only superusers can view approval
workflows defined for the Grid. Limited-access users cannot view approval workflows.
To view approval workflows:
1. From the Administration tab, select the Workflow tab -> Approval Workflows tab.
2. Grid Manager displays the following for each approval workflow:
— Submitter Group: The name of the admin group whose tasks require approvals.
— Approver Group: The name of the admin group that can approve tasks submitted by members of the
submitter group.
— Ticket Number: Displays whether the submitter is required to enter a ticket number when submitting tasks
that require approvals. Possible values are Not Used, Optional, and Required.
— Submitter Comment: Displays whether the submitter is required to enter a comment when submitting tasks
that require approvals. Possible values are Not Used, Optional, and Required.
— Approver Comment: Displays whether the approver is required to enter a comment when approving tasks.
Possible values are Not Used, Optional, and Required.
— Site: Values that were entered for this predefined extensible attribute.
You can do the following in this tab:
• Modify some of the data in the table. Double click a row, and either modify the data in the field or select an item
from a drop-down list. Click Save to save the changes. Note that some fields are read-only.
• Sort the data in ascending or descending order by column.
• Select an approval workflow and click the Edit icon to modify data, or click the Delete icon to delete it.
• Use filters and the Go To function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Print and export the data in this tab.

Modifying Approval Workflows

You can modify information in an approval workflow, except for the submitter group.
To modify approval workflow configuration:
1. From the Administration tab, select the Workflow tab -> Approval Workflows tab.
2. Select an approval workflow and click the Edit icon.
3. Grid Manager provides the following tabs from which you can modify information:
— General tab: You can modify the approver group and decide whether the ticket number, submitter
comment, and approver comment are required, but you cannot change the submitter group. For
information, see Creating Approval Workflows on page 95.
— Approval Notifications tab: You can modify when and to whom email notifications are sent. For information,
see Creating Approval Workflows on page 95.
— Extensible Attributes tab: You can add or modify values of extensible attributes. For information, see About
Extensible Attributes on page 417.
4. Save the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 97

Infoblox Grid Manager

Deleting Approval Workflows

You can delete an approval workflow any time after you have created it. Note that when you delete a workflow that
has associated tasks that are pending approvals, the tasks will be rejected after you delete the workflow.
To delete an approval workflow:
1. From the Administration tab, select the Workflow tab -> Approval Workflows tab.
2. Select an approval workflow and click the Delete icon.
3. Click Yes in the Delete Confirmation dialog.

Viewing Approval Tasks

If you belong to an approver admin group, you can view, approve, or reject tasks that are pending your approval in
the Task Manager tab. For information, see Viewing Tasks on page 82. Submitters can view all pending and
completed tasks they have submitted.

Viewing Workflow Notifications

When a submitter and approver receives an email notification about their tasks, the appliance lists the approval
status and workflow related information such as task ID, submitter name, execution time, object type and action in
the email notification.
Following is a sample email notification:
Notification:
=============
Message: Task 32 submitted by subm has been approved
The following task has been approved:
Task details

Task ID: 32
Submitter: subm
Approver: jdoe
Submit time: 2012-10-09 05:55:01 (UTC) Coordinated Universal Time
Execution time: N/A
Object type: NS Record
Action: Add
Affected object: corp1.com
Ticket number: MKTG245
Submitter comment: Create an NS record.
Approver comment: Approved.

Click here to go to the task management tab -

https://192.168.1.2/ui/?contextId=taskmanager

Note: When you can click the hyperlink displayed in the notification, you can log in to Grid Manager and access
the Task Manager tab in a separate browser tab or window.

98 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Approval Workflows

Unsupported Operations for Submitters

When admins are part of a submitter group in an approval workflow, there are certain operations they cannot perform
even though they may have the permissions to do so. Following is the list of operations that submitters cannot
perform:
• Reclaim IPv4 or IPv6 addresses
• Expand networks
• Resize networks
• Split networks
• Sign (DNSSEC) zones
• Unsign DNSSEC signed zones
• Import DS to DNSSEC signed zones
• Perform KSK rollovers on a DNSSEC signed zones
• Copy records from one DNS zone to another
• Clear all discovered data
• Clear discovered timestamps
• Clear unmanaged addresses
• Resolve discovery conflicts
• Update extensible attributes on multiple objects at a the same time
• Delete or modify several objects at a time (using the “Select all objects in this dataset” option from Grid
Manager)
• Order DHCP Ranges inside a network (feature is available only when used with Sophos)
• Configure member DHCP Captive Portal through the wizard
• Restore objects from the Recycle Bin
• Delete non-native NIOS DNS resource records. These objects can only be synchronized from a Microsoft DNS
server.
• Copy rules from one Response Policy Zone to another
• Order Response Policy Zones

NIOS 7.3 NIOS Administrator Guide (Rev. A) 99

Infoblox Grid Manager

About Long Running Tasks

A long running task is a task that requires more than 30 seconds to complete and involves a large amount of data.
When Grid Manager performs a long running task, it displays the Long Running Task dialog box that indicates whether
you can run the task in the background. You can navigate to another tab or perform other functions only if the task
can be run in the background. For information, see Running Tasks in the Background.
Grid Manager disconnects if a task takes more than five hours to perform. Though you can log back in to Grid Manager
while the appliance continues to perform the task, Grid Manager does not display the progress of the task.

Note: You cannot stop a long running task once you start it.

The appliance supports the following long running tasks:

• Restoring the database
• Backing up the database
• Backing up licenses
• Signing DNS zones
• Unsigning DNS zones
• Exporting DS records and trust anchors
• Deleting all objects in a table or dataset
• Modifying multiple extensible attributes
• Viewing DNS and DHCP configuration properties
• Migrating bloxTools data
• IPAM tasks on the Tasks Dashboard
• Downloading the following:
— Audit logs
— Syslog files
— Support bundles
— SNMP MIB files
— NTP keys
— HTTPS certificates
— Traffic capture

Running Tasks in the Background

Grid Manager allows certain long running tasks to run in the background. You can navigate to other tabs and perform
other functions when Grid Manager performs tasks in the background. However, when you make changes to objects
that are currently affected by a long running background task, Grid Manger does not save the changes until after the
long running task is completed. Grid Manager can perform up to 10 background tasks at a time.
You can run the following tasks in the background:
• Signing DNS zones
• Unsigning DNS zones
• Modifying multiple extensible attributes
• Deleting all objects in a table or dataset
• Migrating bloxTools data
To run a task in the background:
1. Perform the task following the instructions described in this guide.
2. In the Long Running Task dialog box, click Run in Background.

100 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About CSV Import

You can view the progress of the task by clicking the progress bar at the top of the interface. For information, see
Monitoring Long Running Tasks on page 101.

Monitoring Long Running Tasks

When you have one or more tasks running in the background, Grid Manager displays a progress bar next to the Global
Search icon at the top of the interface. You can click the progress bar to view detailed information about the tasks in
the Background / Long Running Task viewer. In this viewer, Grid Manager displays a progress bar for each task that is
currently running in the background. When all background tasks are completed, the progress bar at the top of the
interface disappears. Grid Manager displays a message at the top of the interface when the task is completed
successfully or if the task fails.
For other tasks that you cannot run in the background, the Long Running Task dialog box remains open until the task
is completed. You cannot navigate to other tabs or perform other functions when the long running task is in progress.
Grid Manager closes the dialog box when the task is completed. It also displays a message at the top of the interface
when the task is completed successfully or if the task fails.

About CSV Import

Use CSV Import to import DNS, DHCP, and IPAM data through Grid Manager. You can use this feature to migrate or add
new data, overwrite existing data, merge new data with existing data, delete existing data, or replace certain existing
data in the database.
To import new data, you must first prepare a data file (include all required fields and follow the proper syntax), and
then start an import through Grid Manager. You can also export existing data to a data file, modify the data, and then
import the modified data to the database. You can either overwrite existing data with the modified data or merge new
data with the existing data. You can also delete data that is no longer required or replace certain existing data with
new data in the file. Note that the replace option is valid for authoritative zone data only whereas other options are
valid for all supported objects including zones. The replace operation creates a snapshot or a backup of the existing
data in the database before replacing the database with the data in the imported CSV file.
The appliance supports CSV import for most record types. You can use IDNs and punycode for the domain name field
for most of the DNS object types. For information about IDNs and punycode, see Support for Internationalized Domain
Names on page 113. Only superusers can import A and AAAA records with a blank name. Limited-access users must
have read/write permission to Adding a blank A/AAAA record in order to import A and AAAA records with a blank
name, otherwise the CSV import operation might fail. You can assign global permission for specific admin groups and
roles to allow to import A and AAAA records with a blank name. For more information, see Administrative Permissions
for Adding Blank A or AAAA Records on page 245. For each supported record type, you must include all required fields
in the header row of the dataset that you want to import. For a list of supported record types and specific guidelines
for creating a data file, refer to the Infoblox CSV Import Reference.
To import a data file:
1. Create a data file if you do not already have one. Follow the guidelines for the supported objects to ensure that
you include all the required fields in the file. For more information, refer to the Infoblox CSV Import Reference.
You can also export existing data and then update the file for re-import. For information, see Exporting Data to
Files on page 108.
2. Configure import options. For information, see Configuring Import Options on page 104.
3. Start a CSV import. For information, see Exporting Displayed Data on page 111.
When you submit multiple CSV imports, the appliance puts the import jobs in queue and executes them one at a time
in the order they are submitted. When a job is being executed, it is in the Import in progress state. When a job is in
queue for execution, it is in the Import pending state. You can import multiple CSV files at a time, but at any given
time you can execute only one single task. Note that only one task at a time will be in the Import in progress state,
while the others are in the Import pending state. You can view the status of each import job through CSV Job Manager.
Superusers can view all import jobs while limited-access users can view only the jobs they submitted.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 101

Infoblox Grid Manager

To access CSV Job Manager, from the Data Management tab, click CSV Job Manager from the Toolbar and select Jobs
Manager, or from the Tasks Dashboard, click CSV Import in the IPAM Task Pack. Superusers and limited-access users
that have applicable configurations and permissions can perform CSV imports and exports. For information about
user permissions for CSV imports and exports, see CSV Import User Permissions.

You can do the following in CSV Import:

• Add, overwrite, append, replace or delete data through the imported CSV file, as described in Configuring
Import Options on page 104.
• Verify the content in the CSV file, as described in Configuring Import Options on page 104.
• View a list of CSV import jobs, as described in Creating a Data File for Import on page 108.
• Add and start CSV import jobs, upload data files, stop CSV imports, or edit the options of the uploaded file, as
described in Modifying CSV Import Jobs on page 107.
• Delete uploaded jobs, as described in Deleting Uploaded Jobs on page 107.
• Download the following: imported files, import errors, import results, or snapshots, as described in
Downloading Files on page 107.
• Select a pending or saved job, and then click the Cancel icon to cancel the job.
• Click the Refresh icon to refresh the CSV Job Manager.
Note that superusers can view any jobs in the CSV Job Manager, and limited-access users can only view jobs they
submitted.

Note: The list of CSV import jobs are not restored when you restore a backup file or when you promote a master
candidate.

CSV Import User Permissions

Superusers can perform any CSV import tasks. You must assign limited-access users the correct configurations and
permissions so they can perform CSV imports and exports. For information about how to configure the CSV Import
task for limited-access users, see About Dashboard Templates on page 136. Limited-access users can import data
to which they have proper permissions. For information about admin permissions, see About Administrative
Permissions on page 195.
Changes you make to user permissions can affect CSV import and export behaviors. The following table lists actions
performed on user permissions and the corresponding effects on CSV imports and exports:

Table 1.2

CSV import and export behaviors associated with the

Actions taken on user permissions affected user account
Delete a user account • CSV import jobs remain in the system and are
accessible by superusers only.
• All pending import jobs cannot be executed due
to authentication failures.
• If the action is taken during an import job that is
in progress, the rest of the import will fail.
• All stopped and successful jobs are available to
superusers only.
Modify a user account • If the action is taken during a Import in progress
import job, the rest of the import will fail.
Remove user permissions in a user account • Pending import jobs may be completed with
errors.

102 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About CSV Import

CSV Import Limitations

Ensure that you understand the following limitations before you start an import:
• You can import multiple CSV files at a time, but at any given time you can execute only one single task. The
import tasks are queued. Note that only one task at a time will be in the Import in progress state, while the
others are in the Import pending state.
• Do not use UTF-8 characters in the CSV file name.
• When you perform a CSV import that includes objects that have scheduled changes or updates associated with
them, the import fails. Only superusers can cancel the scheduled changes.
• When you stop an import, the appliance completes the import of the data row it is currently processing before it
stops the import. You cannot resume the import from where it stopped.
• You cannot roll back to previous data.
• The following data cannot be imported: Microsoft management, DNSSEC, and GSS-TSIG data.
• CSV import does not support DNSSEC zones, though resource records added for a signed zone are supported.
• Only editable data can be imported. Discovered data cannot be imported or manipulated.
• When you promote a new Grid Master during an import, the import stops; and it does not restart on the new
Grid Master. When a failover occurs during an import, the import stops on the old active node, and it does not
restart on the new active node.
• It may take longer than expected to import a large number of DHCP ranges that are associated with a single MAC
address filter.
• When a CSV import starts, the appliance validates the first 100,000 rows of data in the CSV file. If the file
contains more than 100,000 rows of data, the appliance validates the rest of the data as the import progresses.
• The appliance supports up to one million rows of data in each CSV import.
• You cannot import network containers.
• To successfully import RIR (Regional Internet Registries) organizations, you must also specify the maintainer
password. Note that the password field is not exported during a CSV export. For information about RIR updates,
see RIR Registration Updates on page 555.
• You can use the Replace operation to replace the current data in the database with the data in the imported CSV
file. Note that the replace option is valid for authoritative zone data only whereas the other options are valid for
all supported objects including zones. For more information, see Configuring Import Options on page 104.
• The Replace operation is available only for authoritative zones. This operation does not support DNS records
that are automatically generated or exported, but it supports NS records that are created manually.
• Use the delete function to delete import jobs that are uploaded. You can delete the content of a CSV file that you
have imported to the database. Note that you cannot delete jobs that are already imported.
• When you import CSV files for NS record updates, you must specify a value for zone_nameservers. NIOS
displays an error message if you do not specify a value for this field when you import the CSV file.
• When you perform a CSV export of automatically created NS records using Infoblox API, the zone_nameservers
field will have an empty value. Therefore, if you import the previously exported CSV file that includes
automatically created NS records through the Infoblox GUI, then the CSV import fails and Grid Manager displays
an error message.
• If you upload a file and preview the file using the Preview option, and later update the content of the same CSV
file, and then try to view the edited file using the same Preview wizard, you may not be able to see the changes.
Infoblox recommends that you start a fresh CSV import to upload the edited file and navigate to the Preview
wizard to preview the file.
• You cannot perform the CSV import operation on a Microsoft Server zone object, but NIOS allows you to perform
the CSV import operation on records within a Microsoft Server zone. You may not see an error message when
you perform a CSV import using the replace operation on an Microsoft Server zone.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 103

Infoblox Grid Manager

Configuring Import Options

You can import CSV files and perform various operations to update the data in the database. You can choose from
several import options: add, override, merge, delete, and replace. You can add new rows from the imported file to the
database, overwrite existing rows in the database, append rows to the existing rows in the database, delete existing
rows in the database, or replace the existing rows in the database. You can verify whether the data in the imported
file is appropriate using the Test option before you import the file to the database. You can also view the results and
progress details of the operation.
To import a CSV file, complete the following:
1. From the Data Management tab, click CSV Job Manager from the Toolbar.
2. In the CSV Job Manager wizard, select CSV Import and click the New CSV import job icon.
3. In the New CSV Import Wizard, complete the following:
Type of Import
For all supported objects (including zones)
— Add: Select this to add new rows from the imported CSV file to the database. NIOS updates the database
with the new data that you have added to the imported CSV file and retains the rows that do not have any
changes.
— Override: Select this to overwrite the existing data in the database with the data from the uploaded file. You
cannot add new rows or delete existing rows. If you want to overwrite values in the required fields, you must
include the required fields and the corresponding _NEW_XXXX fields in the data file.
— Merge: Select this to add values from the imported CSV file to the existing columns in the database that do
not have any data. It does not overwrite the existing data, even if the data file contains new values for
certain fields. If you want to overwrite values in the required fields, you must include the required fields and
the corresponding _NEW_XXXX fields in the data file.
— Delete: Select this to delete the rows in the imported CSV file from the database.
— Custom: Select this to apply custom import actions for individual data rows in your CSV file. When
preparing the CSV file for import with the Custom option, add an IMPORT-ACTION column to the file and
specify a custom import action for each data row. Use the following abbreviations for import actions: 'I'
(INSERT), 'M' (MERGE), 'O' (OVERRIDE), 'IM' (INSERT+MERGE), 'IO' (INSERT+OVERRIDE), 'D' (DELETE).
For zones only
— Replace: Select this to replace the contents of the database with data provided in the CSV file. NIOS cancels
the replace operation and will not save the changes if it encounters an error. You can replace the DNS
records of a zone by importing a zone file that was exported previously. You can only replace DNS records
that are manually created. NIOS generates a results file listing the file name, action performed, date and
time, and result at the end of the validation. You can view the results file only after the replace operation is
complete. NIOS generates the backup file automatically for every replace operation and saves it in the
Infoblox Grid. Note that the CSV file must contain data for one authoritative zone only, that is, you cannot
insert records from different authoritative zones into a single CSV file for replace operation.

Note: The replace operation might affect system performance if you try to replace a zone with a lot of changes.
Infoblox recommends that you perform the replace operation for large import files (more than 10,000 rows
of changes) during non-peak hours. This operation ignores _new_XXX fields in the imported CSV files.

4. Click Next to import the CSV file.

— Import Type: Displays the type of import option you have selected.
— Select the CSV file that you want to import and click Choose.
On Error: Select one of the following to tell the appliance what to do when it encounters an error during an
import:

104 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About CSV Import

— Stop import: Select this to stop the data import once it encounters an error in the uploaded file. Grid
Manager displays the row number at which it stops the import when it encounters an error. NIOS saves the
changes made to the CSV file before an error occurs. For example, if there are 100 rows of data and you
select this option, and there is an error in row 90, the appliance displays 90 of 100 completed, 1 error.
— Skip to the next row and continue: Select this to skip over errors and continue the data import. You can
download an error report to identify the erroneous data. NIOS displays the total number of rows it has
processed by skipping over. For example, if there are 100 rows of data and you select this option, the
appliance displays 100 of 100 completed, 1 error.
5. Click Next to preview your CSV file. In the File Preview table, Grid Manager displays the header row, the first six
rows, and up to 15 columns of the imported data. You cannot edit the data here. Field names with asterisks (*)
indicate required fields. Note that you must define these fields in the imported file. If any of the required fields
are missing, the appliance generates an error during the import operation. You can do the following in this
wizard:
— Import type: The type of import option you have selected.
— File name: The name of the CSV file you have selected.
— Separator: Select a separator for your CSV file from the drop-down list. The default value is Comma.
— On Error: The option you have selected.
6. Click Test to verify the content in your CSV file. Click Yes in the Test CSV Import for Replace Operation dialog box
to verify the content or click No to cancel the operation. NIOS automatically analyzes the data in the imported file
for any syntax errors or other violations. You can also view a detailed report of the file that you are importing. Note
that you can run the test as a background task. This report also displays information about the number of
deleted, updated and added files. It also displays error messages, if any. NIOS generates a results file listing the
file name, action performed, date and time, result, and the number of failures at the end of the validation. You
can view the results file only after the replace operation is complete.

Note: The Test button is enabled only when you select the Replace operation and is disabled for other import
options.

7. Click Import to import the CSV file to the database. Click Yes in the dialog box to import the CSV file or No to cancel
the operation.
8. You can view the progress and results of your import operation in the CSV Import Progress wizard. This wizard
displays the following information:
— Import type: The type of import option you have selected.
— File name: The name of the CSV file you have selected.
— Separator: The separator you have selected for your CSV file. The default value is Comma.
— On Error: The option you have selected when the import operation encounters an error.
— Current status: If an import is in progress, this field displays its current status. Otherwise, it displays the
date and time of the last import.
— Last action: Displays the last operation and the admin who initiated it.
— Rows Completed: The number of rows of data the import has processed. Depending on the import options,
Grid Manager displays either the row number at which it stops an import when it encounters an error or the
total number of rows it has processed by skipping over the erroneous data. For example, if there are 100
rows of data and you select “On error: Stop importing,” and there is an error in row 90, Grid Manager
displays 90 of 100 here. If you select “On error: Skip to the next row and continue,” Grid Manager displays
100 of 100 here and displays 1 in Rows with Errors.
— Rows with Errors: The number of rows of data the import has detected errors. Click Download Errors to
download the CSV file that contains the fields and the rows of erroneous data. You can use this report as a
reference to update the data file before you import the file again.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 105

Infoblox Grid Manager

To cancel the import operation, click Stop Import before the operation is complete. To close the wizard and
execute the operation in the background, click Close & Run in Background. When the operation is complete, you
can click Download errors to download and view the errors. The Download errors button is enabled only if the
operation encounters errors. Click Save & Close to save the operation and close the wizard.

Note: Superusers can view all CSV import jobs and limited-access users can view only the jobs they submitted.

Viewing CSV Import Jobs

You can view the status of import jobs. To view the status:
1. From the Data Management tab, click CSV Job Manager from the Toolbar.
2. In the CSV Job Manager wizard, click CSV Import. Grid Manager displays the following information about the
import jobs that were submitted in the past 30 days:
— User Name: The admin user who submitted the CSV import. Only superusers can view this column.
— Status: The current status of the import job. The status can be one of the following:
— Import successful: The import is completed without errors. Check the Message field for information
about the import.
— Import unsuccessful: The import is completed, but with errors. Check the Message field for information
about the error message.
— Import pending: The job is in queue for execution.
— Import in progress: The job is being executed.
— Import stopped: The job has been stopped. You can select the job and restart the import.
— Test successful: Test is completed without errors. Check the Message field for information about the
test.
— Test unsuccessful: Test is completed, but with errors. Check the Message field for information about the
error message.
— Test pending: Test is in queue for execution.
— Test in progress: Test is in progress.
— Test stopped: Test has been stopped. You can select the job and restart the import.
— Saved file: The data file has been uploaded, but the import has not started.

Note: After a product restart, which can be caused by a failover, all Import in progress jobs go into Import
stopped state; all Import pending jobs continue to be queued for execution.

— Submitted: The timestamp when the job was submitted.

— Completed: The timestamp when the job was completed. This field is blank if the job has not been
completed yet.
— File Name: The CSV data file name.
— Message: This field displays the number of rows of data that have been processed and the number of rows
of data the import has detected errors. Depending on the import options, Grid Manager displays the row
number at which it stops the import when it encounters an error, or the total number of rows it has
processed by skipping over the erroneous data. For example, if there are 100 rows of data and you select
“On error: Stop importing,” and there is an error in row 90, the appliance displays 90 of 100 completed, 1
error. If you select “On error: Skip to the next row and continue,” the appliance displays 100 of 100
completed, 1 error.
— File Size: The size of the imported CSV file.

Note: Superusers can view all CSV import jobs and limited-access users can view only the jobs they submitted.

106 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About CSV Import

Modifying CSV Import Jobs

You can modify the options of the CSV file that you have already uploaded, delete the jobs that are uploaded, or
download uploaded file or error file. After you configure the import options, you can select a data file and start an
import operation or upload a data file. For more information about configuring import options, see Configuring Import
Options on page 104.
To edit the options of a file, complete the following:
1. From the Data Management tab, click CSV Job Manager from the Toolbar.
2. In the CSV Job Manager wizard, select CSV Import and select the import job that you want to update, click the
Action icon and select Edit.
3. In Edit - CSV Import Job, select a type of import and perform the operations mentioned in Configuring Import
Options on page 104.
4. Click Download to download the uploaded file, snapshot file, or the results file. For more information, see
Downloading Files on page 107.
5. Click Save & Close to save the changes.

Deleting Uploaded Jobs

You can delete import jobs that are uploaded. You cannot delete jobs that are already imported. You can delete the
content of a CSV file that you have imported to the database. Note that the CSV import files and the backed up files
are saved for a period of 30 days, but the size limit is set to 1 GB. If these files increase in size, NIOS removes the
older files from the Grid. NIOS generates a syslog message if it encounters an error when generating the backup file.

Note: When you delete a parent object from the CSV file, the child objects associated with the parent objects are also
deleted.

To delete uploaded jobs, complete the following:

1. From the Data Management tab, click CSV Job Manager from the Toolbar.
2. In the CSV Job Manager wizard, select CSV Import and select the import job that you want to delete, click the
Action icon and select Delete or click the Delete pending job icon.
3. Click Yes to delete the uploaded job or No to cancel the operation in the Cancel Import Job wizard.

Downloading Files
You can download various types of files based on the import operation that you have selected. You can download the
following files: uploaded, error, results, and snapshot. Superusers can download the original imported file.

Downloading Uploaded or Error Files

You can download CSV files that are already uploaded or download error files to check the errors that the import
operation encountered. The download options are valid for all import operations, except replace. To download the
file, complete the following:
1. From the Data Management tab, click CSV Job Manager from the Toolbar.
2. In the CSV Job Manager wizard, select CSV Import and select the import job that you want to download, click the
Action icon and select Download.
— Uploaded File: Select this to download the uploaded CSV import file.
— Error File: Select this to download the error file. This option is enabled only if the import operation
encountered an error.
You can export these files to your local system.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 107

Infoblox Grid Manager

Downloading Uploaded, Snapshot, or Results Files

You can view the uploaded, result, and snapshot files. The snapshot and results files are enabled only for replace
operation.
To download the file, complete the following:
1. From the Data Management tab, click CSV Job Manager from the Toolbar.
2. In the CSV Job Manager wizard, select CSV Import and select the import job that you want to download, click the
Action icon and select Edit.
3. In Edit - CSV Import Job, click the arrow beside the Download option and select one of the following:
— Uploaded File: Select this to download the uploaded CSV import file. The uploaded report displays the
content of the imported file, before it was uploaded, that is before the content of the database is changed.
— Snapshot File: Select this to download the backup file. NIOS automatically creates a backup of the
database before replacing the content of the database with the content in the imported CSV file. This option
is enabled only for the replace operation. NIOS generates an error message and saves it in the syslog and
the infoblox.log file when the backup file is not generated. You can download the backup file after the
replace operation is complete. NIOS saves the backup file and other results file in the Grid for a period of 30
days. The name of the backup file has the following format:
csv-snapshot-10-[view]-[zone]-[timestamp].csv where 10 is the import ID of the CSV import task,
view is the DNS view name, zone is the FQDN of the zone being replaced and timestamp is the timestamp
at when the file is generated.
— Results File: Select this to download the results file. The file displays the content of the database after the
content of the file replaced the content of the database. You can view the results file only after the replace
operation is complete.
You can export these files to your local system.

Creating a Data File for Import

If you are migrating new data into the database, you must prepare the data file using the correct format and syntax
before you can import it successfully. You must include all the required fields and understand the dependencies
among some of the fields. For detailed information about the guidelines, supported record types, and
interdependencies among fields, refer to the Infoblox CSV Import Reference.

Exporting Data to Files

You can export existing data to a CSV file. The appliance marks all required fields with an asterisk (*) in the exported
file. It also adds a _new_XXXX field to each required field so you can use this field to update data. You cannot stop
an export once you start it.

Note: Limited-access users can export up to 2,000 rows (2,000 objects) of data. For performance reasons, NIOS has
limited the objects to 2,000. If data exceeds 2,000 rows, the CSV file contains the first 2,000 rows of data and
a message at the end that indicates the report is not complete. Only superusers can export data that exceeds
2,000 rows. For example, consider that you are exporting Infoblox::DNS::Host objects. The NIOS appliance
displays an output file with 4,000 lines, because the Host record consists of two lines, one for the HostRecord
and another for the HostAddress; however, the total count of objects will still remain 2,000.

To export all data to a CSV file:

1. From Grid Manager, navigate to the panel that contains the data you want to export. For example, if you want to
export data for all DNS zones, select the Data Management tab -> DNS tab -> Zones tab.
2. In the panel, select Export data in Infoblox CSV Import format from the Export drop-down menu.
3. In the Export dialog box, complete the following:
— Separator: Select the separator used in the data file. The default is Comma.
— Click Export.

108 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About CSV Import

The appliance exports all the fields of the records that are displayed in this panel based on your filter criteria. You can
either open the data file or save it to your computer. The appliance uses a default file name depending on the panel
from which you perform the export. For example, when you export the data from the IPAM tab, the default file name
is Allnetworks.csv. When you export data from the DNS tab, the default file name is Allzones.csv. The file contains a
header row that includes all the fields of the corresponding record type. You can update this data file, and then
re-import the data in to the database.
You can also export the displayed fields in a panel. For information, see Exporting Displayed Data on page 111.

Exporting New CSV Jobs

You can use the Global CSV Export Wizard to export multiple objects at once. You can export multiple object data
types to a single CSV file through Grid Manager. Objects that have the least or no dependencies on other objects are
placed at the top of the list and the most dependent objects are displayed at the bottom of the list. The export
command will not re-execute after a Grid Manager HA failover.
For standalone appliances, the Grid Manager sends a single CSV export request that contains both Grid and member
CSV headers to export Grid and member properties. Similarly, Grid Manager combines GridDns and MemberDns
headers to export DNS properties and GridDhcp and MemberDhcp headers to export DHCP properties.
You cannot export the default DNS view if you have not created a custom DNS view. To export the default DNS view,
you must either create custom DNS views or use the CSV Global Export option.
Note that when you use the Global CSV Export option to export either all objects, all DNS objects, or all PTR records,
the appliance also exports the PTR system generated records from the auto-created zone “0.0.127.in-addr.arpa”.
When you use the same file for import operation, the CSV import operation might fail due to the presence of these
system generated records. Infoblox recommends that you select the Skip to next row and continue option while
performing the CSV import operation. When you select this option, CSV import skips these rows with appropriate
error messages and then processes other rows in the CSV file.
To export DNS and DHCP data:
1. From the Data Management tab, click CSV Job Manager from the Toolbar.
2. In the CSV Job Manager wizard, click CSV Export. Click the New CSV Export job icon and specify the following in
the Global CSV Export Wizard:
— Separator: Select a separator from the drop-down list: Comma, Semicolon, Space, and Tab.
— All Objects: The check box is selected by default. When you select this check box, all DHCP, global, and DNS
objects are selected by default.
— All DHCP Objects: Select this check box to select all DHCP objects that are listed. To select specific
DHCP objects, clear this check box and select respective check boxes next to the DHCP object names.
— Global Objects: Select this check box to select all global objects that are listed. To select specific global
objects, clear this check box and select respective check boxes next to the global object names.
— All DNS Objects: Select this check box to select all DNS objects that are listed. To select specific DNS
objects, clear this check box and select respective check boxes next to the DNS object names.
3. Click Export Data to start the export process. In the Start global CSV Export dialog box, click Yes to confirm or click
No to cancel the process.
4. Grid Manager displays the CSV export progress and results in the CSV Global Export progress dialog box. It
displays the following information:
— Separator: The separator used in the CSV file.
— Approximate number of objects to be exported: Indicates the total number of objects to be exported.
— Number of objects exported: Indicates the total number of objects that are exported.
— Current status: Indicates the current status of the export process.
5. Click Close to exit.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 109

Infoblox Grid Manager

Managing CSV Export Jobs

You can view the list of CSV export operations using the CSV Job Manager.
1. From the Data Management tab, click CSV Job Manager from the Toolbar. In the CSV Job Manager wizard, click
CSV Export.
2. Grid Manager displays the following information:
— User Name: The admin user who submitted the CSV export. Only superusers can view this column.
— Status: The current status of the export job. The CSV export process runs in an asynchronous mode similar
to the CSV import. The status can be one of the following:
— Export pending: The job is in queue for execution.
— Export running: The job is being executed.
— Export stopped: The job has been stopped. You can select the job and restart the export.
— Export completed: The export is completed without errors. Check the Message field for information
about the export.
— Export failed: The export is completed, but with errors. Check the Message field for information about
the error message.
— Submitted: The timestamp when the job was submitted.
— Completed: The timestamp when the job was completed. This field is blank if the job has not been
completed yet.
— Failed Description: The appliance displays the error message in the Failed Description column if the CSV
export fails. You cannot start a failed CSV export task.
— File Size: The size of the generated CSV file.
Completed CSV export jobs are deleted 30 days from the date of submission. You can also perform the following
operations:
• Select a completed CSV export task and download the exported file.
• Cancel or stop a pending CSV export task using the Delete option.
• Purge all export tasks after an upgrade or restore.
• Start a new global CSV export job.

Modifying CSV Export Jobs

You can cancel an export job that is in progress or download an exported job. You can also schedule new export jobs.
The appliance deletes the CSV jobs that are completed after 30 days from the date of submission.
To update an exported job or delete one:
1. From the Data Management tab, click CSV Job Manager from the Toolbar.
2. In the CSV Job Manager wizard, click CSV Export.
3. Select the export job that you want to update, click the Action icon . Click Cancel to cancel the export job that
is in progress. You can also click the Cancel job icon to delete the file. Click Download file to download the
exported file. For more information, see Downloading Files on page 107.
4. Click the New CSV Export job icon to export a new job. For more information, see Exporting New CSV Jobs on page
109.
5. Click Close to exit.

110 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Exporting Displayed Data

Exporting Displayed Data

You can export visible information, such as global search results and the syslog file, in CSV format from panels and
pages that support the Export function, and then easily convert the file to PDF and other file formats. You can also
export all data in a specific panel. For information, see Exporting Data to Files on page 108.
To export displayed data:
1. From Grid Manager, navigate to the panel that contains the data you want to export. For example, if you want to
export data for DNS zones, select the Data Management tab -> DNS tab -> Zones tab.
2. In the panel, select Export visible data from the Export drop-down menu.
3. In the Export dialog box, click Start. Grid Manager displays a message about the time required to export data
could be long depending on the amount of data.
4. Click Download when the export is finished.
5. Depending on your browser and operating system, you may need to do one of the following in the Opening .csv
dialog box:
— Open with: Select a program with which you want to open the .csv file.
— Save to Disk: Select this if you want to save the .csv file to your local computer.
— Do this automatically for files like this from now on: Select this check box if you want Grid Manager to use
the same method for future exports. When you select this check box, Grid Manager does not display the
Opening .csv dialog box in the future.
6. Click OK.
Depending on the selected option, Grid Manager opens the file using the program you select, or saves the file to
your local computer.

Printing from Grid Manager

In Grid Manager, you can print information from panels and pages that support the Print function. Grid Manager prints
data one page at a time. The amount of data that is displayed in a specific panel depends on the table size
configuration that you set in your user profile. For information, see Specifying the Table Size on page 60.
To print:
1. Click the Print icon. You must allow pop-up windows in your browser for printing. Grid Manager displays a
separate browser window.
2. Click Print.
Grid Manager displays the Print dialog box.
3. Configure printer settings and parameters.
4. Depending on your browser, click OK or Print.

Multilingual Support
The NIOS appliance supports UTF-8 (Unicode Transformation Format-8) encoding for the following:
• Hostnames for Microsoft Windows clients that support Microsoft Windows code pages. For information, see
Configuring UTF-8 Encoding for Hostnames on page 1092.
• Input fields through Grid Manager. For information, see UTF-8 Supported Fields on page 112.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 111

Infoblox Grid Manager

UTF-8 is a variable-length character encoding standard for Unicode characters. Unicode is a code table that lists the
numerous scripts used by all possible characters in all possible languages. It also has a large number of technical
symbols and special characters used in publishing. UTF-8 encodes each Unicode character as a variable number of
one to four octets (8-bit bytes), where the number of octets depends on the integer value assigned to the Unicode
character. For information about UTF-8 encoding, refer to RFC 3629 (UTF-8, a transformation format of ISO 10646) and
the ISO/IEC 10646-1:2000 Annex D. For information about Unicode, refer to The Unicode Standard.
Depending on the OS (operating system) your management system uses, you must install the appropriate language
files in order to enter information in a specific language. For information about how to install language files, refer to
the documentation that comes with your management system.

UTF-8 Supported Fields

The NIOS appliance supports UTF-8 encoding in all of the comment fields and most input fields. You can enter
non-English characters in these data fields through Grid Manager and the Infoblox API. When you use the Infoblox
API, all the non-ASCII strings must be UTF-8 encoded so that you can use Unicode characters. The NIOS appliance
does not support UTF-8 encoding for data that is configurable through the Infoblox CLI commands.
In general, the following items support UTF-8 encoding:
• All the predefined and user-defined extensible attributes.
• All the comment fields in Grid Manager.
• File name fields for FTP and TFTP backup and restore operations.
• The login banner text field. When you use the serial console or SSH, the appliance cannot correctly display the
UTF-8 encoded information that you enter for the login banner.

Note: For data fields that do not support UTF-8 encoding, the appliance displays an error message when you use
non-English characters.

UTF-8 Support Limitations

The NIOS appliance has the following UTF-8 support limitations:
• Object names that have data restrictions due to their usage outside of the Infoblox database do not support
UTF-8 encoding. For example, IP addresses and Active Directory domain names.
• When importing a database, most of the ASCII control characters cannot be encoded. This might cause failures
in upgrades or database restore operations.
• Search is based on the Unicode standard. Depending on the language, you might not be able to perform a
case-sensitive search.
• Binary data is encoded as text.
• UTF-8 encoding does not fully support regular expressions. It matches constant strings. However, It does not
encode characters that are inside square brackets or followed by regular expressions such as *, ?, or +.
• You can use UTF-8 characters to authenticate both the User Name and Password through the Infoblox GUI, but
not through the Infoblox CLI.
• You cannot use UTF-8 characters to name a custom DHCP fingerprint. For information about DHCP fingerprint
detection, see Infoblox DHCP Fingerprint Detection on page 1358.

112 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Support for Internationalized Domain Names

Support for Internationalized Domain Names

The Infoblox Grid supports IDNs (Internationalized Domain Names) for DNS zones and resource records to provide
the flexibility of specifying domain names in non-English characters.
An IDN is a domain name that contains a language-specific script or alphabet, such as Arabic, Chinese, Russian,
Devanagari, or the Latin alphabet-based characters with diacritics, such as French. IDNs are encoded in multi-byte
Unicode and are decoded into ASCII strings using a standardized mechanism known as Punycode transcription. For
example, DNS Zone ‘инфоблокс.рф’ (IDN in Russian) can be written as ‘xn--90anhdigczv.xn--p1ai’ in the punycode
representation. In addition, the appliance has a built-in conversion tool to assist you in identifying and
troubleshooting an IDN or the punycode representation of an IDN. For information about how to decode IDNs, see
Decoding IDNs and Encoding Punycode on page 113.
The appliance supports IDNs in certain fields. For more information, see IDN Supported Fields on page 113. There
are certain guidelines and limitations about IDN support. For more information, see IDN Support Limitations on page
114.

Decoding IDNs and Encoding Punycode

You can encode non-English characters into punycode and decode punycode to obtain a domain name in its original
character set. You can encode IDNs and decode punycode simultaneously. You can use special characters.
To encode non-English character set into punycode and decode punycode:
1. Select any tab in Grid Manager, and then click IDN Converter from the Toolbar.
2. In the IDN Converter wizard, complete the following:
— Specify the domain name in the Unicode text box and click Convert to Punycode. The Punycode field
displays the punycode representation of the domain name.
— Specify the punycode representation of a domain name in the Punycode field and click Convert to Unicode.
The Unicode field displays the domain name in its original character set.

Note: You can use special characters in the Unicode and Punycode fields.

— Click Clear to clear the entries. Note that when you click Clear for a specific conversion, the appliance clears
only the error message that corresponds to that conversion.
3. Click Close.

IDN Supported Fields

The NIOS appliance supports IDNs in all domain name fields. For information, see IDN Support For DNS Zones on
page 838. You can enter non-English characters in the domain name fields through Grid Manager and the Infoblox
API. The NIOS appliance does not support IDNs for data that is configurable through the Infoblox CLI commands. You
can use the punycode representation to configure data through the CLI commands.
The appliance supports IDNs in the following:
• You can use UTF-8 characters when defining your own hostname checking policy. For information, see
Specifying Hostname Policies on page 795.
• You can use both IDNs and punycode to search for IDN data through Global Search. For information, see Global
Search on page 68.
• Use smart folders to organize and monitor IDN data. However, if the content in a smart folder contains IDNs,
then the punycode representation is not available. For information, see About Smart Folders on page 174.
• You can import data that contains IDNs in CSV format for the supported fields and objects using CSV import. For
more information, see About CSV Import on page 101. For a list of supported record types and specific
guidelines for creating a data file, refer to the Infoblox CSV Import Reference.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 113

Infoblox Grid Manager

• The IPAM tab displays IDNs for DNS resource records associated with IP addresses, such as A records, AAAA
records, hosts, and PTR records. For information, see About IP Address Management on page 577.
• The DNS Zones Last Queried report and DNS Resource Records Last Queried report support IDNs. For
information, see Predefined Report Categories on page 1429.
• The audit log entries are displayed in their original characters. The audit log contains IDN data as received by
the appliance and as specified by the administrators. Note that the punycode representation generated by NIOS
is not displayed in the audit log.
• When you upgrade from a previous NIOS release, the appliance converts all punycode to IDNs. If the conversion
fails, the appliance retains the punycode representation to avoid upgrade failure. For information about
upgrades, see Guidelines for Upgrading, Backing Up, and Restoring Data on page 85.
• When you restore a backup file from a previous NIOS release, the appliance converts all punycode to IDNs. If the
conversion fails, the appliance retains the punycode representation to avoid failure to restore the database. For
information, see Guidelines for Upgrading, Backing Up, and Restoring Data on page 85.
• If synchronized data between the appliance and Microsoft servers contains IDNs, the IDNs are preserved. For
information, see Managing Microsoft DNS Servers on page 1284.

IDN Support Limitations

The appliance has the following IDN support limitations:
• F5® load balancers does not support IDNs. The NIOS appliance does not encode punycode to IDNs for F5 load
balancer related objects. Only the punycode representation is available.
• Multi-Grid configuration does not support IDNs.
• The Infoblox CLI does not support IDNs.
• If a resource record containing an IDN is added to the Infoblox Grid through DDNS updates, the domain name
field displays the record name in UTF-8 encoded format. For more information, see Managing Resource Records
on page 880.
• The following FQDNs does not support IDNs:
— FQDN of an external DNS Server (direct or via name server group)
— FQDN of a DNS root server
— FQDN of a Microsoft server
— FQDN of an Infoblox Grid Member
— FQDN of an external authentication source (Active Directory, LDAP, OCSP, RADIUS, TACACS+)
— FQDN of an NTP server
— FQDN of a HSM SafeNet Module
— FQDN of an email relay server
— FQDN of a vSphere/ESX server
— FQDN of a Kerberos Key Distribution Center

Using IDNs for Unsupported Objects

The appliance accepts only punycode entries for objects that do not support IDNs. To use IDNs for these objects,
manually convert IDNs to punycode and use the punycode representation.
Use the punycode representation of IDNs for the following:
• When you configure domain names in forwarder servers, NXDOMAIN rulesets, blacklist rules, and DNS resolver
search lists.
• When you configure domain names for DHCP and DHCPv6 services, including DDNS domain name, any DHCP
options that accept domain names (host-name (12) string) or lists of domain names (domain-search (119)
domain-list), and DHCPv6 options that accept domain names (dhcp6.fqdn (39) string) or lists of domain names
(dhcp6.domain-search (24)) domain-list.

114 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Support for Internationalized Domain Names

• When you add domains in the Inclusion list and Exclusion list. For information, see Excluding Domains From
Query and Response Capture on page 1403.
• When you configure rules for a local RPZ and RPZ feed. For information, see Configuring Local RPZs on page
1677 and Infoblox RPZ feeds on page 1693.

Displaying IDN Entries in Punycode

The appliance displays IDN entries in punycode for the following:
• The data of a zone for which an Infoblox Grid member is the secondary server.
• The CLI commands dig, ddns_add, ddns_delete, show dns, and set dns support punycode only. For
information about CLI commands, refer to the Infoblox CLI Guide.
• All syslog entries generated by DNS.
• IDN data in database files is stored in punycode.
• The DNS cache of a Grid member that contains IDNs.
• The Reporting tab displays all report data that contains IDNs in punycode. For information, see Predefined
Report Categories on page 1429.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 115

Infoblox Grid Manager

116 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 2 Dashboards
Dashboards provide easy access to tasks and a quick overview to the status of your Grid and DNS, DHCP and IPAM
services. This chapter contains the following sections:
• About Dashboards on page 119
• The Tasks Dashboard on page 119
— About Task Packs on page 119
— The IPAM Task Pack on page 120
— The Network Automation Task Pack on page 130
• About Dashboard Templates on page 136
— Adding Dashboard Templates on page 136
— Modifying Dashboard Templates on page 137
— Deleting Dashboard Templates on page 138
— Assigning Dashboard Templates on page 138
• Status Dashboards on page 138
— Adding Widgets to Dashboards on page 139
— Grid Status on page 145
— Grid Upgrade Status on page 147
— Member Status (System Status) on page 147
— DNS Statistics on page 149
— Ranges Over Threshold on page 149
— IPv4 Failover Associations Status on page 150
— DHCP Statistics on page 150
— Network Statistics on page 151
— Network Users - Active Users on page 152
— IPv4 Networks Over Threshold on page 152
— Port Status on page 153
— Discovery Status on page 153
— My Commands on page 154
— DDNS Statistics on page 154
— System Activity Monitor on page 155
— File Distribution Statistics on page 156
— Active WebUI Users on page 156
— Microsoft Servers Status Widget on page 156
— CSV Import Manager on page 157

NIOS 7.3 NIOS Administrator Guide (Rev. A) 117

Dashboards

— Load Balancer Status on page 158

— Pending Approvals on page 159
— Infoblox Community on page 159
— Mobile Devices Status on page 160
— DNS Integrity Check on page 161
— Cloud Statistics on page 162
— Security Status for Grid on page 162
— Security Status for All Members on page 164
— Threat Protection Status for Grid on page 165
— Threat Protection Status for Member on page 166
— Response Policy Zone (RPZ) Status for Grid on page 167
— Response Policy Zone (RPZ) Status for Member on page 169
— Pool Licenses Statistics on page 172
— DNS Record Scavenging on page 172

118 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Dashboards

About Dashboards
The Dashboard is your home page on Grid Manager. It provides easy access to tasks and a quick view to the status of
your Grid and core network services. Grid Manager provides the following dashboards:
• Tasks: The Tasks dashboard contains task packs that provide easy access to commonly performed tasks. A task
pack is a collection of tasks that belong to a specific service or function, such as IPAM or Automation. For
information, see The Tasks Dashboard on page 119.
• Status: A status dashboard contains widgets from which you can view and manage DNS, DHCP, and IPAM status
and data. You can configure multiple status dashboards for managing a large number of Grid members. For
information, see Status Dashboards on page 138.
When you first log in to Grid Manager, the tasks dashboard is your home page. You can change your home page for
subsequent logins.
To change your home page:
1. Navigate to any tab in Grid Manager (except for the Dashboards tab).
2. Click User Profile from the Toolbar and complete the following In the User Profile dialog box:
— Default Dashboard: Select Status or Task from the drop-down list.
3. Save the configuration.
Grid Manager displays the selected dashboard as your home page when you log in the next time.

The Tasks Dashboard

The Tasks Dashboard provides easy access to commonly performed tasks, such as adding networks and adding host
records. Tasks are grouped by service-specific task packs. You must install valid licenses on the appliance to see and
perform specific tasks on the Tasks Dashboard. For information about the required licenses for IPAM tasks, see
Table 2.1 on page 120.
You must also have at least read-only permission to a task-related object to add or hide the task in its task pack. To
execute a task, you must have the appropriate permissions to the member and objects that are related to the tasks.
For example, to add a host record from the Tasks Dashboard, you must have at least read-only permission to the host
records task and read/write permission to the zone and network in which the host records are created. For
information about permissions, see Administrative Permissions for Dashboard Tasks on page 263.

About Task Packs

Grid Manager displays task packs, including the IPAM and Network Automation task packs, based on valid licenses
installed on the appliance. To access the IPAM task pack, you must have valid DNS or DHCP license installed on the
NIOS appliance. To access the Automation task pack, you must first set up an Infoblox Network Automation
appliance, install the Automation Change Management license on the NIOS appliance, and register as a user. For
information about how to activate the Automation task pack, refer to the Infoblox Network Automation Administrator
Guide.

Note: The Tasks Dashboard will not appear in the NIOS system if no task packs are licensed for the system. Some
task packs will also have dependencies. For example, the Network Automation Task Pack licensing activates
along with either the MS license or the NIOS DHCP/DNS combination license. Should either of those licenses
be disabled for any reason, the Network Automation Tasks will also be disabled.

To use the Automation Task Pack, you must enable the Network Automation Tasks feature set and establish a working
connection between the NIOS appliance and an Infoblox Network Automation appliance. See Enabling the Network
Automation Tasks on page 129 for details.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 119

Dashboards

Each task in a task pack opens a workflow dialog in which you can create task-related objects without navigating
through other tabs and editors in Grid Manager. Depending on the task you perform, Grid Manager displays task
results in the Result page from which you can access newly created objects, such as networks and host records. Note
that when a task takes longer than usual to complete, it becomes a long running task. For information about long
running tasks, see About Tasks on page 81.
With valid licenses and proper registrations, Grid Manager displays the following task packs in the Tasks Dashboard:
• The IPAM Task Pack on page 120
• The Network Automation Task Pack on page 130

The IPAM Task Pack

The IPAM task pack contains the following tasks:
• Add Networks
• Add Hosts
• Add Fixed Addresses
• Add A Record
• Add CNAME Record
• Add TXT Record
• Add MX Record
• CSV Import
Depending on your administrative permissions and the Dashboard template configuration, Grid Manager displays
tasks you can access in specific task packs. You can configure your task packs by adding or hiding certain tasks. For
information about Dashboard templates, see About Dashboard Templates on page 136.
To hide tasks in a task pack:
1. Click the Configure icon at the upper right corner of the task pack.
2. In the configuration panel, select the tasks you want to hide from the Active Tasks table. You can use SHIFT+click
and CTRL+click to select multiple tasks.
3. Click the left arrow to move the selected tasks to the Available Tasks table.
Click the Configuration icon again to hide the configuration panel after you complete the modification.

Required Licenses for IPAM Tasks

Table 2.1 lists the required licenses for viewing and performing IPAM tasks on the Tasks Dashboard.

Table 2.1 Required Licenses for IPAM Tasks

Task Required Licenses

Add Networks DHCP or MSMGMT license
Add Hosts DNS or DHCP license
Add Fixed Addresses DHCP or MSMGMT license
Add A Record DNS or MSMGMT license
Add CNAME Record DNS or MSMGMT license
Add TXT Record DNS or MSMGMT license
Add MX Record DNS or MSMGMT license

For information about how to install licenses, see Managing Licenses on page 478.

120 NIOS Administrator Guide (Rev. A) NIOS 7.3

 The Tasks Dashboard

Add Networks
You can create IPv4 and IPv6 networks from the Tasks Dashboard (either from scratch or from a network template that
contains predefined properties). You can also create networks from the Data Management tab. For more information
about IPv4 and IPv6 networks, see Configuring IPv4 Networks on page 1111 and Configuring IPv6 Networks on page
1160.
To add networks from the Tasks Dashboard:
1. Click Add Networks in the IPAM task pack and complete the following in the Add Networks wizard:
— Regional Internet Registry: This section appears only when support for RIR updates is enabled. For
information about RIR, see RIR Registration Updates on page 555. Complete the following to create an RIR
IPv4 network container or network:
— Internet Registry: Select the RIR from the drop-down list. The default is RIPE. When you select None, the
network is not associated with an RIR organization.
— Organization ID: Click Select Organization and select an organization from the RIR Organization
Selector dialog box.
— Registration Status: The default is Not Registered. When adding an RIR allocated network, you can
change this to Registered and select the Do not update registrations check box below. Note that when
you select API as the communication method, the registration status will be updated automatically
after the registration update is completed. However, when you select Email as the communication
method, the registration status will not be automatically updated. If you are creating a new network
and the registration update is completed successfully, the status will be changed to Registered. If the
update fails, the status will be changed to Not Registered. The updated status and timestamp are
displayed in the Status of last update field in the IPv4 /IPv6 Network Container or IPv4/IPV6 Network
editor.
— Registration Action: Select the registration action from the drop-down list. When you select Create, the
appliance creates the IPv4 or IPv6 network and assigns it to the selected organization. When you select
None, the appliance does not send registration updates to RIPE. When you are adding an existing RIR
allocated network to NIOS, select None. When you are adding networks to an RIR allocated network (a
parent network), select Create. Ensure that the parent network associated with an RIR organization
already exists.
— Do not update registrations: Select this check box if you do not want the appliance to submit RIR
updates to RIPE. By default, the appliance sends updates to the RIR database based on the configured
communication method.
— Network View: This appears only when you have multiple network views. From the drop-down list, select the
network view in which you want to create the network.
— Protocol: Select IPv4 to add IPv4 networks and IPv6 to add IPv6 networks.
— Netmask: Enter the netmask or use the netmask slider to select the appropriate number of subnet mask
bits for the network.
— Template: Click Select Template to select a network template. When you use a template to create a network,
the configuration of the template applies to the new network. If the template specifies a fixed netmask, you
cannot edit the netmask in this dialog. You can click Clear to remove the template. For information about
templates, see About IPv4 Network Templates on page 1146 and About IPv6 Network Templates on page
1154.
— Use Active Directory Sites: This check box is displayed only if you install the Microsoft license. Click the Add
icon to associate multiple Active Directory Sites with the network. When you click Add, the appliance
displays the following:
— Active Directory Domain: The Active Directory Domains that are synchronized from the Microsoft server.
Click an Active Directory Domain that you want to associate.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 121

Dashboards

To search for a particular Active Directory Domain, specify the respective name and click Go. If there are
multiple Active Directory Domains, the appliance displays the list of such domains by paging to the next
page. You can use the page navigation buttons that are displayed at the bottom of this column to
navigate through the Active Directory Domains. You can also refresh the values in the column using the
Refresh icon.
— Active Directory Site: The Active Directory Sites that are associated with the selected Active Directory
Domain. Click an Active Directory Site that you want to associate with the network.
To search for a particular Active Directory Site, specify the respective name and click Go. If there are
multiple Active Directory Sites, the appliance displays the list of such sites by paging to the next page.
You can use the page navigation buttons that are displayed at the bottom of this column to navigate
through the Active Directory Sites. You can also refresh the values in the column using the Refresh icon.
— Click Add to add the selected Active Directory Sites to the network or click Cancel to cancel the
operation. The appliance displays these domains and sites in the respective columns. Click the x icon if
you want to close the Active Directory Domains and Sites selector.
— Click the Delete icon to delete Active Directory Sites that are associated with the network.
For more information about Active Directory Domains and Sites, see About Active Directory Sites and
Services on page 1267.
NIOS may execute discovery on the newly created network after you save your settings. When you create a
network in NIOS, it inherits its discovery capabilities (whether or not it is immediately discovered, its polling
settings, and any possible exclusions from discovery), from its parent network (if it has one) or its network
container. If the new network is a parent network, it inherits its polling settings from the Grid and its discovery
member selection and Enable Discovery action must be defined by the user.
— Networks: Do one of the following to add new networks:
Click the Add icon to create a new network.
— For IPv4 networks: Grid Manager adds a row to the table. Enter the network address in the Network
field. Click the Add icon to add another network. You can also select a network and click the Delete icon
to delete it.
— For IPv6 networks: If you are adding a network for a previously defined global IPv6 prefix, you can select
the prefix from the IPv6 Prefix drop-down list. The default is None, which means that you are not
creating an IPv6 network for a previously defined subnet route. If you have defined a global prefix at the
Grid level, the default is the global prefix value. Click Add and Grid Manager adds a row to the table.
Enter the network address in the Network field. When you enter an IPv6 address, you can use double
colons to compress a contiguous sequence of zeros. You can also omit any leading zeros in a
four-hexadecimal group. For example, the complete IPv6 address
2001:0db8:0000:0000:0000:0000:0102:0304 can be shortened to 2001:db8::0102:0304. Note that
if there are multiple noncontiguous groups of zeros, the double colon can only be used for one group to
avoid ambiguity. The appliance displays an IPv6 address in its shortened form, regardless of its form
when it was entered. Click Add again to add another network. You can also select a network and click
the Delete icon to delete it.
or
Click the Next Available icon to have the appliance search for the next available network. For more
information about the next available network, see About the Next Available Network or IP Address on page
1109. Complete the following in the Next Available Networks section:
— Create new network(s) under: Enter the network container in which you want to create the new network.
When you enter a network that does not exist, the appliance adds it as a network container. When you
enter a network that is part of a parent network, the parent network is converted into a network
container if it does not have a member assignment or does not contain address ranges, fixed
addresses, reservations, shared networks, and host records that are served by DHCP. When you enter a
network that has a lower CIDR than an existing network, the appliance creates the network as a parent
network and displays a message indicating that the newly created network overlaps an existing
network. You can also click Select Network to select a specific network in the Network Selector dialog
box. For information about how the appliance searches for the next available network, see Obtaining
the Next Available on page 1110.

122 NIOS Administrator Guide (Rev. A) NIOS 7.3

 The Tasks Dashboard

— Number of new networks: Enter the number of networks you want to add to the selected network
container. Note that if there is not enough network space in the selected network to create the number
of networks specified here, Grid Manager displays an error message. The maximum number is 20 at a
time. Note that when you have existing networks in the table and you select one, the number you enter
here includes the selected network.
— Click Add Next to add the networks. Grid Manager lists the networks in the table. You can click Cancel to
reset the values.

Note: You must click Add Next to add the network container you enter in the Next Available Networks section. If
you enter a network in the Next Available Networks section and then use the Add icon to add another
network, the appliance does not save the network you enter in the Next Available Networks section until
you click Add Next.

— Extensible Attributes: Click the Add icon to enter extensible attributes. Grid Manager adds a row to the table
each time you click the Add icon. Select the row and the attribute name from the drop-down list, and then
enter the value. All inheritance attributes which can be inherited from a parent object will be automatically
inherited when you add a network. Inheritable extensible attributes that are required are automatically
displayed. Optional extensible attributes that are not inheritable are not automatically displayed. For more
information about extensible attributes, see Using Extensible Attributes on page 427.
— If you are adding an RIR network, the RIR network attribute table appears. For information about these
attributes and how to enter them, see RIR Network Attributes on page 565.
Preview RIR Submissions: Click this to view the updates before the appliance submits them to the RIPE
database. This button is enabled only when the registration action is Create, Modify, or Delete, and the Do
not update registrations check box is not selected.
2. Save the configuration.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, click Later
and enter a date, time, and time zone. For information, see About Extensible Attributes on page 417.
The appliance saves the networks you just created, and Grid Manager displays them in the Result page. When
you click a newly created network on this page, Grid Manager displays the IP Map panel from which you can
view detailed information about the network. For information about the IP Map panel, see IP Map on page 594.
You can also add and modify other information about the networks you just created. For information about modifying
network information, see Managing IPv4 DHCP Data on page 1107 and Managing IPv6 DHCP Data on page 1159.

Add Hosts
Host records provide a unique approach to the management of DNS, DHCP, and IPAM data. By using host records, you
can manage multiple DNS records and DHCP and IPAM data collectively, as one object on the appliance. You can add
IPv4 and IPv6 addresses to host records from the Tasks Dashboard or the Data Management tab. Note that when you
add a host record from the Tasks Dashboard, they are configured only for DNS. For more information about Infoblox
host records, see About Host Records on page 578.
To add host records from the Tasks Dashboard:
1. Click Add Hosts in the IPAM Task Pack and complete the following in the Add Hosts wizard:
— Network View: This appears only when you have multiple network views. From the drop-down list, select the
network view in which you want to create the host record.
— Zone Name: Click Select to select a DNS zone from the Zone Selector dialog box.
— Exclude from Network Discovery and Immediate Discovery. When creating the new Host record, you can
direct NIOS to immediately discover the host, or to exclude it from network discovery. By default, the Add
Hosts task enables immediate discovery.
— DNS View: Displays the DNS view of the selected zone.
— Hosts: Do one of the following to add a host record:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 123

Dashboards

Click the Add icon and the appliance adds a row to the table. Complete the following in the table to add a
new host record:
— Name: Enter the name of the host record.
— Zone: Displays the DNS zone you select in Zone Name. When you enter a different zone here, the
appliance displays an error message.
— Address: Enter the IP address you want to associate with this host record.
or
Click the Next Available icon to have the appliance search for the next available IP address for the host
record. For information about the next available IP address, see About the Next Available Network or IP
Address on page 1109. Complete the following in the Next Available IP section:
— Create new host addresses under: Click Select to select the network or address range in the
Network/Range Selector dialog box from which you want the appliance to search for the next available
IP address for this host record.
— Number of new host addresses: Enter the number of host addresses. Note that if there is not enough
space in the selected network or address range to create the number of host addresses specified here,
Grid Manager displays an error message. The maximum number is 20 at a time. Note that when you
have existing host addresses in the table and you select one, the number you enter here includes the
selected host address.
— Click Add Next to add the IP addresses to their corresponding hosts. Grid Manager lists the host
addresses in the table. Ensure that you enter a name for each host record.
— Extensible Attributes table: Click the Add icon to enter extensible attributes. The appliance adds a row to
the table each time you click the Add icon. Select the row and the attribute name from the drop-down list,
and then enter the value. All inheritance attributes which can be inherited from a parent object will be
automatically inherited when you add a host. Inheritable extensible attributes that are required are
automatically displayed. Optional extensible attributes that are not inheritable are not automatically
displayed. For more information about extensible attributes, see About Extensible Attributes on page 417.
2. Save the configuration.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, click Later
and enter a date, time, and time zone. For information about how to schedule a task, see Scheduling Tasks on
page 85.
The appliance saves the host records you just created, and Grid Manager displays them in the Result page.
When you click a newly created host on this page, Grid Manager displays the Data Management -> DNS -> Zones
tab from which you can view information about the host record.
You can also add and modify other information about the host records. For information about modifying host
information, see About Host Records on page 578.

Add Fixed Addresses

You can add IPv4 and IPv6 fixed addresses from the Tasks Dashboard or from the Data Management tab. For more
information about fixed addresses, see Configuring IPv4 Fixed Addresses on page 1125 and Configuring IPv6 Fixed
Addresses on page 1171.
To add fixed addresses from the Tasks Dashboard:
1. Click Add Fixed Addresses in the IPAM task pack and complete the following in the Add Fixed Addresses wizard:
— Network View: This appears only when you have multiple network views. From the drop-down list, select the
network view in which you want to create the fixed address.
— Protocol: Select IPv4 to add IPv4 addresses and IPv6 to add IPv6 addresses.
— Template: Click Select Template to select a fixed address template. When you use a template to create a
fixed address, the configuration of the template applies to the new fixed address. You can also click Clear to
remove the template. For information about templates, see About DHCP Templates on page 1142.

124 NIOS Administrator Guide (Rev. A) NIOS 7.3

 The Tasks Dashboard

— Exclude from Network Discovery and Immediate Discovery. When creating the new fixed address, you can
direct NIOS to immediately discover the device associated with the fixed address, or to exclude it from
network discovery. By default, the Add Fixed Addresses task enables immediate discovery.
— Addresses: Do one of the following to add fixed addresses:
Click the Add icon and Grid Manager adds a row to the table. Complete the following to create fixed
addresses:
— For IPv4 fixed addresses: Enter the IPv4 address and MAC address. Click the Add icon to add another
fixed address.
— For IPv6 fixed addresses: Enter the IPv6 address and DUID. Click the Add icon again to add another
fixed address.
or
Click the Next Available icon to have the appliance search for the next available address. Complete the
following:
— Create new fixed addresses under: Click Select to select the network or address range in the
Network/Range Selector dialog box from which you want the appliance to search for the next available
IP address for this fixed address.
— Number of new fixed addresses: Enter the number of fixed addresses you want to add to the selected
network or address range. Note that if there is not enough space in the selected network or address
range to create the number of fixed addresses specified here, Grid Manager displays an error message.
The maximum number is 20 at a time. Note that when you have existing fixed addresses in the table
and you select one, the number you enter here includes the selected fixed address.
— Click Add Next to add the fixed addresses. The appliance lists the fixed addresses to the table. Ensure
that you enter the MAC address or DUID for each fixed address.
— Extensible Attributes table: Click the Add icon to enter extensible attributes. The appliance adds a row to
the table each time you click the Add icon. Select the row and the attribute name from the drop-down list,
and then enter the value. All inheritance attributes which can be inherited from a parent object will be
automatically inherited when you add a fixed address. Inheritable extensible attributes that are required
are automatically displayed. Optional extensible attributes that are not inheritable are not automatically
displayed. For more information about extensible attributes, see About Extensible Attributes on page 417.
2. Save the configuration.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, click Later
and enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.
The appliance saves the fixed addresses you just created, and Grid Manager displays them in the Result page.
When you click a newly created fixed address on this page, Grid Manager displays the Data Management -> IPAM
-> IP Map or List tab from which you can view information about the fixed address.
You can also add and modify other information about the fixed addresses you just created. For more information
about modifying fixed address information, see Managing IPv4 DHCP Data on page 1107 and Managing IPv6 DHCP
Data on page 1159.

Add A Record
An A (address) record is a DNS resource record that maps a domain name to an IPv4 address. You can add an A record
from the Tasks Dashboard or from the Data Management tab. For more information about managing A records, see
Managing A Records on page 880.
To add networks from the Tasks Dashboard:
1. Click Add A Record in the IPAM task pack and complete the following in the Add A Record wizard:
2. In the Add A Record wizard, do the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 125

Dashboards

— Name: If Grid Manager displays a zone name, enter the hostname that you want to map to an IP address.
The displayed zone name can either be the last selected zone or the zone from which you are adding the
host record. If no zone name is displayed or if you want to specify a different zone, click Select Zone. When
there are multiple zones, Grid Manager displays the Zone Selector dialog box. Click a zone name in the
dialog box and then enter the hostname. The name you enter is prefixed to the DNS zone name that is
displayed, and the complete name becomes the FQDN (fully qualified domain name) of the host. For
example, if the zone name displayed is corp100.com and you enter admin, then the FQDN becomes
admin.corp100.com. Ensure that the domain name you enter complies with the hostname restriction policy
defined for the zone. To create a wildcard A record, enter an asterisk (*) in this field.
— DNS View: This field displays the DNS view to which the DNS zone belongs.
— Shared Record Group: This field appears only when you are creating a shared record from the Data
Management tab. Click Select Shared Record Group. If you have only one shared record group, the
appliance displays the name of the shared record group here. If you have multiple shared record groups,
select the shared record group in the Shared Record Group Selector dialog box. You can use filters or the Go
to function to narrow down the list.
— Hostname Policy: Displays the hostname policy of the zone.
— In the IP Addresses section, click the Add icon and do one of the following:
— Select Add Address to enter the IPv4 address to which you want the domain name to map.
or
— Select Next Available IPv4 to retrieve the next available IP address in a network.
If the A record is in zone that has associated networks, the Network Selector dialog box lists the
associated networks. If the zone has no network associations, the Network Selector dialog box lists the
available networks. When you select a network, Grid Manager retrieves the next available IP address in
that network.
— Comment: Optionally, enter additional information about the A record.
— Create associated PTR record: Select this option to automatically generate a PTR record that maps the
specified IP address to the hostname. To create the PTR record, the reverse-mapping zone must be in the
database.
— Disable: Select this check box to disable the record. Clear the check box to enable it.
3. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
4. Save the configuration or click the Schedule icon at the top of the wizard to schedule this task. For information
about how to schedule a task, see Scheduling Tasks on page 85.
5. Click Restart if it appears at the top of the screen.

Add CNAME Record

A CNAME record maps an alias to a canonical name. You can use CNAME records in both IPv4 forward- and IPv4
reverse-mapping zones to serve two different purposes. (At this time, you cannot use CNAME records with IPv6
reverse-mapping zones.) For more information about CNAME records, see Managing CNAME Records on page 889.
To add a CNAME record from the Tasks Dashboard:
1. Click Add CNAME Record in the IPAM task pack and complete the following in the Add CNAME Record wizard:
— Network View: This appears only when you have multiple network views. From the drop-down list, select the
network view in which you want to create the CNAME record.
— Alias: Click Select Zone to select a DNS zone from the Zone Selector dialog box. If you have only one zone,
Grid Manager displays the zone name here when you click Select Zone. Enter the alias for the canonical
name. For an IPv4 reverse-mapping zone, enter the host portion of an IP address. For example, if the full IP
address is 10.1.1.1 in a network with a 25-bit netmask, enter 1. (The 10.1.1.0/25 network contains host
addresses from 10.1.1.1 to 10.1.1.126. The network address is 10.1.1.0, and the broadcast address is
10.1.1.127.)
— DNS View: Displays the DNS view of the selected zone.

126 NIOS Administrator Guide (Rev. A) NIOS 7.3

 The Tasks Dashboard

— Shared Record Group: This field appears only when you are creating a shared record from the Data
Management tab. Click Select Shared Record Group. If you have only one shared record group, the
appliance displays the name of the shared record group here. If you have multiple shared record groups,
select the shared record group in the Shared Record Group Selector dialog box. You can use filters or the
Go to function to narrow down the list.
— Canonical Name: This field displays the domain name of either the current zone or the last selected zone.
To add a CNAME record to a forward-mapping zone, enter the complete canonical (or official) name of the
host. To add a CNAME record to a reverse-mapping zone, enter host_ip_addr.prefix.network.in-addr.arpa
(host IP address + 2317 prefix + network IP address + in-addr.arpa). For example, enter
1.0.25.1.1.10.in-addr.arpa. This IP address must match the address defined in the PTR record in the
delegated child zone.
— Comments: Enter useful information about this record.
— Disable: Select the check box to disable the record without deleting its configuration. Clear the check box to
enable the record.
2. Save the configuration, or click Next to define extensible attributes. For information about extensible attributes,
see Using Extensible Attributes on page 427.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, click Later
and enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.
3. Click Restart if it appears at the top of the screen.
You can also add and modify other information about the CNAME record you just created. For more information about
modifying the CNAME record, see Modifying, Disabling, and Deleting Host and Resource Records on page 899.

Add TXT Record

A TXT (text record) record contains supplemental information for a host. For example, if you have a sales server that
serves only North America, you can create a text record stating this fact. You can create more than one text record for
a domain name. You can add a TXT record from the Tasks Dashboard or the Data Management tab. For more
information about TXT records, see Managing TXT Records on page 888.
To add TXT records from the Tasks Dashboard:
1. Click Add TXT Record in the IPAM task pack and complete the following in the Add TXT Record wizard:
— Network View: This appears only when you have multiple network views. From the drop-down list, select the
network view in which you want to create the TXT record.
— Name: If Grid Manager displays a zone name, enter the name to define a TXT record for a host or
subdomain. If no zone name is displayed or if you want to specify a different zone, click Select Zone. When
there are multiple zones, Grid Manager displays the Zone Selector dialog box. Click a zone name in the
dialog box. Then, enter the TXT record name. The appliance prefixes the name you enter to the domain
name of the selected zone. For example, if you want to create a TXT record for a web server whose host
name is www2.corp100.com and you define the TXT record in the corp100.com zone, enter www2 in this
field. To define a TXT record for a domain whose name matches the selected zone, leave this field empty.
The appliance automatically adds the domain name (the same as the zone name) to the TXT record. For
example, if you want to create a TXT record for the corp100.com domain and you selected the corp100.com
zone, leave this field empty.
— DNS View: Displays the DNS view of the selected zone.
— Shared Record Group: This field appears only when you are creating a shared record from the Data
Management tab. Click Select Shared Record Group. If you have only one shared record group, the
appliance displays the name of the shared record group here. If you have multiple shared record groups,
select the shared record group in the Shared Record Group Selector dialog box. You can use filters or the Go
to function to narrow down the list.
— Text: Enter the text that you want to associate with the record. It can contain substrings of up to 255 bytes,
up to a total of 512 bytes. Additionally, if you enter leading, trailing, or embedded spaces in the text, add
quotes around the text to preserve the spaces. For example: “ v=spf1 include:corp200.com -all ”

NIOS 7.3 NIOS Administrator Guide (Rev. A) 127

Dashboards

— Comments: Enter useful information about this record.

— Disable: Select the check box to disable the record without deleting its configuration. Clear the check box to
enable the record.
2. Save the configuration, or click Next to define extensible attributes. For information, see About Extensible
Attributes on page 417.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, click Later
and enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.
3. Click Restart if it appears at the top of the screen.

Add MX Record
An MX (mail exchanger) record maps a domain name to a mail exchanger. A mail exchanger is a server that either
delivers or forwards mail. You can specify one or more mail exchangers for a zone, as well as the preference for using
each mail exchanger. A standard MX record applies to a particular domain or subdomain. You can add an MX record
from the Tasks Dashboard or the Data Management tab. For more information about MX records, see Managing MX
Records on page 885.
To add MX records from the Tasks Dashboard:
1. Click Add MX Record in the IPAM task pack and complete the following in the Add TXT Record wizard:
— Network View: This appears only when you have multiple network views. From the drop-down list, select the
network view in which you want to create the MX record.
— Mail Destination: If Grid Manager displays a zone name, enter the mail destination here. If no zone name is
displayed or if you want to specify a different zone, click Select Zone. When there are multiple zones, Grid
Manager displays the Zone Selector dialog box. Click a zone name in the dialog box, and then enter the mail
destination. If you want to define an MX record for a domain whose name matches the zone you selected,
leave this field blank. Grid Manager automatically adds the domain name (the same as the zone name) to
the MX record. For example, if you want to create an MX record for a mail exchanger serving the
corp100.com domain and you selected the corp100.com zone, and leave this field empty.
If you want to define an MX record for a subdomain, enter the subdomain name. The appliance prefixes the
name you enter to the domain name of the selected zone. For example, if you want to create an MX record
for a mail exchanger serving site1.corp100.com—a subdomain of corp100.com—and you define the MX
record in the corp100.com zone, enter site1 in this field.
If you want to define an MX record for a domain and all its subdomains, enter an asterisk ( * ) to create a
wildcard MX record.
— DNS View: Displays the DNS view of the selected zone.
— Shared Record Group: This field appears only when you are creating a shared record from the Data
Management tab. Click Select Shared Record Group. If you have only one shared record group, the
appliance displays the name of the shared record group here. If you have multiple shared record groups,
select the shared record group in the Shared Record Group Selector dialog box. You can use filters or the Go
to function to narrow down the list.
— Host Name Policy: Displays the hostname policy of the selected zone. Ensure that the hostname you enter
complies with the hostname restriction policy defined for the zone.
— Mail Exchanger: Enter the fully qualified domain name of the mail exchanger.
— Preference: Select an integer from 10 to 100, or enter a value from 0 to 65535. The preference determines
the order in which a client attempts to contact the target mail exchanger.
— Comment: Enter useful information about this record.
— Disable: Select the check box to disable the record without deleting its configuration. Clear the check box to
enable the record.
2. Save the configuration, or click Next to define extensible attributes. For information, see About Extensible
Attributes on page 417.
or

128 NIOS Administrator Guide (Rev. A) NIOS 7.3

 The Tasks Dashboard

Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, click Later
and enter a date, time, and time zone. For information about scheduling tasks, see Scheduling Tasks on page
85.
3. Click Restart if it appears at the top of the screen.

CSV Import
You can access CSV Import Manager and perform CSV imports, manage import jobs, and view import status. You can
perform CSV imports from the Task Dashboard and the Toolbar. You can also click CSV Import Manager, which allows
for importing of data, managing import jobs, and viewing import status.
You can click New CSV import job icon in the CSV Job Manager wizard to import a CSV file to the database. You can
also verify the content in your CSV file before replacing the content of the database with the content in the imported
CSV file. For detailed information about the CSV import feature, see About CSV Import on page 101.

Enabling the Network Automation Tasks

The Network Automation Tasks pack requires the configuration, licensing and connection of an Infoblox Network
Automation appliance to support automation tasks.
Should two superusers be logged in to the NIOS system and one superuser enables the Network Automation Tasks
pack on their console, the other superuser will not see the task pack on their console until their next login; the Disable
Network Automation Tasks from the Configure icon menu shows the correct state.
You install the Network Automation appliance into the managed network, ensuring the appliance is reachable by the
NIOS Grid Master. After this is accomplished, you register the Network Automation appliance with NIOS.
1. Click the Configure icon at the top right corner of the Tasks page.
2. Choose Enable Network Automation Tasks.
The Enable Network Automation Tasks dialog box appears, requesting verification of your action:
Though you can see the change immediately, other users who are 
currently logged in will not see the change until they log in again.
Are you sure you want to proceed?
3. Click Yes to enable the Network Automation Tasks set.
After a moment, the Automation Tasks panel appears.

Disabling Network Automation Tasks

Should you need to disable the Network Automation Tasks pack, do the following:
1. Click the Configure icon at the top right corner of the Tasks page.
2. Choose Disable Network Automation Tasks.
The Disable Network Automation Tasks dialog box appears, requesting verification of your action:
Though you can see the change immediately, other users who are 
currently logged in will not see the change until they log in again.
Are you sure you want to proceed?
3. Click Yes to disable the Network Automation Tasks pack.

Registering Network Automation with NIOS

You must register a Network Automation appliance with NIOS to support the Network Automation Tasks. This
registration is done directly on the NIOS system. You need the admin account and password for the Network
Automation appliance and its hostname or IP address.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 129

Dashboards

Note that when you register Network Automation with a NIOS HA pair, you can register only one interface at a time.
Use the IP address of the LAN1 interface, not the VIP address, for registration. When an HA failover occurs, the
Network Automation registration is disabled. You can register the Network Automation appliance again after the
failover.
1. From the Dashboards tab, select the Tasks tab.
2. At the top right corner of the Automation Tasks panel, click the Configure icon -> NetMRI Registration.
3. In the NetMRI Registration dialog, do the following:
a. Enter the IP address or resolved host name of the Network Automation appliance supporting the
Automation task pack.
b. Enter the Admin Password.
This information is specific to the Infoblox Network Automation appliance supporting the Automation tasks
in NIOS.
4. Click Register to commit settings.
After registration, the NetMRI Registration menu item changes to read NetMRI Deregistration to support
disconnecting from the Network Automation appliance.
You can also start Network Automation from the NIOS Dashboards page.
1. From the Dashboard tab, select the Tasks tab.
2. In the Automation Tasks pane, click the down arrow gadget and select Launch NetMRI.
Network Automation launches in a new browser tab.
To check on script executions, go to Configuration Management –> Job Management side tab –> Scripts and check the
Last Run column.
The NIOS Task Viewer (see Using the Task Viewer to View Job Logs and Approve Jobs) also provides the log history of
automated jobs.

The Network Automation Task Pack

The Network Automation task pack contains the following tasks:
• Network Provisioning Task
• Using the Port Activation Automation Task
• Specifying a Port Activation Script
• Assigning a New Script to the VLAN Reassignments Task
• Rogue DHCP Server Remediation
Depending on your administrative permissions, Grid Manager displays tasks you can access in specific task packs.
You can configure your task packs by adding or hiding certain tasks.
To hide tasks in a task pack:
1. Click the Configure icon at the upper right corner of the task pack.
2. In the configuration panel, select the tasks you want to hide from the Active Tasks table. You can use SHIFT+click
and CTRL+click to select multiple tasks.
3. Click the left arrow to move the selected tasks to the Available Tasks table.
Click the Configuration icon again to hide the configuration panel after you complete the modification.

Network Automation Task Options

Tasks allow the assignment of job scripts to change and expand task functionality. These scripts reside on the
Network Automation appliance and must be readable by the NIOS system to run the automation tasks. You can also
select different scripts to execute for automation tasks that provide that feature in NIOS. Three network automation
tasks allow for the choosing of non-default scripts for task operation:
• Network Provisioning Task

130 NIOS Administrator Guide (Rev. A) NIOS 7.3

 The Tasks Dashboard

• Using the Port Activation Automation Task

• Specifying a Port Activation Script

Network Provisioning Task

The Network Provisioning task runs in two modes: a basic mode with a much shorter list of configuration options, and
a more complex mode that provides detailed configuration for provisioning a network, including the use of NIOS
network views, extensible attributes and network templates.
New networks can be provisioned on routed networks and on switched networks. In the latter case, you can specify
the new VLAN number and VLAN name for provisioning, along with the Device Group Device and Interface. the Device
Group values are taken from the Device Groups defined on the Network Automation appliance from which NIOS
obtains its data.
Network Provisioning supports two types of networks: IPv4, in which the new network is IPv4 only, and IPv4 and IPv6,
in which the new network runs both protocol stacks.

Simple vs. Complex Provisioning

Use of a Network View determines whether you use the simple or detailed views of provisioning a network. A network
view is a single routing domain with its own networks and shared networks. In NIOS, all networks must belong to a
network view. You can manage networks in one network view independently of other network views. Because network
views are mutually exclusive, the networks in each view can have overlapping address spaces with multiple duplicate
IP addresses without impacting network integrity.
Also, the same network segment can be present in multiple network views. When you create a new network, you
select one view in which to place it, and preserve those values to apply to another view.
You also have the option to provision a single network segment without recourse to NIOS network views. The simple
network provisioning option (accessible by simply clicking the IPv4 tool at the top of the Network Provisioning dialog
box) allows you to specify as few as three values to configure a network.
The NIOS system also provides a default network view, which appears as an option for network provisioning.
If a single network view is configured in NIOS, you will not see a Network View option in the Network Provisioning task.

Applying Extensible Attributes

Extensible attributes are associated with a specific network view, and are referenced by the Network Provisioning
task. Should you configure a new network using a network view, you may need to consider the application of
extensible attributes to the new network (they are not automatically applied, but will appear in the Network
Provisioning dialog if those attributes are defined in the chosen Network View). Extensible attributes are generally
defined for descriptive and tracking purposes in the network. A network view may have attributes such as Building,
Country, Region, Site, State or VLAN, for example. Attributes are defined for network views in NIOS but are not defined
by the Network Automation appliance.
If the NIOS system supports only a single network view, no View selections are made for the purposes of network
provisioning.
Required settings for provisioning a new network will show a red asterisk (*) by the option name.
To perform an automatic network provisioning task:
1. From the Dashboards tab, select the Tasks tab -> Network Provisioning.
2. Select the network Type for provisioning: IPv4 or IPv4 and IPv6.
3. To configure IPv4 provisioning.
a. Enter the Parent Network value (or click Select Network to choose the parent network from a list if using a
Network View).
b. Choose the Network Template from the drop-down list if one is provided by the chosen Network View. The
Network template is otherwise optional.
The Provision Network task provides subnetting tools.
c. Drag the Netmask slider to the required CIDR mask bit depth (1-32).

NIOS 7.3 NIOS Administrator Guide (Rev. A) 131

Dashboards

d. In the New Network field, enter the IP prefix for the new network.
e. In the Router Address field, enter the IP address for the router interface.
f. Select any Extensible Attributes in the list if they are provided; otherwise, you can create new ones by
clicking Add and choosing the Attribute Name, Value and the Required setting.
4. To configure IPv6 provisioning:
a. Enter the Parent Network value (or click Select Network to choose the parent network from a list if using a
Network View).
b. Choose the Network Template from the drop-down list if one is provided by the chosen Network View. The
Network template is otherwise optional.
The Provision Network task provides subnetting tools.
c. Drag the Netmask slider to the required CIDR mask bit depth (1-32).
d. In the New Network field, enter the IP prefix for the new network.
e. In the Router Address field, enter the IP address for the router interface.
f. Select any Extensible Attributes in the list if they are provided; otherwise, you can create new ones by
clicking Add and choosing the Attribute Name, Value and the Required setting.
5. Enter the required name value in the Interface Hostname field. (Examples include “eth0” and “serial0.”)
6. Select the DNS Zone under which the hostname operates.
7. Choose a device group from the Device Group drop-down list.
8. From the Device drop-down list, choose the switch or router on which the network will originate.
9. If the selected device is a router, the VLAN Number and VLAN Name fields will be disabled.
10. From the Interface list, choose the interface to which the network will be reassigned. The drop-down list contains
all the interfaces from the chosen network device, and also shows the ports’ respective states (up/down, up/up
and so on).
If an interface shows Routed or Switched, it cannot be selected for provisioning as it is already being used as
part of an active network.
11. If the chosen device is a switch, enter the new VLAN Number on which the new network segment runs.
12. If the chosen device is a switch, enter the new VLAN Name on which the new network segment runs.
13. Click Provision Network to commit settings.
The system sends the configuration request to the Network Automation appliance and displays the task configuration
sequence.
You can start Network Automation from the registered Network Automation appliance to check job execution.
1. In the Automation Tasks pane, click the down arrow gadget and select Launch TAE.
Network Automation will launch in a new browser tab. To check on script executions, go to Configuration Management
–> Job Management side tab –> Job History and view details about provisioning jobs and other jobs that execute as a
result of NIOS-based automation tasks.

Defining Options for the Network Provisioning Task

The Network Provisioning task provides several configuration options that affect how the task operates.
Hostname provisioning for interfaces is useful for troubleshooting purposes in the network, usually to ensure that an
admin knows which router interface they are connecting through to communicate with the device. The hostname
value is actually provisioned from within the Network Provisioning task. Enabling the Hostname Required? check box
sets the Network Automation appliance to provision the network with hostnames applied to the router interfaces for
easier identification.
Network provisioning requires that the system know exactly which IP address the gateway for the network will reside.
For provisioning most networks, an Offset value of 1 indicates that the provisioned network gateway IP address ends
with the host address of *.*.*.1, as in 192.168.1.1. An Offset value of 1 will be by far the most common value for
provisioning networks. Specifying an offset value other than 1 indicates that the gateway IP is a specified number of

132 NIOS Administrator Guide (Rev. A) NIOS 7.3

 The Tasks Dashboard

host values from the prefix address of the network. For example, setting an IPv4 Gateway Address Offset of 12
indicates that the IP for the gateway ends in *.*.*.12, as in 10.1.1.12. Offsets work the same way for any size network:
for an example such as 10.1.1.64/26, and an offset of 12, the provisioned gateway IP would be 10.1.1.76. Make sure
the defined offset value lies within the addressable boundaries of the provisioned network!
The same principles also apply for IPv6 networks, except that the IPv6 value is entered manually in hexadecimal
instead of being selected from a drop-down list. Most provisioned IPv6 networks will use a /64 network address.
You can also select a different script from the default for the Network Provisioning task.
To define settings for the Network Provisioning automated task:
1. From the Dashboards tab, select the Tasks tab. Under the Network Provisioning task, click the settings icon on
the top right.
2. If the provisioning process requires a hostname, enable the Hostname Required? check box. (The network
interface hostname (“eth0,” “serial0”) and the Zone that it belongs to are defined in the Network Provisioning
task.)
3. Choose a gateway offset value from the IPv4 Gateway Address Offset drop-down list. If no value is selected, the
offset value defaults to 1 for the provisioned network address.
4. If an IPv6 offset is required for provisioning an IPv6 network or for provisioning a network that supports both IPv4
and IPv6 addressing, enter the IPv6 Gateway Address Offset value in hexadecimal. If no value is entered, the
offset value defaults to 0000.0000.0000.0001 for the provisioned network address, indicating an offset value
of 1 for the gateway IP address.
5. In the Script Name dropdown, choose the script that you wish to run for the Port Activation task. The scripts are
located on the Trinzic Automation 4000 appliance, and referenced for use by NIOS. By default, the bundled Port
Activation script is selected.
6. Click Save to commit settings.
7. Click Cancel to close the dialog.
The system sends the request to the Network Automation appliance and displays a Provisioning Network Config
updated notification message.

Using the Port Activation Automation Task

The Port Activation task provides a central console on which the interfaces for any device anywhere in the managed
network can be conveniently enabled or disabled. Ports can be taken administratively Up or Down using this task,
and all interfaces on a selected device can be activated or deactivated with a series of mouse clicks.
1. From the Dashboards tab, select the Tasks tab -> Port Activation.
2. Choose the Device Group from the drop-down list.
3. From the Device drop-down list, choose the network device on which port activation will be executed.
The Interfaces table lists all interfaces on the current device. The VLAN and VLAN Name columns list the VLAN
assigned to each port (VLAN 1/Default resides on all ports without an explicit VLAN assignment). The OP Status
column will show the current state of each interface.
4. Scroll down the table to locate the interface(s) you want to activate.
5. From the Admin Status column, select Up (or Down) from the drop-down list for the chosen interface.
6. Set any other interfaces on the current device based on your assigned task.
7. Click Apply to commit settings.
The system sends the request to the Network Automation appliance and displays the task configuration sequence.
The Port Activation task will also write the full running configuration to memory, making it the saved configuration. If
the user made a change to the running configuration, in parallel with the port activation change, and did not save it,
those changes will also be saved.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 133

Dashboards

Specifying a Port Activation Script

The Port Activation task provides a central console on which the interfaces for any device in the managed network can
be conveniently activated. Ports can be taken administratively Up or Down using this task, and all interfaces on a
selected device can be activated or deactivated with a series of mouse clicks.
The Network Automation appliance provides the ability to create new automation scripts for many purposes. You may,
for example, wish to create a new Port Activation script and use that as an automation task.
To select a different script from the default choice in the software:
1. From the Dashboards tab, select the Tasks tab. Under the Port Activation task, click the settings icon.
2. For Port Activation Options, choose a new script from the Script Name drop-down list. The scripts are located on
the Trinzic Automation 4000 appliance, and automatically referenced for use by NIOS. By default, the bundled
Port Activation script is selected.
3. Click Save to commit settings.
The system sends the request to the Network Automation appliance and displays a notification message.

VLAN Reassignment
VLANs can be reassigned to new interfaces on individual L2/L3 switches in the managed network. A VLAN can have
a path across several switches; when you make changes on a given switch, make sure that the path is maintained.
To ensure end-to-end connectivity, you may need to change VLAN port assignments on more than one switch in the
path. This feature operates with the VLAN Trunking Protocol (VTP). VLAN switching is changed across one port per
switch at a time. Should you need to change VLAN assignments across more than one switch in the path, plan
accordingly.
VLANs must already be configured on the switch(es) being changed, and be detected by the Network Automation
appliance.
1. From the Dashboards tab, select the Tasks tab -> VLAN Reassignment.
2. Begin by selecting the Device Group from the drop-down list. For VLAN Reassignments, you typically choose the
Switching device group.
3. From the Device drop-down list, choose the switch on which port reassignment will be executed.
4. From the Port list, choose the interface to which the VLAN will be reassigned. The Port list also shows the
Administrative and Operational states of each interface on the current device (Administratively Up/Operationally
Down, for example.)

Note: You can reassign a VLAN to a port that is operationally or administratively Down.

The Current VLAN value will show the VLAN to which the selected interface is currently assigned.
5. Choose the new VLAN value for port reassignment from the New VLAN drop-down list.
6. Click Move VLAN to commit settings.
The system sends the configuration request to the Network Automation appliance and displays the task configuration
sequence.
The VLAN Reassignment task will also write the full running configuration to memory, making it the saved
configuration. If the user made a change to the running configuration, in parallel with the port activation change, and
did not save it, those changes will also be saved.

134 NIOS Administrator Guide (Rev. A) NIOS 7.3

 The Tasks Dashboard

Assigning a New Script to the VLAN Reassignments Task

The Network Automation appliance provides the ability to create new automation scripts for many purposes. You can
create and assign a new VLAN Reassignment script and use that for the automation task.
To select a different script from the default choice in the software:
1. From the Dashboards tab, select the Tasks tab. Under the VLAN Reassignment task, click the settings icon.
2. For Port Activation Options, choose a new script from the Script Name drop-down list.
3. Click Save to commit settings.
The system sends the request to the Network Automation appliance and displays a notification message.
The VLAN Reassignment task will also write the full running configuration to the device’s memory, making it the saved
configuration. If the user made a change to the running configuration, in parallel with the port activation change, and
did not save it, those changes will also be saved.

Provision Bare Metal Device

The Provision Bare Metal Device automated task enables automated installation of new switches and routers into the
network. The Trinzic Automation task enables cost and convenience savings by detecting the default behavior of new
devices on the network, pointing them to customized TFTP servers from which standardized bare-metal configuration
files are downloaded and installed onto the new devices.
The Provision Bare Metal Device automated task does not provide NIOS-based optional settings; configuration for
this task is done in the Trinzic Automation 4000 Network Automation user interface. The automated task is
automatically triggered by detection of a network device requiring configuration.

Rogue DHCP Server Remediation

All DHCP servers on the network should be under administrative control. If any device offering DHCP leases to clients
on the network is not properly administered, it violates many security guidelines and at the very least may cause
configuration problems throughout the network. Some events may be unwitting or innocuous (an office worker
installing a wireless access point in their cube to share a resource), or may be an attempt to hijack clients and steal
information. To prevent such issues, the Rogue DHCP Server Remediation task enables the detection, location and
isolation of such devices.
The Provision Bare Metal Device automated task does not provide NIOS-based optional settings; configuration for
this task is done in the Trinzic Automation 4000 Network Automation user interface. The automated task is
automatically triggered by detection of a network device requiring remediation.

Using the Task Viewer to View Job Logs and Approve Jobs
You can view the logged results from any task run from the Automation Tasks dashboard through a pair of information
pages, which are accessed through the Task Viewer window.
A Job History page provides a log history of all TAE tasks that have recently run, including all Automation Task types
in the dashboard.
A second page, Issues & Approvals, provides links to two important items: Issues, which displays details about any
network issue related to TAE tasks and jobs in an Issue Viewer page from the Network Automation appliance, and
Approvals, which are jobs that must be approved before the Network Automation appliance can execute the job. For
example, the Isolate Rogue DHCP Server job must be approved before it will run and attempt to isolate the detected
rogue DHCP server in the network.
1. From the Dashboards tab, select the Tasks tab.
2. In the Automation Tasks pane, click the down arrow gadget and select Task Viewer. The Task Viewer window
appears, displaying a scrollable and sortable Job History table. Important columns include the Start Time, the
Job ID (a numeric value with a clickable link to the TAE Job Details Viewer, which will open in a new browser tab),
the Job Name, the User account that executed the task, the job Status and the # Devices (the number of devices)
against which the task ran.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 135

Dashboards

The Job History page shows the most recent subset of executed TAE jobs. A yellow bar at the top of the table
provides a click here to see more link, which takes the user to the Network Automation appliance Job History
page in a new browser tab.
3. If an item appears in the Issues & Approvals page, click the link in the Action column. You will typically see two
different link types: Issue Details or Approve Job.
a. To view an issue in more detail: Clicking an Issue Details link displays the Network Automation appliance
Job Details page in a new browser tab for the selected job.
b. To approve a job: Clicking an Approve Job link displays the Summary page of the Network Automation Job
Wizard, with an Approve Job button.
4. Click Close to close the Task Viewer.
In the Network Automation appliance, you can also check Configuration Management –> Job Management side tab –
> Job History and view details about any jobs that execute as a result of NIOS-based automation tasks.

About Dashboard Templates

Superusers can specify the tasks an admin group can perform from the Tasks Dashboard tab by creating a dashboard
template and assigning it to the admin group. When you create a dashboard template, you define the tasks users in
an admin group can perform and specify whether the users can configure their own dashboards when they log in to
Grid Manager. When you assign a dashboard template to an admin group, all users in this group can see and perform
the tasks you define in the template, provided that the users also have the correct permissions to the objects related
to the tasks. For information about administrative permissions, see Administrative Permissions for Dashboard Tasks
on page 263. If the assigned template is unlocked, users can configure tasks on their dashboard. If you lock the
dashboard template, users cannot configure task packs on their own dashboards.
Superusers can also restrict limited-access users to access only the Tasks Dashboard tab when they log in to Grid
Manager. These users cannot manage other core network services through Grid Manager. They can only see the Tasks
Dashboard tab and access only the tasks defined in the dashboard template, if applicable. This feature is useful
when you want to define different levels of admin users and restrict them to specific tasks based on their
organizational functions. For information about how to set this restriction, see Creating Limited-Access Admin Groups
on page 190.
To configure and apply dashboard templates, complete the following:
1. Configure dashboard templates, as described in Adding Dashboard Templates on page 136.
2. Assign dashboard templates to admin groups, as described in About Admin Groups on page 188.

Adding Dashboard Templates

Only supersuers can configure dashboard templates. Limited-access users may configure task packs depending on
the configuration of their assigned dashboard templates.
To add a dashboard template:
1. Log in as a superuser.
2. From the Dashboards -> Tasks tab, click the Configure icon at the top right corner of a task pack.
3. Select tasks from the Active Tasks table and use the left arrow to move them to the Available Tasks table to hide
the tasks, and vice versa. Grid Manager displays the tasks you place in the Active Tasks table. Repeat the steps
for all task packs.
4. At the top right corner of the Tasks Dashboard panel, click the Configure icon -> Configure Template.
5. In the Dashboard template configuration section, click Create new template.
6. In the Save Dashboard Template dialog box, complete the following:
— Name: Enter a name for the new dashboard template.

136 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Dashboard Templates

— Locked: When you select this check box and assign this template to an admin group, users in the admin
group can only perform the tasks you configure to appear in this template. They cannot configure their
dashboards. When you clear this check box, users can still only see the tasks you configure for this
template, but they can now configure tasks in the task packs on their dashboards. Note that when you lock
a template, it applies to all users in the admin group, including those who have customized dashboards.
7. Click Save & Close.
The appliance saves the template and adds it to the Template drop-down list.

Resetting Dashboard Templates

Only users with an unlocked dashboard template assigned can reset their dashboards to the template that was
originally assigned to them. Users with locked dashboard template cannot configure or reset their dashboards. Also,
only superusers can configure dashboard templates.
To reset a dashboard template:
1. Select the Dashboards -> Tasks tab.
2. For superusers: At the top right corner of the Tasks Dashboard panel, click the Configure icon -> Reset. Note that
the Configure icon appears only if you are a superuser.
For limited-access users: At the top right corner of the Tasks Dashboard panel, click Reset.
The appliance reset your dashboard to the original dashboard template that was assigned to your admin group.

Modifying Dashboard Templates

You can modify an existing dashboard template by locking or unlocking it, and adding or removing tasks from a task
pack. However, you cannot change the name of the template. When you change the name of a template, the appliance
clones the template and adds the new template to the list. Note that when you modify a locked template that is
assigned to an admin group, users in the group automatically adopt the changes you make to the template the next
time they log in to Grid Manager.
To modify a dashboard template:
1. From the Dashboards -> Tasks tab, click the Configure icon at the top right corner of the panel.
2. In the Dashboard template section, select the template you want to modify from the Template drop-down list.
Note that Grid Manager displays [L] before the name of a locked template.
3. In the task pack, click the Configure icon at the top right corner.
4. Select tasks from the Active Tasks table and use the left arrow to move them to the Available Tasks table to hide
the tasks, and vice versa. Grid Manager displays the tasks you place in the Active Tasks table. Repeat the steps
for all task packs.
5. Click Save.
6. In the Save Dashboard Template dialog box, modify other information, as described in Adding Dashboard
Templates.
7. Click Save & Close.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 137

Dashboards

Deleting Dashboard Templates

Only superusers can delete dashboard templates. To delete a dashboard template that is currently assigned to an
admin group, you must first unassign the template from the admin group. For more information, see Creating
Limited-Access Admin Groups on page 190.
To delete a dashboard template:
1. From the Dashboards -> Tasks tab, click the Configure icon at the top right corner of the panel.
2. In the Dashboard template section, select the template you want to delete from the Template drop-down list.
3. Click Delete.
4. In the Delete Dashboard Template dialog box, click Yes.

Assigning Dashboard Templates

After you create a dashboard template, you can assign it to an admin group. Admin users in this admin group can
access the tasks you define in the template.
To assign a dashboard template to an admin group, see About Admin Groups on page 188.

Status Dashboards
A status dashboard contains widgets from which you can view and manage data. Widgets are the building blocks of
status dashboards. For more information about widgets, see Adding Widgets to Dashboards on page 139. They
provide information about different aspects of your Grid and networks. For example, the Member Status widget
provides general information about a Grid member, and the Network Statistics widget provides data for a specified
network.
The appliance provides a default status dashboard. Grid Manager displays the default dashboard only when there
are more than one widget on the dashboard. You can add and modify widgets in the default dashboard, but you
cannot rename or delete it. From a dashboard, you can access your most commonly accessed tasks and monitor
appliance status. You can configure your own status dashboards to which you can add widgets that help you manage
different data. Configuring multiple status dashboards helps organize widgets in a meaningful way and improves
dashboard and widget performance. This is especially useful when you have a Grid serving a large number of Grid
members. When you configure a new dashboard, you can use the existing dashboard as a template. You can create
up to 100 copies at a time using the Add Dashboard option. For information about how to add status dashboards,
see Adding Status Dashboards on page 142.
You can add widgets to different dashboards, however, you can add only one widget at a time on each dashboard.
The default number of widgets per dashboard is 10. The maximum number of widgets that you can add on each
dashboard is 20 at a time. You can define the number of widgets that can be configured on each dashboard in User
Profile. This limitation applies only to dashboards that you configure and does not apply to the default dashboard.
For information about how to specify the widget limit, see Configuring Widget Limit per Dashboard on page 141.
Grid Manager provides a default Security dashboard if you have installed any or all of the following licenses on the
appliance: Threat Protection, RPZ, and Threat Analytics. The Security dashboard contains widgets that help you
monitor the security status of the Grid. In the Security dashboard, you can add and remove widgets, but you cannot
rename or delete them.

Note: To ensure that the Security dashboard displays correct data, use NTP to synchronize the time of the Grid
members with that of the Grid Master.

If you have configured a lot of status dashboards, you can use the Quick Navigation icon to quickly access each status
dashboard. For information, see Using Quick Navigation on page 142. Figure 2.1 illustrates the typical layout in Grid
Manager after you configure multiple status dashboards.

138 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

Figure 2.1 Status Dashboard

Configure Icon Dashboard Options List of Configured Dashboards Quick Navigation

You can do the following in the Status tab:

• Add new status dashboards, as described in Adding Status Dashboards on page 142.
• Rename a dashboard, as described in Renaming Status Dashboards on page 142.
• Copy or move a widget, as described in Copying or Moving Widgets on page 143.
• Reorder dashboards, as described in Reordering Status Dashboards on page 143.
• Delete dashboards, as described in Deleting Status Dashboards on page 143.
• Configure widget limit, as described in Configuring Widget Limit per Dashboard on page 141.
• Configure Security dashboard properties, as described in Configuring Security Status Thresholds on page 144.

Adding Widgets to Dashboards

You can add all or some of the following widgets to your status dashboards depending on whether you are managing
a Grid, an independent appliance, or an Infoblox Orchestration server:
— Grid Status
— Grid Upgrade Status
— Member Status (System Status)
— DNS Statistics
— Ranges Over Threshold
— IPv4 Failover Associations Status
— DHCP Statistics
— Network Statistics
— IPv4 Networks Over Threshold
— Discovery Status
— Advanced Discovery Status
— My Commands
— DDNS Statistics

NIOS 7.3 NIOS Administrator Guide (Rev. A) 139

Dashboards

— System Activity Monitor

— File Distribution Statistics
— Active WebUI Users
— Microsoft Servers Status Widget
— CSV Import Manager
— Load Balancer Status
— Pending Approvals
— Infoblox Community
— Infoblox Community
— Mobile Devices Status
— Threat Protection Status for Grid
— Threat Protection Status for Member
— DNS Integrity Check
— Cloud Statistics
— Security Status for Grid
— Security Status for All Members
— Security Status for All Members
— Pool Licenses Statistics
— DNS Record Scavenging
Grid Manager displays the Security dashboard if you have any or all of the following licenses installed on your
appliance: Threat Protection, RPZ, and Threat Analytics. The Security dashboard contains the following widgets,
depending on the licenses installed on your appliance:
— Security Status for Grid
— Security Status for All Members
— Threat Protection Status for Grid
— Threat Protection Status for Member
— Response Policy Zone (RPZ) Status for Grid
— Response Policy Zone (RPZ) Status for Member

Note that you must have at least read-only permission to the objects that a widget displays. Otherwise, though you
are allowed to select and place the widget on the dashboard, it does not display any information.
To add widgets to your dashboard:
1. Default Status Dashboard: From the Dashboards -> Status tab -> Default tab, click the Configure icon -> Add
Content. This is applicable when you have the default dashboard only.
Configured Status Dashboards: From the Dashboards -> Status tab, select the configured status dashboard,
click the Configure icon -> Add Content.
Security Status Dashboard: From the Dashboards -> Status tab -> Security tab, click the Configure icon -> Add
Content. This is applicable only when at least one member in the Grid has Threat Protection, RPZ, or Threat
Analytics license. Note that the Security Status dashboard is a default dashboard and it cannot be renamed or
deleted.
Grid Manager displays thumbnails of the available widgets. Use the scroll bar on the right to scroll through the
widgets, as illustrated in the Figure 2.2.
2. Select and drag a widget to the desired location on your dashboard.
After you add a widget to the dashboard, you can configure it to provide relevant data. You can also copy or move a
widget, by selecting and dragging it to its new location on your dashboard. Grid Manager saves your dashboard
configuration and displays it the next time you log in.

140 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

You can turn on auto-refresh by clicking On in the Turn Auto Refresh field at the top of the dashboard to periodically
refresh the contents of all widgets in the dashboard. Click Off to disable auto-refresh for all widgets in the dashboard.
When auto-refresh is disabled, you can enable it for individual widgets by clicking the Configure icon in the
corresponding widgets. You can specify the auto-refresh period in seconds. The default auto-refresh period is 30
seconds.
Widgets have the following icons:
• Copy/Move: Click to copy or move the widget from a dashboard to another. For information about how to copy or
move, see Copying or Moving Widgets on page 143.
• Span Up/Span Down: Click to resize the widget. Click Span Up to increase the width of the widget. Click Span
Down to decrease the width of the widget. Note that the fully spanned widgets are moved to the top of the
dashboard.
• Refresh: Click to update the content of the widget. Each widget contains a status bar at the bottom that displays
the last date and time it was updated.
• Configure: Click to hide and show the configuration options of the widget.
• Toggle: Click to minimize and restore the widget.
• Close: Click to remove the widget from a dashboard.

Figure 2.2 Widgets Panel

Thumbnails of Widgets Widget Icons Select and drag Widgets Close button

Configuring Widget Limit per Dashboard

You can define the number of widgets that can be configured on each dashboard. This limitation applies only to
dashboards that you configure and does not apply to the default dashboard.
1. From the Dashboards -> Status tab, click the Configure icon -> User Profile.
2. In the User Profile editor, complete the following:
— Maximum Widgets per Dashboard: Specify the maximum number of widgets that can be configured per
Dashboard. You can enter a value between 1 and 20. The default value is 10. This limit does not apply to
the default dashboard.
3. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 141

Dashboards

Adding Status Dashboards

You can create your own status dashboards and add the widgets that you need. You can configure up to 100 status
dashboards at a time. When you create multiple instances of a dashboard, the appliance names each dashboard by
adding an incremental suffix to the name of the new dashboard. For example, if you name a new dashboard
“Corp_Dashboard” and specify the number of instances as three, then the appliance creates three instances of this
new dashboard. In this example, the appliance creates three dashboards: Corp_Dashboard, Corp_Dashboard1, and
Corp_Dashboard2. Note that the dashboards you create will not be available to other users. You cannot share
dashboards you have created with other users.
Note that “Security” is reserved for the default Security dashboard. Grid Manager displays an error message if you
name a new dashboard “Security”.
To add a new status dashboard:
1. From the Dashboards -> Status tab, click the Configure icon -> Add Dashboard.
2. In the Add Dashboard wizard, complete the following:
— Name: Enter a name for the new dashboard.
— Add <> instances of this new dashboard: Enter the number of dashboards you want to create. The maximum
number of dashboards you can create is 100 at a time.
— Copy initial content from an existing dashboard: Select this check box if you want the appliance to copy the
contents from an existing status dashboard into the new dashboard. After you select this check box, the
appliance displays the list of configured dashboards. Select a dashboard from the list. By default, this
check box is not selected.
3. Save the configuration.
The appliance displays all dashboard instances in the Status tab.

Using Quick Navigation

You can use the Quick Navigation icon to quickly access a specific dashboard. The appliance provides the Quick
Navigation icon at the right corner of the status dashboards, as illustrated in Figure 2.1.
To quickly navigate to a dashboard:
1. From the Dashboards -> Status tab, click the Quick Navigation icon at the right corner of the dashboards.
The list of configured dashboards are displayed.
2. Select a dashboard or specify the name of the dashboard in the text box. The appliance displays the selected
dashboard.

Renaming Status Dashboards

You can rename only the status dashboards that you have configured. You cannot rename the default dashboard and
the Security dashboard.
To rename a dashboard:
1. From the Dashboards -> Status tab, click the Configure icon -> Rename Dashboard.
2. In the Rename Dashboard wizard, complete the following:
— Select a dashboard: Select a dashboard from the drop-down list.
— Name: Enter the new name of the dashboard.
3. Do one of the following:
— Click Save and Close to save the new name and close the wizard.
— Click Save to save the new name and continue to rename other dashboards.
To rename a specific dashboard:
1. From the Dashboards -> Status tab, select a dashboard that you want to rename.
2. Click the Configure icon -> Rename Dashboard.

142 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

3. In the Rename Dashboard wizard, enter the new name in the Name text box.
4. Click Save and Close to save the new name and close the wizard.

Copying or Moving Widgets

You can copy or move a widget from one dashboard to another. When you add a widget that already exists, the
appliance displays an error message. When you move a widget, it is moved from the source to the destination
dashboard. The moved widget will not be available in the source dashboard any more. When you copy a widget, the
widget is duplicated and is available in both the source and destination dashboards. Note that the Copy/Move icon
is not available in a widget if the appliance has only the default status dashboard.
To move or copy a widget:
1. From the Dashboards -> Status tab, select a status dashboard.
2. Select the widget that you want to copy or move, and then click the Copy/Move icon.
3. In the Copy/Move <name of the widget> wizard, complete the following:
— Copy: Select this to copy a widget.
— Move: Select this to move a widget.
— To Dashboard: Select the name of the destination dashboard.
4. Click OK.

Reordering Status Dashboards

You can change the order of your status dashboards. When you add a new status dashboard, it is added as a tab.
When you create multiple instances of a dashboard, they are added as subsequent tabs. You can arrange the order
of each dashboard through the reordering process.
To reorder status dashboards:
1. From the Dashboards -> Status tab, click the Configure icon -> Reorder Dashboards.
2. The following are displayed in the Order Dashboards wizard:
— Ordering: You can use the up and down arrows to move dashboards in the desired order or drag and drop
them to the desired positions.
— Dashboard: Displays the list of all the status dashboards.
3. Click OK to save the changes.

Deleting Status Dashboards

You can delete status dashboards that you have configured. You cannot delete the default status dashboard and the
Security dashboard. You can delete multiple dashboards at the same time. Note that you cannot restore a deleted
dashboard.
To delete multiple dashboards:
1. From the Dashboards -> Status tab, click the Configure icon -> Delete Dashboards.
2. In the Delete Dashboards wizard, select the Dashboard check box. You can select multiple check boxes for
multiple dashboards.
3. Click Delete.
4. Click Yes in the confirmation dialog box.
To delete a specific dashboard:
1. From the Dashboards -> Status tab -> select the <Status Dashboard> tab.
2. Click the Configure icon -> Delete Dashboard.
3. In the Delete Confirmation dialog box, click Yes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 143

Dashboards

Configuring Security Status Thresholds

You can configure thresholds to determine the overall status of Threat Protection, DNS RPZ (Response Policy Zone),
and DNS Threat Analytics services in the Grid. Grid Manager provides a view of the overall security status of the Grid
in the Security Status for Grid dashboard widget. For information, see Security Status for Grid on page 162.
To configure the thresholds for security status:
1. From the Dashboards -> Status tab, click the Configure icon -> Global Dashboard Properties.
2. In the Global Dashboard Properties editor, complete the following:
— Threat Protection Thresholds: Define the thresholds for each severity level of the threat protection events
for the following colors:
— Yellow: Specify the low threshold value for Critical, Major, and Warning severity level. The default
values are 1, 20, and 100 for Critical, Major, and Warning respectively.
— Red: Specify the high threshold value for Critical, Major, and Warning severity level. The default values
are 5, 100, and 1000 for Critical, Major, and Warning respectively.
Depending on the specified thresholds, Grid Manager determines the status of threat protection service as
follows, which is displayed in the Status column of the Security Status for Grid widget:
— Green (OK): When the number of threat protection events are less than the low threshold value
specified for the yellow color for all the severity levels.
— Yellow (Warning): When the number of threat protection events equals or exceeds the threshold value
specified for the yellow color but less than the threshold value specified for the red color for any of the
severity levels.
— Red (Critical): When the number of threat protection events equals or exceeds the high threshold value
specified for the red color for any of the severity levels.
— Response Policy Zone Thresholds: Define the threshold values for the following colors to determine the
overall status of RPZ:
— Yellow: Specify the low threshold value for Blocked, Substitute, and Passthru RPZ rules. The default
values are 10, 1, and 100 for Blocked, Substitute, and Passthru respectively.
— Red: Specify the high threshold value for Blocked, Substitute, and Passthru RPZ rules. The default
values are 100, 10, and 1000 for Blocked, Substitute, and Passthru respectively.
Depending on the specified thresholds, Grid Manager determines the status of RPZ as follows, which is
displayed in the Status column of the Grid Security Status widget:
— Green (OK): When the number of RPZ hits are less than the low threshold value specified for the yellow
color for all the rule types.
— Yellow (Warning): When the number of RPZ hits equals or exceeds the threshold value specified for the
yellow color but less than the threshold value specified for the red color for any of the rule types.
— Red (Critical): When the number of RPZ hits equals or exceeds the high threshold value specified for the
red color for any of the rule types.
— Threat Analytics Thresholds: Define the thresholds for the following colors, to determine the overall status
of DNS Threat Analytics:
— Yellow: Specify the low threshold value for DNS Tunneling events. The default value is 1.
— Red: Specify the high threshold value for DNS Tunneling events. The default value is 5.
Depending on the specified thresholds, Grid Manager determines the status of DNS Threat Analytics as
follows, which is displayed in the Status column of the Grid Security Status widget:
— Green (OK): When the number of DNS tunneling attacks are less than the low threshold value specified
for the yellow color.
— Yellow (Warning): When the number of DNS tunneling attacks equals or exceeds the threshold value
specified for the yellow color but less than the threshold value specified for the red color.
— Red (Critical): When the number of DNS tunneling attacks equals or exceeds the high threshold value
specified for the red color.
3. Save the configuration.

144 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

Note: If you have configured the same threshold value for both Yellow and Red color in the Global Dashboard
Properties editor and if the same number of events are triggered, then Grid Manager displays the status in red
in the Grid Security Status widget.

Grid Status
The Grid Status widget provides status information about the Grid members and services. Add the Grid Status widget
to your Dashboard to monitor the Grid status.
You can configure the Grid Status widget to display information about all Grid members or only Grid members that
have service errors. To modify the Grid Status widget, click the Configure icon and select one of the following:
• Show all Grid members (this is the default)
• Only show members with service warnings or errors: When you select Only show members with service
warnings or errors, the widget displays only the members that have service errors. The widget does not display
any data in the member table if all the services on all members are running properly.
• Group Members by: If you want to group members by the same extensible attribute value, select this and
choose an extensible attribute from the drop-down list. The appliance groups Grid members that have the same
extensible attribute value, and the Grid Status displays the following information:
• <Extensible Attribute Name>: The value of the selected extensible attribute. You can click the link of the
extensible attribute value to view all the members in this group in the Grid/Members view.
• Status: This is the overall status for all members in the group. Depending on the status of each member, the
overall status can be one of the following:
— Working: Indicates that all the members in the group are running properly.
— Warning: Indicates that one of the member in the group has operational problems. For example, if there
are two members in a group with one member Running and another member is Offline, then the overall
status will be Warning.
— Failed: Indicates that at least one of the members in the group is in the failed status and none of the
members in the group are in the Running or Working status. For example, if there are two members in
the group and one of them is in Failed status and the other is Offline, then the overall status is Failed.
— Offline: Indicates that one or more members in the group is offline and none of the members in the
group are in the Failed or Running status. For example, if a member is in the Working status and
another member is in the Offline status, then overall status is Offline.
— Inactive: Indicates that one or more members in the group is inactive and none of the members in the
group are in the Failed, Offline, Working, or Running status.
— Unknown: Indicates that the status of all the members in the group is unknown.

Note: You can click a member link to monitor the detailed status of the selected member. Grid Manager displays the
Grid tab -> Member tab. For information, see Member Status on page 1326. You can click on a group to show
the members of the group in the Grid/Members view.

The Grid Status widget also displays the following information in the member table:
• Member Name: The name of the member.
• IPv4 Address: The IPv4 address of the member.
• IPv6 Address: The IPv6 address of the member.
• Status: The current status of the member.
• System Uptime: The duration of time (days, hours, and minutes) that the Grid member has been up and
running.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 145

Dashboards

In the upper section of the widget, Grid Manager displays the overall status of the Grid. The Grid status represents
the status of the most critical member in the Grid. When all Grid members are running properly, the overall Grid status
is green. When one of the members has operational issues, the overall Grid status is red. The status icon can be one
of the following:

Icon Color Meaning

Green All Grid members are operating normally in a “Running” state.

Yellow At least one of the Grid members is connecting or synchronizing with its Grid Master.

Red At least one of the Grid members does not have a Grid license, is offline, upgrading,
downgrading, or shutting down.

This section also displays the overall operational status of the DNS, DHCP, NTP, FTP, TFTP, HTTP (File Distribution),
bloxTools, Captive Portal, DNS Accelerator usage, and Reporting services that are currently running on the Grid. The
DNS Accelerator usage feature is only available in the IB-4030 appliance. The status icon can be one of the following:

Green The enabled service is running properly on one or more Grid members.

Yellow At least one of the Grid members is having issues with the enabled service.

Red The enabled service is not running properly on at least one of the members. (A red status icon
can also appear temporarily when the service is enabled and begins running, but the
monitoring mechanism has not yet notified Grid Manager.)
Gray The service is not configured or is disabled on at least one Grid member.

146 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

Grid Upgrade Status

The Grid Upgrade Status widget provides upgrade status of the Grid Master and members. Add the Grid Upgrade
Status widget to your Dashboard to monitor the upgrade status of the Grid and its members.
The Grid Upgrade Status widget displays the following information:
• Upgrade Status: The current upgrade status of the Grid. This can be Running, Paused, Canceled, or Inactive.
• Grid Member Upgrade Process Status: The pie chart shows the number of members that are still processing the
upgrade, members that have completed the upgrade, and members that are waiting for the upgrade to happen.
• Detailed Upgrade Status: Click this link to access the Grid tab -> Upgrade tab to see detailed information about
the upgrade.
The table on the right shows a summary of the upgrade status of the upgrade groups. It displays the following
information:
• Group: The name of the upgrade group.
• Date/Time: The date and time when the upgrade started on this upgrade group. Note that the time zone is the
time zone of the first member in the upgrade group.
• Completed: Indicates whether the upgrade is complete or not.

Member Status (System Status)

The Member Status widget provides status information about the system resources and services of a Grid member,
including the reporting server. The System Status widget provides the operational status about an independent
appliance. Add a Member Status widget to your Dashboard for each Grid member that you want to monitor. The
widget always displays the services that a Grid member is running. You can then configure it to display additional
information and specify how the information is displayed.
You can modify the Member Status or the System Status widget by clicking the Configure icon. If you have an
independent appliance, you can only configure some of the following:
• For Member Status widget only: Click Select Member to select a Grid member for display. When you select the
reporting server, the widget displays reporting related information, such as reporting usage and reporting
warning count.
• Select the information you want to display:
— Show Role: For Member Status widget only. Click to display whether the appliance is a Grid Master, Grid
Master candidate, or Grid member. An independent appliance does not have a Grid license installed.
— Show Hardware Type: Click to display the appliance hardware model.
— Show HA Status: Click to display whether the appliance is part of an HA pair. It displays one of the
following:
— Standalone: The Grid member is an independent appliance.
— HA OK: The Grid member is part of an HA pair that is functioning properly.
— HA Broken: The appliance is part of an HA pair that is not operating properly. You can check the logs to
determine the problem.
— Show System Uptime: Click to display the duration of time (days, hours, and minutes) that the Grid member
has been up and running.
• Statistics: Select the data that you want to display and its format:
— CPU: Click to display the percentage of CPU that is in use. Select either Dial or Bar for the display format.
— Memory: Click to display the current percentage of memory that is in use. Select either Dial or Bar for the
display format.
— Database: Click to display the percentage of the database that is in use. Select either Pie or Bar for the
display format.
— Disk: Click to display the percentage of the data partition on the hard disk drive in use. Select either Pie or
Bar for the display format.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 147

Dashboards

— System Temperature: Click to display the system temperature. Depending on the hardware model, the
system temperature may not be available. Select to display the temperature in either Celsius or Fahrenheit.
— CPU Temperature: Click to display the CPU temperature. Depending on the hardware model, the CPU
temperature may not be available. Select to display the temperature in either Celsius or Fahrenheit.
— DNS Accelerator Usage: This feature is only available in the IB-4030 appliance. Click to display the
percentage of DNS Cache Acceleration usage, if available. When the DNS cache acceleration utilization
reaches the maximum threshold, the appliance displays both the Member Status and the banner in yellow
each time you log in to the appliance within 24 hours. It also displays the number of times the appliance
has reached the maximum limit in the past 24 hours.
For example, if you are using a DNS Cache Acceleration Tier 3 license with 300K performance, and if the
DNS Cache Acceleration usage has reached 250K, then the appliance displays the DNS Cache Acceleration
usage as 83%, which is calculated as (250*100)/300. In this case, the appliance displays the following
message in the banner:
DNS Cache accelerator usage reached 83% of the maximum capacity 6 times in the last
24 hours.
Click the Configuration icon again to hide the configuration panel after you complete the modification.
Grid Manager displays the hostname of the appliance at the top of the widget. You can click the name link to view
detailed information about the appliance. The widget also displays the upgrade status if the member is currently in
the process of an upgrade. If the member is scheduled for an upgrade, the Scheduled for upgrade link appears. You
can click this link to access the Grid tab -> Upgrade tab to view more details about the date and time of the scheduled
upgrade.
The widget also displays the service status of the following: FTP, TFTP, HTTP (File Distribution), DNS, DHCP, NTP,
bloxTools, Captive Portal, DNS Accelerator, and Reporting in the Services section. The service status can be one of
the following:

Icon Color Meaning

Green The service is enabled and running properly.

Yellow The service is enabled, but there may be some issues that require attention.

Red The service is enabled, but it is not running properly or is out of synchronization. (A red status
icon can also appear temporarily when a service is enabled and begins running, but the
monitoring mechanism has not yet notified the GUI engine.)
Gray The service is not configured or is disabled.

The widget also displays the statistics you specified, such as CPU usage, memory and database usage, in the format
you selected.
When you select the reporting server, you can also see the following information:
• Reporting Usage: Displays the daily consumption rate for the reporting service.
• Reporting Warning Count: When the data usage on the reporting server approaches or reaches the daily
maximum limit, the appliance sends an SNMP trap and email notification, if configured. When you receive five
(5) violation notifications in a rolling period of 30 days, you cannot view reports or configure reporting related
functions. You must then contact Infoblox Technical Support to resolve the issue.
For more information about reporting, see Infoblox Reporting and Analytics on page 1379.

148 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

DNS Statistics
The DNS Statistics widget provides statistics for a member or for a zone. The zone statistics are cumulative, collected
from all the members that are authoritative servers for zones or are hosting stub zones. The widget displays the totals
for each type of DNS response as well as a line graph that tracks the responses per second.
You can add a DNS Statistics widget to your Dashboard for each zone or member DNS server on the Grid.
To configure the DNS Statistics widget, click the Configure icon and do the following:
• Click Select Member. In the Member Selector dialog box, choose a Grid member to display statistics for all its
stub zones and authoritative zones.
or
• Click Select Zone. In the Zone Selector dialog box, choose a DNS zone to display statistics for that zone only.
The widget displays only the option that you selected on your subsequent logins. For example, if you clicked Select
Member, the widget displays the Select Member option only, and not the Select Zone option, when you log in again.
• Graph Configuration: Select which DNS messages you want to track in the Responses per Second graph.
— Success: The number of successful queries.
— NXDOMAIN: The number of queries for domain names that did not exist in the database.
— Referral: The number of queries that became referrals.
— NXRRSET: The number of queries for domain names that did not have the requested records.
— Failure: The number of queries that failed due to reasons other than nonexistent domain names or records
in a domain.
— Recursion: The number of recursive queries for which the name server sent queries to other name servers.
The widget displays the following information:
• DNS Responses tab: Displays a pie chart and the total number of each type of message. It also displays the total
number of full and incremental zone transfers that the Grid member performed.
• Responses per Second tab: Displays a line graph that tracks the DNS responses received per second, within an
hour. The time is displayed according to the time zone specified in the User Profile. If the auto-detect time zone
option is enabled and Grid Manager cannot determine the browser time zone, then the time is displayed in UTC
format. You can mouse over the graph to display the coordinates of any point in the graph.

Ranges Over Threshold

The Ranges Over Threshold widget enables you to monitor IPv4 DHCP range usage from your Dashboard. It lists the
IPv4 ranges that are allocated above a specified threshold and thus may warrant your attention. The default threshold
is 75%. For information, see Configuring Thresholds for DHCP Ranges on page 1087. Note that the appliance
highlights disabled IPv4 ranges in gray.
The widget displays the IPv4 ranges with utilization percentages that surpass the threshold.
To configure the Ranges Over Threshold widget, click the Configure icon and do the following:
• Network View: Select a network view in which you want to monitor the IPv4 ranges. This field is displayed only
when you have more than one network view.
• Threshold: Enter a new threshold value. The default is 75%.
In addition, you can do the following:
• Click the Export button to export the list of IPv4 ranges that surpass the threshold to a file in CSV format.
• Click the Refresh button to refresh the data in the list.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 149

Dashboards

IPv4 Failover Associations Status

The IPv4 Failover Associations Status widget enables you to monitor the status of the failover associations from your
Dashboard. It lists all the failover associations in the Grid and displays their names and status. The widget also
displays the primary and secondary servers in the association. When you click a failover association link or a status
link, Grid Manager displays the Failover Association section where you can get detailed information about the failover
association. For information, see Monitoring Failover Associations on page 1183.
In addition, you can do the following:
• Click the Export button to export the list of failover associations to a file in CSV format.
• Click the Refresh button to refresh the data in the list.

DHCP Statistics
The DHCP Statistics widget displays statistics about the different types of DHCP messages that a Grid member sends
and receives. The widget displays the totals for each type of DHCP message as well as a line graph that tracks the
messages per second.
You can add a DHCP Statistics widget to your Dashboard for each member DHCP server in the Grid. If the DHCP service
is not enabled or is offline, the widget displays a message indicating that the DHCP statistic are not available.
To configure the DHCP Statistics widget, click the Configure icon and do the following:
• Protocol: Select either IPv4 or IPv6.
• Click Select Member. In the Member Selector dialog box, select a Grid member from the list.
• Graph Configuration: This section lists IPv4 or IPv6 messages, depending on the protocol you selected.
• Select which IPv4 messages you want to track in the Messages per Second graph.
— Discovers: The number of DHCPDISCOVER messages that the Grid member received from DHCP clients. A
DHCP client broadcasts a DHCPDISCOVER message to obtain an IP address.
— Offers: The number of DHCPOFFER messages that the Grid member sent to DHCP clients. If the Grid member
has an IP address that it can allocate to the DHCP client that sent the DHCPDISCOVER message, the Grid
member responds with a DHCPOFFER message that includes the IP address and configuration information.
— Requests: The number of DHCPREQUEST messages that the Grid member received from DHCP clients. A
DHCP client sends DHCPREQUEST messages when it selects a lease, connects to the network, and if it
renews the lease.
— Acks: The number of DHCPACK messages that the Grid member sent to DHCP clients. When the Grid
member receives a DHCPREQUEST message, it responds with a DHCPACK message to confirm the IP address
selected by the DHCP client.
— Nacks: The number of DHCPNACK messages that the Grid member sent to DHCP clients. The Grid member
sends a DHCPNACK message when a DHCP client requests an IP address that is not valid for the network.
— Declines: The number of DHCPDECLINE messages that the Grid member received. A DHCP client sends a
DHCPDECLINE message to a DHCP server when it discovers that the IP address offered by a DHCP server is
already in use.
— Informs: The number of DHCPINFORM messages that the Grid member received. A client that did not receive
its IP address from the DHCP server can send it a DHCPINFORM message to retrieve configuration
parameters, such as the IP addresses of DNS servers in the network.
— Releases: The number of DHCPRELEASE messages that the Grid member received. A DHCP client sends a
DHCPRELEASE message when it terminates its lease and releases its IP address.
Select which IPv6 messages you want to track in the Messages per Second graph.
— Declines: The number of Decline messages that the Grid member received. A DHCP client sends a Decline
message to a DHCP server when it discovers that the IP address offered by a DHCP server is already in use.
— Renews: The number of Renew messages that the Grid member received. A DHCP client sends a Renew
message to a DHCP server to extend the lifetimes on the leases granted by the DHCP server and to update
other properties.

150 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

— Information Requests: The number of Information-Request messages that the Grid member received. A
client sends an Information-Request message to retrieve configuration parameters, such as the IP
addresses of DNS servers in the network.
— Solicits: The number of Solicit messages that the Grid member received, including Solicit messages
embedded in Relay-Forward messages. A DHCP client sends a Solicit message to locate DHCP servers.
— Requests: The number of Request messages that the Grid member received. A DHCP client sends a Request
message to request one or more IP addresses and configuration parameters from a DHCP server.
— Rebinds: The number of Rebind messages that the Grid member received. A DHCP client sends a Rebind
message to extend the lifetime of its lease and to update configuration parameters.
— Releases: The number of Release messages that the Grid member received. A DHCP client sends a Release
message when it terminates its lease and releases its IP address.
— Advertises: The number of Advertise messages that the Grid member sent. When a DHCP server receives a
Solicit message, it can respond with an Advertise message to indicate that the server is available for DHCP
service.
— Replies: The number of Reply messages that the Grid member sent. A DHCP server sends a Reply message
that includes IP addresses and configuration parameters when it responds to Solicit, Request, Renew or
Rebind message. It sends a Reply message with configuration parameters only when it responds to an
Information-Request message.
The widget displays the following information:
• DHCP Messages tab: Displays a pie chart and the totals for each type of DHCP message. It also displays the
number of Deferred Updates, which are DDNS update requests which are deferred because the DNS primary
was not reachable when the update was first attempted.
• Messages per Second tab: Displays a line graph that tracks the DHCP messages that were sent and received per
second, within an hour. The time is displayed according to the time zone specified in the User Profile. If the
auto-detect time zone option is enabled and Grid Manager cannot determine the browser time zone, then the
time is displayed in UTC format. You can mouse over the graph to display the coordinates of any point in the
graph.

Network Statistics
The Network Statistics widget provides information about IP address usage in an IPv4 network. You can monitor
several networks simultaneously to view the distribution of address resources. Such information can indicate if there
is a sufficient number of available addresses in each network. It can also provide information about the distribution
of address resources, indicating if there are too many unused addresses in one network while all the addresses in
another are in use.
Add a Network Statistics widget to your Dashboard for each network that you want to monitor. You can monitor IPv4
networks only.
To configure the Network Statistics widget, click the Configure icon and do the following:
• Select one of the following chart types:
— Pie
— Bar
• Click Select Network. In the Network Selector dialog box, choose a network from the list and click Select.
Note that if multiple network views were previously configured, Grid Manager displays the default network view.
You can choose another network view from the drop-down list, and then select a network.
The Network Statistics widget displays the following information about the selected network:
• IPAM Utilization: When you define a network, this is the percentage based on the IP addresses in use divided by
the total addresses in the network. For example, in a /24 network, if there are 25 static IP addresses defined
and a DHCP range that includes 100 addresses, the total number of IP addresses in use is 125. Of the possible
256 addresses in the network, the IPAM utilization is about 50% for this network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 151

Dashboards

When you define a network container that contains subnets, this is the percentage of the total address space
defined within the container regardless of whether any of the IP addresses in the subnets are in use. For
example, when you define a /16 network and then 64 /24 networks underneath it, the /16 network container is
considered 25% utilized even when none of the IP addresses in the /24 networks is in use.
You can use this information to verify if there is a sufficient number of available addresses in a network. The
IPAM utilization is calculated approximately every 15 minutes.
• Unmanaged: The number of discovered IP addresses that do not have corresponding records on the appliance,
such as A records, PTR records, fixed address records, host records, or leases. To obtain this data, you must run
a discovery process on the network first.
• Conflicts: The number of IP addresses that have either a MAC address conflict or a DHCP range conflict. To
obtain this data, you must run a discovery process on the network first. A discovered host has a MAC address
conflict when its MAC address is different from that specified in its fixed address, DHCP lease, or host record. A
discovered host has a DHCP range conflict when it is part of a DHCP range, but it does not have a matching fixed
address or DHCP lease, and it is not part of an exclusion range.

Network Users - Active Users

The Network Users - Active Users widget displays up to 10 active users for Windows devices managed by the Grid. To
modify the Network Users - Active Users widget, click the Configure icon and select one of the following:
• Only show networks with: Select At least or Fewer than from the drop-down list and specify the number of users
in the Users field. The default values are set to At least and 10 users.
• All Network Views: Select this to monitor active users on the managed Active Directory domains in all network
views.
• Select Network View: Click Select to select the network view in which you want to monitor active users.
The Network Users - Active Users widget displays the following information:
• Network: The network address. You can click the network link to view network details.
• Active Users: All users who are currently using the Active Directory domains.
You can also export the list to a .csv file.

IPv4 Networks Over Threshold

The IPv4 Networks Over Threshold widget enables you to monitor IPv4 network and IP address usage from your
Dashboard. It lists the IPv4 networks that are allocated above a specified threshold and thus might warrant your
attention. The default threshold is 75%.
For network containers, the threshold is the percentage of IP address space that has been allocated. For subnets, it
is the percentage of used addresses, except the broadcast and network addresses. The widget displays the network
containers and subnets with utilization percentages that surpass the threshold.
You can also select to view IPv4 cloud networks only if you have deployed Cloud Network Automation. For information
about this feature, see Deploying Cloud Network Automation on page 361.
To configure the Networks Over Threshold widget, click the Configure icon, and then complete the following:
• Threshold: Enter a new threshold value. The default is 75%.
• Type: Select IPAM Utilization or IPv4 DHCP Utilization. For information, see Managing IPv4 DHCP Data on page
1107.
• All Network Views: Select this to monitor threshold for IPv4 networks in all network views.
• Select Network View: Click Select to select the network view in which you want to monitor the threshold.
To view information related to cloud networks, select View Cloud Networks Only, and then select one of the following:
• All Tenants: Displays information for all tenants.
• Select Tenant: Click Select to select a specific tenant.
In addition, you can do the following in this widget:
• Click the Export button to export the list of networks that surpass the threshold to a file in CSV format.

152 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

• Click the Refresh button to refresh the data in the list.

Port Status
The Port Status widget provides a quick way to inspect the interface status for any discovered device in the network.
The widget shows an overview of all interfaces on all devices or for a single device (called the Data Scope).
Click the Configure icon to change settings for the widget.
1. You can choose a Bar or Pie chart for the Total Switch or Switch-Router chart, which shows the percentage of
ports that are operationally Active and that are operationally Down.
2. Under Data Scope, the All Devices setting allows the widget to show the total counts for all discovered network
infrastructure devices. This is the default.
3. To use the widget to display port information for a single device, such as a switch, enable the Select Device radio
button. Choose the device in the Device Selector window. The widget adjusts its reported values to the scale of
the selected device.
4. You can also choose the Media Type. to further filter port status information. Choices include: Ethernet Interface,
Layer 2 Virtual LAN, Proprietary Serial Interface, Proprietary Virtual/Internal Interface, Loopback Interface and
Tunnel Interface.
The counters in the widget include Total Switch and Switch-Router Ports, Total Down Switch and Switch-Router Ports
and Total Active Switch and Switch-Router Ports.

Discovery Status
The appliance can run an IP discovery to detect and obtain information about active hosts in specified networks. For
information about the discovery process, see IP Discovery and vDiscovery on page 617.
You can add the Discovery Status widget to your Dashboard. From this widget, you can access Discovery Manager and
configure parameters for a discovery. You can do the following from the widget:
• Start a discovery immediately. For more information about immediate discovery, see Configuring and Starting
an IP discovery on page 627.
• Schedule a discovery for a later date and time. For more information about discovery, see Scheduling IP
Discovery on page 628.
• Configure a recurring discovery. For more information about recurring discovery, see Scheduling IP Discovery on
page 628.
• Click the Start button to start a discovery process.
• Click the Pause button to temporarily pause the process.
• Click the Stop button to stop the process.
This widget displays the status of discovery tasks. If there are no active discovery tasks, the widget displays the
discovery results of the previous tasks. For information about starting and scheduling a discovery task, see
Guidelines for Starting and Scheduling IP Discovery on page 626.
After you start a discovery, the Discovery Status widget displays a status bar that indicates the discovery is in
progress. It also tracks the number of networks in an IP discovery. You can click the Refresh icon to update the
discovery status.
The widget displays the following information about the discovery process:
• Current Status: If a discovery is in progress, this field displays its current status. Otherwise, it displays the date
and time of the last discovery.
• Last Action: Displays the last operation and the admin who initiated it.
• IPv4 Device Discovery: Displays the total number of IPv4 networks and the IPv4 network and IP address range
on which the IP discovery is currently running. You can click Refresh to update this information.
The Discovery Status widget also displays the following information about the last discovery:
• Discovered: The total number of active hosts in the network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 153

Dashboards

• Managed: The number of discovered IP addresses that are managed by the NIOS appliance. These IP addresses
have an A record, PTR record, fixed address record, host record, lease, or are within a configured DHCP range.
• Unmanaged: The number of discovered IP addresses that do not have corresponding records on the appliance,
such as A records, PTR records, fixed address records, host records, or leases.
• Conflicts: The number of discovered hosts that have a MAC address conflict or are part of a configured DHCP
range, but do not have a fixed address or lease record and are not part of an exclusion range.

Advanced Discovery Status

With the correct licensing, dedicated NIOS appliances operating as Grid members can perform infrastructure device
discovery. NIOS appliances with the Discovery license operate primarily for discovery tasks and do not perform core
DNS or DHCP network functions. Discovery appliances, called Probes, collect all network device data and compile it
into a database. A separate NIOS appliance, called a Consolidator, aggregates the collected device information from
the Probes and synchronizes with the Infoblox Grid Master.
For more information about discovery and its features and requirements, see the chapter Infoblox Network Insight on
page 653 and its associated sections.
The Advanced Discovery Status widget provides several basic counts describing the general state of device discovery
within the Grid, and for networks outside the Grid being inventoried by the NIOS appliances designated for discovery.
The widget divides counters into two categories: Networks and Assets. Network counters refer to counts of managed
and unmanaged networks discovered by Probe appliances. Asset counters refer to counts of specific types of network
devices, termed Assets, which are comprised of end hosts, enterprise servers, enterprise printers, and any other
enterprise asset that exists in an end-user network segment. The widget counters include:
In the Networks category:
• Discovered: The total number of networks discovered by Probe appliances.
• Managed: The number of discovered networks that are currently managed by the NIOS Grid. These IP networks
have been converted from Unmanaged status to Managed status.
• Unmanaged: The number of discovered networks that are counted as Unmanaged by the NIOS Grid Master. After
a network is discovered and catalogued by a Probe appliance, its default state as a network is Unmanaged.
In the Assets category:
• Discovered: The total number of Assets discovered by Probe appliances.
• Managed: The number of discovered assets that are currently managed by the NIOS Grid. These devices have
been converted from Unmanaged status to Managed status.
• Unmanaged: The number of IPs with discovered data that are counted as Unmanaged by the NIOS Grid Master,
and have not been converted into a Host or a Fixed IP Address. After an Asset is discovered and catalogued by a
Probe appliance, its default state is Unmanaged.
• Conflicts: The number of discovered assets that have a MAC address conflict or are part of a configured DHCP
range, but do not have a fixed address or lease record and are not part of an exclusion range.

My Commands
The My Commands widget provides easy access to commands that you frequently use, so you can perform your tasks
without leaving the Dashboard. You can add one My Commands widget to your Dashboard.
To configure the My Commands widget, click the Configure icon and do the following:
• Select a command from the Available list and click the > arrow to move it to the Selected list. You can always
toggle the commands between the two lists. Select multiple commands by using SHIFT-click and CTRL-click.

DDNS Statistics
The DDNS Statistics widget provides information about the dynamic DNS (DDNS) updates that occur on the DNS
service of a selected Grid member. The widget displays the total number of DDNS updates that succeeded, failed, and
that were rejected. It also displays a line graph that tracks the status of the DDNS updates per second.

154 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

You can add a DDNS Statistics widget to your Dashboard for each DNS server on the Grid that accepts dynamic DNS
updates.
To configure the DDNS Statistics widget, click the Configure icon and do the following:
• Click Select Member. In the Member Selector dialog box, select a Grid member from the list.
• Graph Configuration: Select which updates you want to track in the Updates per Second graph:
— Success: The number of DDNS update requests that succeeded.
— Prerequisite Reject: The number of DDNS update requests that were rejected because the prerequisite
conditions specified in the request were not met.
— Reject: The number of DDNS update requests that were rejected by the DNS service.
— Failure: The number of DDNS update requests that failed.
The widget displays the following information:
• DDNS Updates tab: Displays totals for each type of update.
• Updates per Second tab: Displays a line graph that tracks the status of the DDNS updates. The time is displayed
according to the time zone specified in the User Profile. If the auto-detect time zone option is enabled and Grid
Manager cannot determine the browser time zone, then the time is displayed in UTC format. You can mouse over
the graph to display the coordinates of any point in the graph.

System Activity Monitor

The System Activity Monitor widget provides information about the following resources on the selected Grid member:
CPU, system memory, NIC usage, and information about VLAN interfaces. By default, the widget displays the system
activity of the Grid Master. You can add a System Activity Monitor widget to your Dashboard for each Grid member
whose resources you want to monitor.
To configure the System Activity Monitor widget, click the Configure icon and select a Grid member and the resources
that you want to track:
• Click Select Member. In the Member Selector dialog box and select a Grid member from the list.
• CPU: Select which type of CPU usage you want to track:
— User: The CPU usage of user applications, such as programs and libraries.
— System: The CPU usage of the kernel and drivers.
— Idle: The percentage of CPU that is not in use.
• System Memory: Select which portion of the system memory you want to track:
— Real Memory Used: The physical RAM usage.
— Swap Used: The swap area usage. The swap area is the disk area that temporarily holds a process memory
image.
• NIC Usage: Select how you want to measure network traffic:
— Bytes: Reports the number of bytes.
— Packets: Reports the number of packets.
• NIC Settings: Select the port on which you want to measure network traffic. If you have configured VLANs, Grid
Manager displays them in the format LAN1 nnnn or LAN2 nnnn, where nnnn represents the associated VLAN ID.
For example, a VLAN configured on LAN1 can be displayed as LAN1 297 and a LAN2 VLAN can be LAN2 21. For
more information about VLANs, see About Virtual LANs on page 444.
The System Activity Monitor widget displays a tab for each resource: CPU, System Memory, and NIC Usage.
Each tab contains a line graph that tracks the resource utilization per second. The graph in the CPU tab tracks the
percentage of CPU usage. The graph in the System Memory tab tracks the memory utilization percentage. The graph
in the NIC Usage tab tracks either bytes or packets per second.
The time is displayed according to the time zone specified in the User Profile. If the auto-detect time zone option is
enabled and Grid Manager cannot determine the browser time zone, then the time is displayed in UTC format. You
can mouse over the graph to display the coordinates of any point in the graph.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 155

Dashboards

File Distribution Statistics

The File Distribution Statistics widget enables you to monitor the status of file distributions services from the
Dashboard. The widget provides an overall status of file distribution on all members in the Grid. It also displays the
file system utilization for the file distribution subsystem.
The service status displays one of the following:
• OK: All file distribution services are running properly.
• Stopped: All file distribution services are stopped.
• Warning: The file distribution services are not running properly.
• Error: The file distribution services encounter an error.
You can click the link to view detailed information about the file distribution services. Grid Manager displays the
Members tab in the File Distribution tab.
To configure the File Distribution Statistics widget, click the Configure icon and select one of the following chart types:
• Pie
• Bar
The File Distribution Statistics widget displays the following information:
• File System Utilization: The percentage of utilization of the overall allocated file distribution subsystem space
on all members. You can use this information to verify if there is sufficient space for file distribution in the Grid.

Active WebUI Users

The Active WebUI Users widget provides information about the users who are logged in to Grid Manager or System
Manager. It does not include users who are using the Infoblox API or are logged in to the serial console.
You can add only one Active WebUI Users widget to the Dashboard. You must have a superuser account to add this
widget to the Dashboard.
It displays the following information about each user:
• User ID: The user name.
• Source Address: The IP address of the management station the user used to connect to Grid Manager.
• Logged In Since: The date and time the user logged in.
• Idle Time: The number of minutes the user has not had any activity on Grid Manager. Note that the idle session
timeout is 2 hours, so the idle time is cleared every 2 hours.
• User Agent: The system used to access Grid Manager, such as the browser version and platform information.
You can sort the columns and hide or display each one. You can also export the list to a .csv file.

Microsoft Servers Status Widget

The Microsoft Servers Status widget displays the operational status of each Microsoft server managed by the Grid.
Grid Manager displays this widget only when at least one member in the Grid has a Microsoft management license.
You can configure this widget to display the status of all Microsoft servers or only those with warnings and errors. You
can also view the monitor and control status for the DNS and DHCP service on the Microsoft server. To modify the
Microsoft Servers Status widget, click the Configure icon and select one of the following:
• Show all Microsoft servers
• Only show servers with service warnings or errors
The Microsoft Servers Status widget displays the following information about each Microsoft server:
• Server Name: The hostname of the Microsoft server.
• IP Address: The IP address of the Microsoft server.
• Status: The connection status of the Microsoft server.
— OK: The Grid member is connected to the Microsoft server.

156 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

— Connecting: The Grid member is connecting to the Microsoft server.

— Error: The Grid member tried to connect to the Microsoft server, but failed. You can check the syslog for any
messages.
— Not Available: The Microsoft server is disabled. The Grid member does not try to connect to disabled
servers.
• DNS: The status of the DNS service on the Microsoft server.
The DNS service status can be one of the following:

Icon Color Meaning

Green The DNS service is functioning properly.

Red The Microsoft server is unavailable.

Yellow The DNS service is starting or stopping.

Gray The DNS service is stopped or management of the Microsoft DNS server is disabled.

• DHCP: The status of the DHCP service on the Microsoft server.

The DHCP service status can be one of the following:

Icon Color Meaning

Green The DHCP service is functioning properly.

Red The Microsoft server is unavailable.

Yellow The DHCP service is starting or stopping.

Gray The DHCP service is stopped or management of the Microsoft DHCP server is disabled.

• Active Directory Sites: The status icon in green indicates the synchronization status of Active Directory Sites on
the Microsoft server.
• Enable DNS Monitor & Control: Displays Yes if the monitor and control status is enabled for the DNS service on
the Microsoft server and displays No if it is disabled.
• Enable DHCP Monitor & Control: Displays Yes if the monitor and control status is enabled for the DHCP service
on the Microsoft server and displays No if it is disabled.

CSV Import Manager

The CSV Import Manager on the Status Dashboard displays the status of CSV import jobs you have submitted. You
can start a file import from CSV Import Manager and control and monitor it from this widget. You can also launch CSV
Import Manager from the Task Dashboard or the Toolbar. You can also delete uploaded CSV files. For more
information, see About CSV Import on page 101. You can click the Refresh icon or configure auto refresh to update
the status.
The widget displays the following information about the import jobs that were submitted in the past 30 days:
• User Name: The admin user who submitted the CSV import. Only superusers can view this column.
• Status: The current status of the import job. The status can be one of the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 157

Dashboards

— Import successful: The import is completed without errors. Check the Message field for information
about the import.
— Import unsuccessful: The import is completed, but with errors. Check the Message field for information
about the error message.
— Import pending: The job is in queue for execution.
— Import in progress: The job is being executed.
— Import stopped: The job has been stopped. You can select the job and restart the import.
— Test successful: Test is completed without errors. Check the Message field for information about the
test.
— Test unsuccessful: Test is completed, but with errors. Check the Message field for information about the
error message.
— Test pending: Test is in queue for execution.
— Test in progress: Test is in progress.
— Test stopped: Test has been stopped. You can select the job and restart the import.
— Saved file: The data file has been uploaded, but the import has not started.

Note: After a product restart, which can be caused by a failover, all Import in progress jobs go into Import
stopped state; all Import pending jobs continue to be queued for execution.

• Submitted: The timestamp when the job was submitted.

• Completed: The timestamp when the job was completed. This field is blank if the job has not been completed
yet.
• File Name: The CSV data file name.
• Message: This field displays the number of rows of data that has been processed and the number of rows of
data the import has detected errors. Depending on the import options, Grid Manager displays the row number
at which it stops the import when it encounters an error, or the total number of rows it has processed by
skipping over the erroneous data. For example, if there are 100 rows of data and you select “On error: Stop
importing,” and there is an error in row 90, the appliance displays 90 of 100 completed, 1 error. If you select
“On error: Skip to the next row and continue,” the appliance displays 100 of 100 completed, 1 error.
• File Size: The CSV data file size.

Note: Superusers can view all CSV import jobs and limited-access users can view only the jobs they submitted.

Load Balancer Status

The Load Balancer Status widget displays the operational status of GLBs (Global Load Balancers) managed by the
Grid. Grid Manager displays this widget only when at least one member in the Grid has a Load Balancer license. You
can configure this widget to display the status of all GLBs or only those with warnings and errors. To modify the Load
Balancer Status widget, click the Configure icon and select one of the following:
• Show all Load Balancers
• Only show servers with service warnings or errors
The Load Balancer Status widget displays the following information about each load balancer:
• Name: The name of the load balancer.
• IP Address or FQDN: The IP address or FQDN of the load balancer.
• Version: The TMOS version that is running on the load balancer.
• Status: The connection status of the GLB.
— OK: The Grid member is connected to the GLB.
— Unknown: The Grid member is unable to contact the GLB and cannot retrieve any status details. This can be
caused by incorrect IP address, FQDN, username, or password.

158 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

— Error: The GLB has a connection error. Click the Detailed Status icon to view detailed information or check
the syslog for any error messages.
— Warning: Certain issues, such as Grid member failures or licensing issues, have occurred. Click the Detailed
Status icon to view detailed information or check the syslog for messages to determine the reason for the
warning.
— Disabled: The load balancer is disabled. The Grid member does not try to connect to disabled GLB.

Pending Approvals
The Pending Approvals widget provides information about tasks that are pending your approvals. Add the Pending
Approvals widget to your Dashboard to monitor tasks that require your approvals.
You can select a task and perform the following:
• Click the Approve icon to approve the task.
• Click the Reject icon to disapprove the task.
You can also click Task Manager to access the Administration tab -> Workflow tab -> Task Manager tab.
The Pending Approvals widget displays the following information about each task that requires your approval:
• Task ID: The ID associated with the task. The appliance assigns an ID to a task in chronological order.
• Submitter: The username of the admin who scheduled or submitted the task.
• Ticket Number: The reference number entered by the submitter to identify the task. You can enter up to 20
alphanumeric characters.
• Scheduled Time: The date, time, and time zone when the task was scheduled for execution.
• Affected Object: The name or value of the object that is associated with the task. For example, if the task
involves an A record, this field displays the domain name of the record. If it is a fixed address, it displays the IP
address of the fixed address.
• Object Type: The object type. For example, the appliance can display A Record or Fixed Address.
• Action: The operation the appliance performs in this task. The can be: Add, Modify, Delete, or Network
Discovery.
• Submitted Time: The date, time, and time zone when the task was submitted. You can select this for display. It
is not displayed by default.

Infoblox Community
The Infoblox Community widget displays the latest news from Infoblox. It provides links to video clips that show you
how to perform certain tasks, such as how to prepare for IPAM Express and how to add a network. You can click
available links in the widget to get more information about Infoblox products and solutions.
Note that content in the Infoblox Community widget may not be displayed in certain versions of Mozilla FireFox,
Google Chrome, and Microsoft Internet Explorer due to restrictions these browsers use to block certain secure data.
Follow these steps to unblock the Infoblox Community widget and view data in your respective browser:
• Mozilla FireFox: Click the Shield icon in the address bar and choose Disable Protection on This Page from
the drop-down list. The icon in the address bar changes to a warning triangle and content is displayed in the
Infoblox Community widget. For more details, refer to information at
https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/.
• Google Chrome: Click the Shield icon in the address bar and click Load unsafe script in the pop-up box.
Chrome automatically refreshes the webpage and loads the content in the Infoblox Community widget. For more
details, refer to information at https://support.google.com/chrome/answer/1342714?hl=en.
• Internet Explorer: Click the Compatibility View icon adjacent to the address bar. The browser refreshes and
the Security Warning dialog box is displayed. Click No in the dialog box. The Only Secure content is displayed
pop-up blocker is displayed at the bottom of the browser. Click the Show all content button in this pop-up
blocker to view the content. For more details, refer to the information at
http://windows.microsoft.com/en-in/internet-explorer/use-compatibility-view#ie=ie-8.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 159

Dashboards

Mobile Devices Status

The Mobile Devices widget provides information about the number of active leases of the DHCP fingerprint devices
managed by the Grid. The widget displays a pie chart indicating the number of active leases in percentile for each of
the device category. For information about device category, device class, and device type, see Table 2.2. You can click
the Refresh icon or configure auto refresh to update the status.

Note: The Mobile Devices widget updates its data every 15 minutes. A device might not be displayed in this widget
if its lease expires within 15 minutes.

To configure the Mobile Devices widget, click the Configure icon and do the following:
• Click Select Network View. In the Network View Selector dialog box, select a network view from the list and click
OK.
Note that if multiple network views were previously configured, Grid Manager displays the default network view.
You can select another network view from the Network View Selector dialog box.
The widget displays the number of active leases for the following device classes:
• Mac OS - Displays all devices that were detected to be running Mac OS.
• Windows - Displays all devices that were detected to be running Windows.
• Android Mobile - Displays Smartphones/PDAs/Tablets that were detected to be running Android.
• Apple Mobile - Displays Smartphones/PDAs/Tablets that were detected to have Apple in the DHCP fingerprint
information.
• No Match - Displays all devices whose fingerprint information does not match with any of the standard/custom
DHCP fingerprint data stored in the appliance. For information about Standard and Custom DHCP Fingerprints,
see Standard and Custom DHCP Fingerprints on page 1359.
• Other - Displays all devices that belong to a device class other than those listed above.

Table 2.2 List of device types and classes

Category Device Class Device Type

Windows Windows Microsoft Windows 2000
Microsoft Windows 2003
Microsoft Windows 8
Microsoft Windows Vista/7 or Server 2008
Microsoft Windows XP
Mac OS Macintosh Apple Mac OS 9
Apple Mac OS X, TV (HD)
Apple Mobile Smartphones/PDAs/Tabl Apple iPod
ets
Apple iPod, iPhone, iPad or TV (SD)

160 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

Category Device Class Device Type

Android Mobile Smartphones/PDAs/Tabl Android Phone/Tablet (Generic)
ets
Android Phone/Tablet (HTC, older devices)
Android Phone/Tablet (Motorola, older devices)
Android Phone/Tablet (Sony Ericsson, older
devices)
Android Phone/Tablet (Unknown devices)
Android Phone/Tablet (Vizio tablet, Others)
Android Phone/Tablet (newer devices)
Android tablets (Samsung, Others)

ZTE N9120 Android

DNS Integrity Check

The DNS Integrity Check widget displays status about DNS data discrepancies that have been detected through DNS
integrity check that is designed to mitigate DNS domain hijacking. This widget displays top-level or parent
authoritative zones that have been selected for DNS data monitoring. For information about how to configure DNS
integrity check to mitigate possible DNS domain hijacking, see About DNS Integrity Check for Authoritative Zones on
page 836.
The widget displays the following information (note that this table is sorted by Status.):
• : Left click the Action icon next to a zone to perform the following:
— View Syslog: Select this to open the Syslog Preview dialog and view data discrepancy events for the
selected zone. For more information, see Previewing Syslog Events on page 162.
— Check Now: Select this to perform DNS integrity check to immediately query current DNS data from the
top-level parent domain. When you select this, verbose logging for DNS integrity check is automatically
enabled. After the operation is complete, the appliance updates the timestamp for the Last Checked
column.
• Zone: Displays the name of the top-level authoritative zones that is being monitored for DNS integrity check.
You can click the zone name and the appliance opens the zone viewer for the selected zone.
• Status: Displays the current DNS data discrepancy status. The status can be one of the following:
— Critical (red): Data in the NS RRsets for the authoritative and delegate zones are completely out of
synchronization.
— Severe (orange): Some data in the NS RRset between the authoritative and delegate zones overlaps and
some data is different.
— Warning (yellow): The NS RRset for the authoritative zone is a subset of the NS RRset for the delegate zone.
It is possible that incorrect IP addresses have been entered at the registrar.
— Informational (blue): The NS RRset for the delegate zone is a subset of the NS RRset for the authoritative
zone. This could indicate a possible delay in domain registration.
— Normal (green): There are no DNS data discrepancies between the NS RRsets for the authoritative and
delegated zones.
— None (black): No DNS discrepancies data has been collected or DNS integrity check has not been
performed.
• Last Checked: The timestamp in YYYY-MM-DD HH:MM:SS when the parent domain was last queried for its DNS
data.
• Description: Information about the zone.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 161

Dashboards

Previewing Syslog Events

When you select View Syslog from the DNS Integrity Check widget for a selected zone, the Syslog Preview dialog is
displayed. You can view related syslog events for the selected zone in this dialog, as follows:
• Timestamp: The timestamp in YYYY-MM-DD HH:MM:SS when the event was logged.
• Facility: The location that determines the processes and daemons from which the log messages are generated.
• Level: The severity level of the DNS data discrepancies. This can be Critical, Severe, Warning, Information, or
Normal. For more information, see descriptions for the Status field.
• Server: The name of the Grid member that performed the data check.
• Message: Syslog information about the event. If you have enabled verbose logging, this displays detailed
information about the event. For information about how to enable verbose logging, see Configuring DNS
Integrity Check on page 836.
You can also click Go to Syslog Viewer on the upper right corner of the dialog to view all events in the syslog. For more
information about the syslog, see Viewing the Syslog on page 1341.

Cloud Statistics
The Cloud Statistics widget appears only when you have deployed the Cloud Network Automations license on the Grid
Master. This widget displays statistical information for cloud objects. It contains the following tabs: Tenant & VMs,
Fixed vs. Floating and Available vs. Allocated. You must install valid cloud related licenses to access this widget. For
more information about installing licenses and enabling Cloud Network Automation, see Deploying Cloud Network
Automation on page 361.
To modify the Cloud Statistics widget, click the Configure icon and select one of the following:
• Show Statistics From:
— All Tenants: Select this to display statistics for all tenants.
— Select Tenant: Click Select to choose a specific tenant for which statistics are displayed.
• Show:
— All IP Addresses: Select this to display all IP address allocation for all tenants or the tenant of your choice.
— Fixed: Select this to display only fixed IP address allocation for all tenants or the tenant of your choice. Fixed
IP addresses correspond to OpenStack Fixed IP Addresses.
— Floating: Select this to display only floating IP address allocation for all tenants or the tenant of your choice.
Floating IP addresses correspond to OpenStack Floating IP Addresses.

Security Status for Grid

The Security Status for Grid widget displays the overall status of Threat Protection, RPZ (Response Policy Zone), and
DNS Threat Analytics services on the Grid members that support Infoblox External DNS Security and Infoblox Internal
Security. Grid Manager displays this widget only when at least one member in the Grid has the Threat Protection, RPZ,
or Threat Analytics license installed. You can add this widget to the Security dashboard to monitor the overall security
status of the Grid. The statistics displayed in this widget are cumulative, collected from all the Grid members that
support Infoblox External DNS Security and Infoblox Internal Security. This widget displays data for the last 30
minutes. The overall status of Threat Protection, RPZ, and DNS Threat Analytics is determined by the threshold values
configured in the Global Dashboard Properties editor. For information, see Configuring Security Status Thresholds on
page 144.

Note: If the Threat Protection license is not installed on any of the Grid members, Grid Manager does not display any
threat protection related information in this widget. Similarly, if the RPZ license is not installed on any of the
Grid members, Grid Manager does not display RPZ and DNS Threat Analytics related information in this widget
and if the Threat Analytics license is not installed on any of the Grid members, Grid Manager does not display
DNS Threat Analytics related information in this widget.

The widget displays the following information for Threat Protection, RPZ, and DNS Threat Analytics:

162 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

• Status: It displays the overall status of the security service in the Grid based on the events collected from all the
members that support Infoblox External DNS Security and Infoblox Internal Security. It represents the status of
the most critical member in the Grid.
The status icon can be one of the following for the Threat Protection, RPZ, and DNS Threat Analytics service:
— OK (Green): The license for the security service is installed and the security service is running. The rulesets
for the security service are available and the number of events triggered are less than the yellow and red
threshold values configured in the Global Dashboard Properties editor for the corresponding security
service.
— Warning (Yellow): The license for the security service is installed and the security service is running. The
rulesets for the security service are available and the number of events triggered for any of the parameters
equals or exceeds the yellow threshold value, but less than the red threshold value configured in the Global
Dashboard Properties editor for the corresponding security service.
— Critical (Red): The license for the security service is installed and the security service is running. The
rulesets might not be available or the number of events triggered for any of the parameters, equals or
exceeds the red threshold value configured in the Global Dashboard Properties editor for the corresponding
security service.
— Not Setup (Black): The license for the security service is installed, but the security service is not running.
— Unknown (Black): The data is not available from the Grid member.
You can hover your mouse over the Threat Protection status icon and view the Threat Protection Status for Grid
widget. For information about Threat Protection Status for Grid widget, see Threat Protection Status for Grid on
page 165.
• Events from <> of <> security capable members: This column displays the cumulative event counts collected from
the online Grid members that support the Infoblox External DNS Security and Infoblox Internal Security.
— Threat Protection: Displays the total threat protection event counts for the following severity levels:
— Critical (Red): The total number of critical events.
— Major (Orange): The total number of major events.
— Warning (Yellow): The total number of warning events.
— Informational (Blue): The total number of informational events.
— RPZ: Displays the total number of hits received for the following RPZ rules:
— Blocked hits (Red): Total number of queries that triggered a Block (No Data) or Block (No Such Domain)
RPZ rule.
— Passthru hits (Yellow): Total number of queries that triggered a Passthru RPZ rule.
— Substituted hits (Orange): Total number of queries that triggered a Substitute (Domain Name) or
Substitute (Record) RPZ rule.
— Analytics: Displays the total number of DNS tunneling events.
• Definitions/Rules: This column displays the status of the latest ruleset available in the database. For RPZ, the
definition status is based on the latest RPZ feed received from Infoblox specific feeds. You can hover your
mouse over the definition status to see the RPZ definition status when RPZ definitions exists.
• Configuration Status: This column indicates whether the security service is enabled and running properly or not.
Grid manager displays a green check mark if the security service is enabled and running properly in the Grid. If
the security service is disabled, a gray pause mark is displayed. You can hover your mouse over the gray pause
mark to see the status of the security service.
In addition, you can click the Configure icon and do the following:
• Click Configure Security Status Thresholds to configure the thresholds for the security status of the Grid. In the
Global Dashboard Properties editor, you can define the threshold values for Threat Protection, RPZ, and DNS
Threat Analytics. For information, see Configuring Security Status Thresholds on page 144.
• Select the Auto Refresh Period check box to turn on auto-refresh and specify the auto-refresh period in seconds.
The default auto-refresh period is 30 seconds.
Click the Configure icon again to hide the configuration panel after you complete the modification.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 163

Dashboards

Security Status for All Members

The Security Status for All Members widget displays information about the status of all the Grid members that support
Infoblox External DNS Security and Infoblox Internal Security. Grid Manager displays this widget only when at least
one member in the Grid has the Threat Protection or RPZ license. You can add this widget to the Security dashboard
to monitor the status of the Grid members that support Infoblox External DNS Security and Infoblox Internal Security.

Note: When an HA Grid Master fails over, the new active node re-collects data from all the Grid members. Hence, it
might take a few seconds until the data is displayed in the Security dashboard. When an HA Grid member fails
over, the Grid Master stops collecting data from the HA member.

The Security Status for All Members widget displays the following information:
• Overall Status: The current overall security status of the members that support Infoblox External DNS Security
and Infoblox Internal Security. This can be OK, Warning, Critical, or Unknown.
The security status for a member might be Unknown if NTP service is out of synchronization for the member.
Hence, to ensure that the correct data is displayed for the member, use NTP to synchronize the time of the
member with that of the Grid Master.
• Member: The name of the member. You can hover your mouse over the member name and view the Member
Status widget. For information about the Member Status widget, see Member Status (System Status) on page
147.
• IPv4 Address: The IPv4 address of the member.
• IPv6 Address: The IPv6 address of the member.
• Threat Protection Status: The status of the threat protection service running on the member. This can be either
OK, Warning, Critical, Not Setup, or Unknown. You can hover your mouse over the threat protection status and
view the Threat Protection Status for Member widget. For information about the Threat Protection Status for
Member widget, see Threat Protection Status for Member on page 166.
• RPZ Status: The status of the RPZ service running on the member. This can be either OK, Warning, Critical, Not
Setup, or Unknown. You can hover your mouse over the RPZ status and view the Response Policy Zone (RPZ)
Statistics widget. For information about the Response Policy Zone (RPZ) Statistics widget, see Response Policy
Zone (RPZ) Status for Member on page 169.
• Analytics Status: The status of the DNS Threat Analytics service running on the member. This can be either OK,
Warning, Critical, Not Setup, or Unknown.
You can also do the following in this widget:
• Turn on auto-refresh. Click the Configure icon and select the Auto Refresh Period check box to turn on
auto-refresh. Specify the auto-refresh period in seconds. The default auto refresh period is 30 seconds.
• Click the Action icon (shown as a gear in each row of the table) next to the overall status of each member,
and select View Syslog to view all the events logged in the syslog. Grid Manager displays the syslog messages
in the Syslog Preview window.
• Click the Export icon to export the data displayed in this widget.
• Click the Print icon to print the data displayed in this widget.
• Click Response Policy Zones link in the Go To field at the top of the widget to view the RPZs configured on the
member. Grid Manager displays the Response Policy Zones tab in the DNS tab. To navigate back to the Security
dashboard, click Back to Security Dashboard at the top left corner of the navigation bar in the Response Policy
Zones tab.
• Click Threat Protection link in the Go To field at the top of the widget to view the threat protection rulesets
configured on the member. Grid Manager displays the Threat Protection Rules tab in the Security tab. To
navigate back to the Security dashboard, click Back to Security Dashboard at the top left corner of the
navigation bar in the Threat Protection Rules tab.
• Click Members link in the Go To field at the top of the widget to view the members configured in the Grid. Grid
Manager displays the Members tab in the Grid Manager tab. To navigate back to the Security dashboard, click
Back to Security Dashboard at the top left corner of the navigation bar in the Members tab.

164 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

Threat Protection Status for Grid

The Threat Protection Status for Grid widget displays the statistical information about the threat protection events
triggered on all the members in the Grid that support Infoblox External DNS Security and Infoblox Internal Security.
This widget contains the following tabs: Total Events by Severity, Top 10 Grid Members, Events Over Time, Top 10
Rules, and Top 10 Clients.
You can do the following in this widget:
• Turn on auto-refresh.
— Click the Configure icon, select the Auto Refresh Period check box, and specify the refresh period in
seconds. The default auto refresh period is 30 seconds.
You can click the Configure icon again to hide the configuration panel.
• Click the Total Events by Severity tab to view information about threat protection related events by the severity
level. For information, see Total Events by Severity on page 165.
• Click the Top 10 Grid Members tab to view information about the top 10 Grid members that have the most
number of threat protection events. For information, see Top 10 Grid Members on page 165.
• Click the Events Over Time tab to view information about the total event count for each type of event severity in
the given time frame. For information, see Events Over Time on page 166.
• Click the Top 10 Rules tab to view information about the top 10 threat protection rules with the most number of
hits. For information, see Top 10 Rules on page 166.
• Click the Top 10 Clients tab to view information about the top 10 clients that have the most number of threat
protections events. For information, see Top 10 Clients on page 166.

Total Events by Severity

The Total Events by Severity tab displays statistics about the Threat Protection events for each type of event severity.
This tab displays a bar chart that lists the total event counts for each severity level. Each severity level is represented
by a different color. The event statistics are cumulative, collected from all the members in the Grid that support
Infoblox External DNS Security and Infoblox Internal Security.
This line graph displays the event counts for the following severity levels:
• Critical (Red): The total number of critical events.
• Major (Orange): The total number of major events.
• Warning (Yellow): The total number of warning events.
• Informational (Blue): The total number of informational events.
If you have configured a reporting member in the Grid, the Go To History link is displayed in this tab. You can click Go
To History to view the Threat Protection Event Count By Severity Trend report in the Reporting tab. To navigate back to
the Security dashboard from the Reporting tab, click Back to Security Dashboard at the top left corner of the
navigation bar in the Reporting tab.

Top 10 Grid Members

The Top 10 Grid Members tab displays a stacked bar chart that tracks the top Grid members with the most total counts
of threat protection events. Each severity level is represented with a different color. The report displays the top 10
members in descending order.
If you have configured a reporting member in the Grid, the Go To History link is displayed in this tab. You can click Go
To History to view the Threat Protection Event Count By Member/Member Group Trend report in the Reporting tab. To
navigate back to the Security dashboard from the Reporting tab, click Back to Security Dashboard at the top left
corner of the navigation bar in the Reporting tab.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 165

Dashboards

Events Over Time

The Events Over Time tab displays a line graph that tracks the event count for each event severity in a given time
frame. You can view the event counts for the following severity level: Critical, Major, Warning, and Informational. The
event statistics are cumulative, collected from all the members in the Grid that supports Infoblox External DNS
Security and Infoblox Internal Security. Each severity level is represented with a different color.
If you have configured a reporting member in the Grid, the Go To History link is displayed in this tab. You can click Go
To History to view the Threat Protection Event Count By Severity Trend report in the Reporting tab. To navigate back to
the Security dashboard from the Reporting tab, click Back to Security Dashboard at the top left corner of the
navigation bar in the Reporting tab.

Top 10 Rules
The Top 10 Rules tab displays a horizontal bar chart that tracks the top threat protection rules that have the most
number of hits. Each severity level is represented with a different color. The report displays the top 10 rules in
descending order.
If you have configured a reporting member in the Grid, the Go To History link is displayed in this tab. You can click Go
To History to view the Threat Protection Top Rules Logged report in the Reporting tab. To navigate back to the Security
dashboard from the Reporting tab, click Back to Security Dashboard at the top left corner of the navigation bar in the
Reporting tab.

Top 10 Clients
The Top 10 Clients tab displays a horizontal bar chart that tracks the total number of threat protections events
triggered by top clients (source IP addresses). This tab displays the IP addresses of the top 10 clients. For NAT clients,
it displays the NAT addresses for the clients.
If you have configured a Reporting member in the Grid, the Go To History link is displayed in this tab. You can click Go
To History to view the Threat Protection Top Rules Logged by Source report in the Reporting tab. To navigate back to
the Security dashboard from the Reporting tab, click Back to Security Dashboard at the top left corner of the
navigation bar in the Reporting tab.

Note: The data displayed in this widget may not be consistent with the data displayed in the Threat Protection Top
Rules Logged by Source report.

Threat Protection Status for Member

The Threat Protection Status for Member widget displays statistics about the threat protection events for a specific
Grid member that supports Infoblox External DNS Security. For information about the threat protection feature, see
About Infoblox External DNS Security on page 1563.
To configure the Threat Protection Status for Member widget, click the Configure icon and complete the following:
• Click Select Member. In the Member Selector dialog box, select a Grid member from the list that supports
Infoblox External DNS Security.
• Select either Dial or Bar as the display format for the following resources: Smart NIC CPU, Traffic being dropped,
Traffic being received.
• SNIC Settings: Select the interface for which you want to view the interface usage information. You can select
one of the following from the drop-down list: HA, LAN1, or LAN2. You can view the interface usage information
for the selected interface in the Interface Usage tab.
Note that you can select the HA port even though the Grid member is not an HA pair, because the HA port on a
single member can be exposed to potential attacks.
• Events Over Time: Select the severity level, Critical, Major, Warning, or Informational, to view the details for a
specific severity level. You can select one or all the available severity levels.
• Select the Auto Refresh Period check box to turn on auto-refresh, and specify the auto-refresh period in
seconds. The default is 30 seconds.

166 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

Click the Configure icon again to hide the configuration panel after you complete the modification.
You can do the following in this widget:
• Click the Summary tab to view the statistics for the following resources in the format you selected:
— Smart NIC CPU: The percentage of Smart NIC CPU that is in use.
— Traffic being dropped: The percentage of traffic dropped. It is displayed for both LAN1 and LAN2 interfaces.
— Traffic being received: The percentage of traffic received. It is displayed for both LAN1 and LAN2 interfaces.
• Click the Events Over Time tab to view information about the threat protection event counts for each severity
level over the given time frame. It displays line graphs that show the threat protection event counts for each
event severity over the last 30 minutes. Each event severity is represented by a different color line graph. You
can hover your mouse over the graph to view the coordinates of any point in the graph. You can also click the
Events Over Time legend and use it as a filter to view the graph for specific severity level.
• Click the Top 10 Rules tab to view information about the threat protection rules that have the most number of
hits. It displays a bar chart to track the top 10 threat protection rules with the most number of hits for critical,
major, and warning severity levels. Each event severity is displayed in a different color.
If you have configured a Reporting member in the Grid, the Go To History link is displayed in this tab. You can
click Go To History to view the Threat Protection Top Rules Logged report in the Reporting tab. To navigate back
to the Security dashboard from the Reporting tab, click Back to Security Dashboard at the top left corner of the
navigation bar in the Reporting tab.
• Click the Top 10 Clients tab to view information about the top sources (client IP addresses) that triggered threat
protection rules. It displays a bar chart to track the top 10 clients with the most number of hits.
If you have configured a Reporting member in the Grid, the Go To History link is displayed in this tab. You can
click Go To History to view the Threat Protection Top Rules Logged by Source report in the Reporting tab. To
navigate back to the Security dashboard from the Reporting tab, click Back to Security Dashboard at the top left
corner of the navigation bar in the Reporting tab
• Click the Interface Usage tab to view information about the interface usage (in megabytes per second) over a
given time frame. It displays line graphs that show the interface usage trends for the selected interface over the
last 30 minutes. You can hover your mouse over the graph to view the coordinates of any point in the graph.
• Click the Smart NIC CPU tab to view the information about the percentage of CPU usage over a given time frame.
It displays line graphs that show the CPU usage trends over the last 30 minutes. You can hover your mouse over
the graph to view the coordinates of any point in the graph.

Response Policy Zone (RPZ) Status for Grid

The Response Policy Zone (RPZ) Status for Grid widget provides statistical information about RPZ hits for the Grid. This
widget contains the following tabs: Top 10 Grid Members, RPZ Recent Hits, Trend and Health.
You can do the following in this widget:
• Select a graph configuration, Client Hits, Passthru Hits, Blocked Hits, or Substituted Hits, to view details of a
specific RPZ rule. You can select either one or all the available graph configurations. Note that Client Hits is
displayed only when the graph type is Line Diagram.
• Select a graph type, Stacked Diagram or Line Diagram, to display data in the required diagrammatic format. This
option is enabled only when you click the Trend tab and disabled when you click the Top 10 Grid Members, RPZ
Recent Hits, or Health tabs. For more information, see Trend on page 169.
• Click the Top 10 Grid Members tab to view information about the top 10 Grid members that have the most
number of RPZ hits. For more information, see Top 10 Grid Members on page 168.
• Click the RPZ Recent Hits tab to view information about the latest five RPZ hits with unique client addresses. For
more information, see RPZ Recent Hits on page 168.
• Click the Trend tab to view RPZ hit statistics for the Grid. For more information, seeTrend on page 169.
• Click the Health tab to view information about RPZ zones and their last updated times. For more information,
see Health on page 169.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 167

Dashboards

Note that you must install the RPZ license and enable RPZ logging to access this widget. For more information about
installing licenses and enabling RPZ logging, see License Requirements and Admin Permissions on page 1673 and
Setting DNS Logging Categories on page 1340.

Top 10 Grid Members

The Top 10 Grid Members tab displays a stacked bar chart that tracks the top Grid members with the most total counts
of RPZ hits. Each RPZ hit type is represented with a different color. The report displays the top 10 members in
descending order.

RPZ Recent Hits

The RPZ Recent Hits tab displays the data that is collected from the most recent hits of five unique clients, identified
by their IP addresses, during the last 24 hours. NIOS retrieves this data from the syslog. This tab does not display any
data when there are no syslog messages or if RPZ logging is disabled. NIOS displays an error message if RPZ logging
is disabled. For more information about enabling RPZ logging, see Setting DNS Logging Categories on page 1340.
Grid Manager retrieves recent hits from the Grid members. If a member has an RPZ license installed, then NIOS will
parse the syslog every 60 seconds to collect the data. NIOS parses the generated data to identify the five most recent
hits. It searches for these fields in the syslog message: CEF: data string(RPZ syslog) and src fields.
The NIOS appliance remembers the start and end time of previously searched operations to optimize the recent hits
data collection, so that the same data is not searched again. Note that when the same client makes repeated queries
in the last 24 hours, then there might be less than five unique client hits. You cannot sort or filter values in this tab.
This tab displays the following information:
• Client IP Address: IP address of the client that made the recent hits.
• Requested FQDN: The domain name or IP address that triggered the RPZ rule. For example, consider an RPZ rule
test.com.rpz.com, which queries for test.com. In this example, test.com is the requested FQDN.
• RPZ Entry: The RPZ rule that queried a domain name or an IP address. In the above example, test.com.rpz.com is
the RPZ rule.
• Timestamp: The date and time when the hit occurred.
Consider an example in which you query an RPZ zone and the NIOS appliance logs the following message in the
syslog:
CEF:0|Infoblox|NIOS|6.9.0-219291|RPZ-QNAME|NODATA|4|app=DNS dst=10.35.101.14
src=10.36.0.251 spt=44460 view=_default qtype=A msg="rpz QNAME NODATA rewrite w18.vg [A]
via w18.vg.fireeye.com"
This tab displays information in the corresponding fields as follows:

Fields Description
Client IP Address Data is retrieved from the src
field.
Example: 10.36.0.251
Requested FQDN It is retrieved from the data
between the rewrite and [A]
via fields. Example: w18.vg.

RPZ Entry It is retrieved from the data after

the via in msg field.
Example: w18.vg.fireeye.com
Timestamp This is listed in the syslog.

You can export data displayed in this tab by clicking the Export icon. For more information, see Exporting Displayed
Data on page 111.

168 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

Trend
The Trend tab displays statistics of RPZ hits during the last 60 minutes for the Grid. You can use a stacked graph or a
line graph to view the hits. Each of the RPZ policy is represented with a different color. This tab displays the following
information:
• Client Hits: Total number of queries that triggered an RPZ policy. Note that this option is not displayed when you
choose Stacked Diagram, but displayed only when you choose Line Diagram.
• Passthru Hits: Total number of queries that triggered a Passthru RPZ rule. For more information about passthru
rules, see Managing Passthru Rules on page 1679.
• Blocked Hits: Total number of queries that triggered a Block (No Data) or Block (No Such Domain) RPZ rule. For
more information, see Managing Block (No Data) Rules on page 1682 or Managing Block (No Such Domain)
Rules on page 1681 respectively.
• Substitute Hits: Total number of queries that triggered a Substitute (Domain Name) or Substitute (Record) RPZ
rule. For more information, see Managing Substitute (Domain Name) Rules on page 1683 and Managing
Substitute (Record) Rules on page 1685.
• Timestamp: The graph displays a 24 hours time window.
Note the following about this tab:
• The statistical data in DNS service will be reset when you stop and restart the DNS service or if you force an
active DNS service to restart regardless of its state. This results in loss of prior data.
• Using this graph, you can view the timestamp of statistics collection.

Health
The Health tab displays information of RPZ zones and their last updated date and time. This data is retrieved directly
from the database. Note that you cannot sort or filter values in this tab. You can export the data displayed in this tab
by clicking the Export icon. For more information, see Exporting Displayed Data on page 111.

Response Policy Zone (RPZ) Status for Member

The Response Policy Zone (RPZ) Status for Member widget provides statistical information about RPZ hits for the
selected member. This widget contains the following tabs: RPZ Recent Hits, Trend, and Health.
You can do the following in this widget:
• Click Select Member. In the Member Selector dialog box, choose a Grid member to view the RPZ hits, or
statistics, or RPZ zones and their last updated date and time.
• Select a graph configuration, Client Hits, Passthru Hits, Blocked Hits, or Substituted Hits, to view details of a
specific RPZ rule. You can select either one or all the available graph configurations. Note that Client Hits is
displayed only when the graph type is Line Diagram.
• Select a graph type, Stacked Diagram or Line Diagram, to display data in the required diagrammatic format. This
option is enabled only when you click the Trend tab and disabled when you click the Top 10 Grid Members, RPZ
Recent Hits, or Health tabs. For more information, see Trend on page 170.
• Click View Syslog to view the last 20 RPZ events that are logged in the syslog. For more information, see
Previewing the Syslog on page 171.
• Click the RPZ Recent Hits tab to view information about the latest five RPZ hits with unique client addresses. For
more information, see RPZ Recent Hits on page 170.
• Click the Trend tab to view RPZ hit statistics on the selected member. For more information, seeTrend on page
169.
• Click the Health tab to view information about RPZ zones and their last updated times. For more information,
see Health on page 171.
Note that you must install the RPZ license and enable RPZ logging to access this widget. For more information about
installing licenses and enabling RPZ logging, see License Requirements and Admin Permissions on page 1673 and
Setting DNS Logging Categories on page 1340.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 169

Dashboards

RPZ Recent Hits

The RPZ Recent Hits tab displays the data that is collected from the most recent hits of five unique clients, identified
by their IP addresses, during the last 24 hours. NIOS retrieves this data from the syslog. This tab does not display any
data when there are no syslog messages or if RPZ logging is disabled. NIOS displays an error message if RPZ logging
is disabled. For more information about enabling RPZ logging, see Setting DNS Logging Categories on page 1340.
Grid Manager retrieves recent hits from the selected member. If a member has an RPZ license installed, then NIOS
will parse the syslog every 60 seconds to collect the data. NIOS parses the generated data to identify the five most
recent hits. It searches for these fields in the syslog message: CEF: data string(RPZ syslog) and src fields.
The NIOS appliance remembers the start and end time of previously searched operations to optimize the recent hits
data collection, so that the same data is not searched again. Note that when the same client makes repeated queries
in the last 24 hours, then there might be less than five unique client hits. You cannot sort or filter values in this tab.
This tab displays the following information:
• Client IP Address: IP address of the client that made the recent hits.
• Requested FQDN: The domain name or IP address that triggered the RPZ rule. For example, consider an RPZ rule
test.com.rpz.com, which queries for test.com. In this example, test.com is the requested FQDN.
• RPZ Entry: The RPZ rule that queried a domain name or an IP address. In the above example, test.com.rpz.com is
the RPZ rule.
• Timestamp: The date and time when the hit occurred.
Consider an example in which you query an RPZ zone and the NIOS appliance logs the following message in the
syslog:
CEF:0|Infoblox|NIOS|6.9.0-219291|RPZ-QNAME|NODATA|4|app=DNS dst=10.35.101.14
src=10.36.0.251 spt=44460 view=_default qtype=A msg="rpz QNAME NODATA rewrite w18.vg [A]
via w18.vg.fireeye.com"
This tab displays information in the corresponding fields as follows:

Fields Description
Client IP Address Data is retrieved from the src
field.
Example: 10.36.0.251
Requested FQDN It is retrieved from the data
between the rewrite and [A]
via fields. Example: w18.vg.

RPZ Entry It is retrieved from the data after

the via in msg field.
Example: w18.vg.fireeye.com
Timestamp This is listed in the syslog.

You can export data displayed in this tab by clicking the Export icon. For more information, see Exporting Displayed
Data on page 111.

Trend
The Trend tab displays statistics of RPZ hits on the selected member during the last 60 minutes. You can use a stacked
graph or a line graph to view the hits. DNS service generates RPZ statistics for the selected member. Each of the RPZ
policy is represented with a different color. This tab displays the following information:
• Client Hits: Total number of queries that triggered an RPZ policy. Note that this option is not displayed when you
choose Stacked Diagram, but displayed only when you choose Line Diagram.

170 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Status Dashboards

• Passthru Hits: Total number of queries that triggered a Passthru RPZ rule. For more information about passthru
rules, see Managing Passthru Rules on page 1679.
• Blocked Hits: Total number of queries that triggered a Block (No Data) or Block (No Such Domain) RPZ rule. For
more information, see Managing Block (No Data) Rules on page 1682 or Managing Block (No Such Domain)
Rules on page 1681 respectively.
• Substituted Hits: Total number of queries that triggered a Substitute (Domain Name) or Substitute (Record) RPZ
rule. For more information, see Managing Substitute (Domain Name) Rules on page 1683 and Managing
Substitute (Record) Rules on page 1685.
• Timestamp: The graph displays a 24 hours time window.
Note the following about this tab:
• The statistical data in DNS service will be reset when you stop and restart the DNS service or if you force an
active DNS service to restart regardless of its state. This results in loss of prior data.
• Using this graph, you can view the timestamp of statistics collection.

Health
The Health tab displays information of RPZ zones on the selected member and their last updated date and time. This
data is retrieved directly from the database. Note that you cannot sort or filter values in this tab. You can export the
data displayed in this tab by clicking the Export icon. For more information, see Exporting Displayed Data on page
111.

Previewing the Syslog

You can view the RPZ events that are logged in the syslog for a selected Grid member. Note that the preview displays
only the last 20 RPZ events from the syslog. This wizard displays the following information:
• Timestamp: The date and time when the hit occurred.
• Facility: The location on the syslog server sorting the log message.
• Level: The severity of the message. This can be ALERT, CRITICAL, DEBUG, EMERGENCY, ERROR, INFO, NOTICE, or
WARNING.
• Server: The name of the server that logged this message, plus the process ID.
• Message: Detailed information about the RPZ query.
You can click the Go to Syslog Viewer link to view the RPZ events that are logged in the syslog. NIOS displays all the
RPZ events that are logged in the syslog for the selected member and the Quick Filter is set to RPZ Incident Logs by
default. For more information, see Viewing RPZ in the Syslog on page 1714.

Tenant & VMs

The Tenant & VMs tab displays a table that shows the total number of Tenants, Cloud VMs, and IP Addresses,
depending on your configuration. It also displays the average number of cloud VMs and IP addresses per tenant.

Fixed vs. Floating

The Fixed vs. Floating tab displays IP address allocation for cloud objects. It displays the total number of fixed address
allocation and floating address allocation, depending on your configuration. It also displays a pie chart indicating the
percentage for each allocation.

Available vs. Allocated

The Available vs. Allocated tab displays IP address allocation for available versus allocated IP addresses. It displays
the total number of available IP addresses versus allocated IP addresses, depending on your configuration. It also
displays a pie chart indicating the percentage for each allocation.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 171

Dashboards

Pool Licenses Statistics

The Pool Licenses Statistics widget displays information about pool license allocation in your Grid. Pool licenses are
dynamic service and feature licenses, such as vNIOS, DNS, DHCP, and Cloud Platform that you purchase for vNIOS
and cloud deployments based on your evolving business needs. The Grid Master keeps track of dynamic licenses that
are allocated to vNIOS members and adjusts the total number of available dynamic licenses for each feature and
service.
In the widget, you can select the license type and Grid Manager displays the total numbers of assigned and available
licenses based on the selected license type.
To configure the Pool Licenses Statistics widget, click the Configure icon and complete the following:
• Show Usage for: From the drop-down list, select a license type for which you want the appliance to display
dynamic license usage.
The widget displays license usage and the numbers of assigned and available licenses.
You can also view the total number of dynamic licenses installed for each feature and service, the number of active
and available licenses, their usage, and other related information in the Grid tab -> Licenses tab -> Pool tab of Grid
Manager. For information about how to view dynamic licenses, see Managing Dynamic Licenses on page 481.

DNS Record Scavenging

The DNS Record Scavenging dashboard widget displays statistics about the scavenging of stale DNS records. For
more information about record scavenging, see DNS Record Scavenging on page 803.
The widget displays the following information for the current or last known scavenging activities:
• Status: The status of the scavenging operation.
• Start: The start time of the scavenging operation.
• End: The end time of the scavenging operation.
• User: The user who initiated the scavenging operation.
• Selected Object: The Grid, view, or zone affected by record scavenging.
• Action: The action applied to the scavenging operation.
• Processed Records: The number of DNS records processed.
• Reclaimable Records: The number of DNS records marked as reclaimable.
• Reclaimed Records: The number of DNS records removed during the scavenging operation.

172 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 3 Smart Folders
This chapter explains how to create and use smart folders to organize your core network services data. It includes the
following sections:
• About Smart Folders on page 174
— Global Smart Folders on page 175
— My Smart Folders on page 175
— Predefined Smart Folders on page 176
• Creating Smart Folders on page 176
• Viewing and Modifying Data in Smart Folders on page 177
• Modifying Smart Folders on page 178
• Deleting Smart Folders on page 178
• Saving a Copy of a Smart Folder on page 179
• Printing and Exporting Data in Smart Folders on page 179

NIOS 7.3 NIOS Administrator Guide (Rev. A) 173

Smart Folders

About Smart Folders

Use smart folders to organize your core network services data. Depending on your administrative roles and business
needs, you can filter your data by object types, names, extensible attributes, and discovered data such as conflicts,
unmanaged data, or the virtual entity data, and then place the filtered results in a smart folder. You can also group
the filtered results by defining up to 10 extensible attributes as the Group By rules. For example, you can create a
smart folder that contains all the networks you manage in Belgium, and then group the networks by building number,
as illustrated in Figure 3.1.
Once you set up a smart folder, the appliance displays up-to-date information based on your filter and grouping
criteria each time you access the folder. You can also view and modify object information in the folder. For
information, seeViewing and Modifying Data in Smart Folders on page 177. With smart folders, you can organize your
data in a meaningful way and quickly obtain the information you need to perform specific tasks without searching the
entire database.

Figure 3.1 Creating Smart Folders

1 From Grid Manager, 2 Create a smart folder with filter 3 The appliance searches objects
define extensible criteria set to specific objects and that match the filter criteria, and
attributes. The appliance values. You can also group groups the objects by the Group
annotates core network the results by specifying the Group By rules. Grid Manager displays
services data in the database. By rules. the folder contents in a
hierarchical view.
10.2.2.0/24
10.2.2.0/24
= Belgium Networks

120.10.0.0/16 120.10.0.0/16

35.10.2.0/24

10.1.1.128/25 Filter Criteria =

Leaf Subnet equals Yes +
Country equals Belgium

35.10.2.0/24 Group By = Building

Before you set up your smart folders, decide how you want to organize your data. You can specify search and Group
By criteria to help you group information in a meaningful way. You can also decide whether you want to include
objects that do not contain attribute values when you use the Group By criteria to group filtered data by extensible
attributes. For information, see Creating Smart Folders on page 176. Note that a smart folder becomes invalid when
you delete an extensible attribute that the folder uses as a filter or Group By criterion. You must redefine the
extensible attribute and reconfigure the folder criteria to validate the smart folder.
In Grid Manager, you can create smart folders in both the Global Smart Folders and My Smart Folders panels. In Global
Smart Folders, you can create smart folders to which other administrators can create links. Only administrators with
superuser accounts can create, edit, and delete global smart folders. For information, see Global Smart Folders on
page 175. You can create personal folders as well as links to global smart folders in My Smart Folders. For
information, see My Smart Folders on page 175.
Each smart folder you create can contain up to 2,000 objects. When the number of objects exceeds 2,000, Grid
Manager sorts and displays the first 2,000 objects only. It also displays a warning message at the top of the panel.
In this case, you may want to redefine your filter criteria to further refine the filtered data in your smart folders.

174 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Smart Folders

To create smart folders, follow these procedures:

1. Determine how you want to organize your core network services data.
2. Identify the fields that you want to use to group networks or define extensible attributes for the data that you
want to track. For information about extensible attributes, see About Extensible Attributes on page 417.

Note: Infoblox strongly recommends that you use Type as one of the filter criteria to improve system
performance.

3. Create smart folders in either the My Smart Folders or Global Smart Folders panel. For information, see Creating
Smart Folders on page 176.

Global Smart Folders

You can create global smart folders to share among administrators. You must log in as a superuser account to create,
edit, and delete global smart folders. All other users have read-only access to global smart folders. You can create as
many folders as you need in Global Smart Folders, but Grid Manager displays a maximum of 500 smart folders in the
list panel. You can also save a local copy of an existing folder, depending on your administrative permissions. For
information, see Saving a Copy of a Smart Folder on page 179.
Grid Manager displays a list of global smart folders in the list panel.
When you log in as a superuser and mouse over a global smart folder, the following icons appear:
• Information: Displays information about the selected smart folder. Information includes comments and filter
criteria for the folder. It also displays the Group By rules.
• Edit: Click this icon to edit the definition and filter criteria for the smart folder.
• Create link: Click this icon to create a link to the smart folder. The link to this folder is placed in My Smart
Folders.
• Delete: Click this icon to delete the smart folder. This operation does not affect the objects that are in the folder.
Only the smart folder is deleted.

My Smart Folders
In My Smart Folders, you can create personal smart folders and links to global smart folders. When you create links
to global smart folders, you can only view information in the folders. However, you can create a local copy of the
global smart folder in its current state for editing purposes. Note that when the original global smart folder is
updated, information in your local copy is not updated. For information, see Saving a Copy of a Smart Folder on page
179. When you delete a link to a global smart folder in this tab, only the link is deleted. There is no impact on the
information in the original global smart folder.
Grid Manager displays a list of smart folders in the list panel. The same list of smart folders is also displayed in the
Finder panel. For information, see Finder Panel on page 68.
When you mouse over a smart folder in the list panel, the following icons appear:
• Information: Displays information about the selected smart folder. Information includes comments and filter
criteria of the folder. It also displays how you grouped the filtered data.
• Edit: Click this icon to edit the definition and filter criteria for the smart folder.
• Delete: Click this icon to delete the smart folder. This operation does not affect the objects or networks that are
in the folder. Only the smart folder is deleted.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 175

Smart Folders

Predefined Smart Folders

The appliance can detect remote clients through their DHCP fingerprints, or through device information discovered
through SNMP and other device and network detection protocols. You can use predefined smart folders to view lease
history, IP addresses, network infrastructure devices, and other related information for remote clients that contain
DHCP fingerprint information related to the following device groups:
• Smartphone, PDA, Tablet Devices: Includes all devices that were detected as smartphones, PDAs, and tablets.
• Microsoft Windows Devices: Includes all devices that were detected to be running Windows OS.
• Apple MAC OS Devices: Includes devices that were detected to be running MAC OS.
• Conflicts: Includes hosts detected in the network that have a MAC Address conflict. A discovered host has a
MAC address conflict when its MAC address is different from that specified in its fixed address, DHCP lease, or
host record.
• Discovered Routers/Switches: Includes core network infrastructure devices of the specific Router, Switch, or
Switch-Router types discovered by NIOS using the discovery feature set. Clicking on a device name opens the
device page under Data Management –> Devices and shows the Interfaces page for the chosen device.
• Active Directory Sites: Includes all names that were detected as Active Directory Sites. Clicking on an Active
Directory Site opens the Active Directory Site Properties editor where you can edit the name, add, or delete
networks that are associated with the Active Directory Site. For more information, see Modifying Active Directory
Sites and Networks on page 1270.
• Gaming Console Devices: Includes devices that were detected as gaming consoles.
• Router and Wireless Access Point Devices: Includes devices there were detected as routers or wireless access
point devices.
• Unmanaged: Shows all unmanaged devices.

Note: For information about DHCP fingerprints, see About DHCP Fingerprints on page 1359. For information about
discovery, see Infoblox Network Insight beginning on page 653.

Creating Smart Folders

You can create personal smart folders in My Smart Folders. You can also create global folders to share among
administrators in Global Smart Folders when you log in as a superuser account. Each time you access a smart folder,
you obtain up-to-date information about the core network services data that match the filter criteria you set for the
folder. You can also set Group By rules to group the filtered data by extensible attributes. Grid Manager displays a
hierarchical view of the data using the Group By rules you define.
To create a smart folder:
1. Click the Smart Folders tab.
2. Click the My Smart Folders tab to create a personal smart folder.
or
If you logged in with a superuser account, click the Global Smart Folders tab to create a global smart folder.
3. Click Create.
4. In the Smart Folder data panel, complete the following:
— Name: Enter the name of the smart folder.
— Comment: Optionally, enter additional information about the smart folder.
— In the first drop-down list, select a field as the filter. You can select a network view or a record type as the
filter. Grid Manager highlights extensible attributes and Active Directory Sites in gray. You can also group
the default data by adding a Group By rule without adding a filter.

176 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing and Modifying Data in Smart Folders

Note: Infoblox strongly recommends that you use Type as the first filter criterion to improve system performance.

— In the second drop-down list, select an operator for the filter.

— Enter or select a value for the selected field and operator. Depending on the field and operator that you
select, the field can be a text or an integer field. It can also be a drop-down list or a calendar widget. For
example, if you select Network/Zone/Range/Member in the Type field, Grid Manager displays all the
networks, zones, DHCP ranges, and members in the results table. The results table may display the name in
its native characters if the name was originally entered as an IDN (Internationalized Domain Name). For
example, the Name column in the results table displays 网络 , a zone name in Chinese.
— Optionally, click + to add another filter. You can also click Apply to view the filtered data in the results table.
— Optionally, select the Group Results check box to organize the filtered data. You can also disable a Group By
filter by deselecting the check box.
— From the Group by drop-down list, select an extensible attribute or an Active Directory Site by which you
want to group the filtered data. For example, if you want to group the filtered data by building number, you
can select Building from the drop-down list. To add additional Group By rules, click the + icon, and then
select a field from the drop-down list. You can apply up to 10 Group By rules. You can also delete a rule by
selecting the rule and clicking the - icon.
— After you add all filter criteria and Group By rules, click Apply. Grid Manager displays the filtered data in the
results table. Note that in the Name field, the appliance highlights disabled DHCP objects in gray. A DHCP
object can be a DHCP range, fixed address, reservation, host configured for DHCP, or roaming host with an
allocated IP address. If you select to include objects with no attribute values in the Group By rules, the
appliance may take longer to process the results. You can also choose to display Active Directory Site
values in the table.
5. Click Save to save the smart folder.

Viewing and Modifying Data in Smart Folders

After you set up a smart folder, the appliance searches for matching objects based on the filter criteria you specified
for the folder. Grid Manager also groups the objects by the Group By rules you specify. If you select to include objects
with no attribute values, the appliance may take longer to process the results. Each smart folder you create can
contain up to 2,000 objects. When the number of objects exceeds 2,000, Grid Manager sort and displays the first
2,000 objects and a message at the top of the panel. In this case, you may want to redefine your filter criteria to
further refine the filtered data in your smart folders.
Grid Manager displays smart folders hierarchically in a tree view based on your Group By rules in the following:
• Smart Folder section in the Finder panel
• Selectors from which you can select a smart folder
In the smart folder list panel however, Grid Manager displays all the smart folders in a flat list. You can modify some
of the data in the table. Double click a row of data, and either edit the data in the field or select an item from a
drop-down list. Note that some fields are read-only. For more information about this feature, see Modifying Data in
Tables on page 70.
In the smart folder data panel, Grid Manager displays the first hierarchical level of the smart folder based on your
Group By rules. If you do not configure any Group By rule, Grid Manager displays all the objects in the results table.
If you select to include objects with no attribute values, Grid Manager also includes these objects in the hierarchical
view. Depending on your Group By rules, you can view detailed information about the objects by clicking the object
link and drilling down to the lowest hierarchical level, and then opening an object. To go back to a previous
hierarchical view, click the link of the corresponding level in the breadcrumb.
To view detailed information about an object:
1. In the Smart Folder data panel, click the object link until you drill down to the last hierarchical level of the folder.
2. Grid Manager displays the following information:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 177

Smart Folders

— Name: The name or IP address of the object.

— Comment: Information about the object.
— Type: The object type.
— Site: The site to which the object belongs. This is one of the predefined extensible attributes.
You can also select other available extensible attributes for display, and sort the data in ascending or
descending order by column.
3. Select an object check box, and then do one of the following:
— Click the Open icon to display the data in the network list or IP address list.
— Click the Edit icon to modify or schedule the modification of the object configuration. Grid Manager displays
the corresponding editor depending on the object you select.
— Click the Delete icon to delete the object or click the Schedule Deletion icon to schedule the deletion of the
object.
You can also print or export the data in this panel. For information, see Infoblox Grid Manager on page 53.

Modifying Smart Folders

After you create a smart folder, you can modify its filter and grouping criteria.
To modify a smart folder:
1. Go to Smart Folders.
2. Click My Smart Folders to modify personal smart folders.
or
Click Global Smart Folders to modify global smart folders if you logged in with a superuser account.
3. Mouse over to the smart folder that you want to modify.
4. Click the Edit icon. You can also click the Edit icon next to the name of the smart folder in the data panel.
5. Make the appropriate changes in the Smart Folder data panel as described in Creating Smart Folders on page
176.

Deleting Smart Folders

You can delete personal smart folders in My Smart Folders. However, you must log in as a superuser account to delete
global smart folders.
To delete a smart folder:
1. Click the Smart Folders tab.
2. Click the My Smart Folders tab to delete personal smart folders.
or
Click the Global Smart Folders tab to delete global smart folders.
3. Mouse over to the smart folder that you want to delete.
4. Click the Delete icon. In the Delete Smart Folder dialog box, click Yes.

178 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Saving a Copy of a Smart Folder

Saving a Copy of a Smart Folder

You can make a copy of an existing smart folder, add or change filter criteria, and then rename the folder accordingly.
You can also create a local copy of the global smart folder in its current state for editing purposes. In My Smart
Folders, you can save a folder copy only in My Smart Folders. In Global Smart Folders however, you can save a folder
copy in either My Smart Folders or Global Smart Folders. You must have superuser permissions to save a global smart
folder copy in Global Smart Folders. Note that when the original global smart folder is updated, information in your
local copy is not updated.
To save a copy of a smart folder:
1. Click My Smart Folders to save a folder copy in this tab.
or
Click Global Smart Folders to save a folder copy in either this tab or My Smart Folders. To save a smart folder
copy in Global Smart Folders, log in as a superuser account.
2. Select the smart folder that you want to save as a copy.
3. Click Save copy as.
4. Grid Manager saves the folder copy in My Smart Folders when you save the folder copy in this tab.
or
The Save Smart Folder As dialog box appears when you perform this function in Global Smart Folders. Select
one of the following:
— My Smart Folders: Saves the copy in My Smart Folders.
— Global Smart Folders: Saves the copy in Global Smart Folders.
Click OK.

Note: For the folder copy, the appliance appends the word Copy to the original name of the smart folder. You can
change the name of the folder at anytime by editing the folder.

Printing and Exporting Data in Smart Folders

You can print the list of networks that are on the current smart folder page, or you can export all the data in CSV
(comma separated value) format. For information, see About Tasks on page 81 and Exporting Data to Files on page
108.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 179

Smart Folders

180 NIOS Administrator Guide (Rev. A) NIOS 7.3

Part 2 Appliance Administration
This section provides information about configuring admin groups, roles, and accounts, and defining the appropriate
permissions. It explains how to configure and manage a Grid or an independent appliance, and set operational
parameters. It also describes the file distribution services (TFTP, FTP, and HTTP) and the bloxTools environment. It
includes the following chapters:
• Chapter 4, Managing Administrators, on page 183
• Chapter 5, Deploying a Grid, on page 269
• Chapter 6, Deploying Independent Appliances, on page 331
• Chapter 8, Managing Appliance Operations, on page 395
• Chapter 9, File Distribution Services, on page 503
• Chapter 10, Managing NIOS Software and Configuration Files, on page 519
• Chapter 11, bloxTools Environment, on page 549
• Chapter 12, RIR Registration Updates, on page 555

NIOS 7.3 NIOS Administrator Guide (Rev. A) 181

182 NIOS Administrator Guide (Rev. A) NIOS 7.3
Chapter 4 Managing Administrators
This chapter describes the various tasks associated with setting up admin groups, admin roles, admin accounts, and
permissions. It contains the following sections:
• About Admin Accounts on page 186
• About Admin Groups on page 188
— Creating Superuser Admin Groups on page 189
— Creating Limited-Access Admin Groups on page 190
• About Admin Roles on page 192
— Creating Admin Roles on page 192
• Managing Admin Groups and Admin Roles on page 193
— Modifying Admin Groups and Roles on page 193
— Deleting Admin Groups and Roles on page 193
— Viewing Admin Groups on page 194
— Viewing Admin Roles on page 194
— Viewing Admin Group Assignments on page 195
• About Administrative Permissions on page 195
— Defining Global Permissions on page 196
— Defining Object Permissions on page 200
— Defining DNS and DHCP Permissions on Grid Members on page 202
— Applying Permissions and Managing Overlaps on page 204
— Managing Permissions on page 205
• Authenticating Administrators on page 207
• Creating Local Admins on page 208
— Managing Passwords on page 209
— Modifying and Deleting Admin Accounts on page 210
• About Remote Admins on page 211
• Authenticating Admins Using RADIUS on page 213
— Authentication Protocols on page 213
— Accounting Activities Using RADIUS on page 214
— Configuring Remote RADIUS Servers on page 214
— Configuring RADIUS Authentication on page 215
— Configuring a RADIUS Authentication Server Group on page 215

NIOS 7.3 NIOS Administrator Guide (Rev. A) 183

Managing Administrators

• Authenticating Admins Using Active Directory on page 217

— Configuring an Active Directory Authentication Service Group on page 218
— Enabling Active Directory Authentication for Nested Groups on page 219
• Authenticating Admin Accounts Using TACACS+ on page 220
— TACACS+ Accounting on page 221
— Configuring TACACS+ on page 221
— Configuring a TACACS+ Authentication Server Group on page 221
• Authenticating Admins Using LDAP on page 223
— Authentication Protocols on page 224
— Configuring LDAP on page 224
— Configuring an LDAP Server Group on page 224
• Defining the Authentication Policy on page 227
— Configuring a List of Authentication Server Groups on page 227
— Configuring a List of Remote Admin Groups on page 227
• Authenticating Admins Using Two-Factor Authentication on page 228
— Best Practices for Configuring Two-Factor Authentication on page 230
— Configuring the OCSP Authentication Server Group on page 230
— Viewing the OCSP Authentication Server Group on page 232
• Changing Password Length Requirements on page 232
• Notifying Administrators on page 232
• Administrative Permissions for Common Tasks on page 234
• Administrative Permission for the Grid on page 237
— Administrative Permissions for Grid Members on page 237
— Administrative Permissions for Network Discovery on page 238
— Administrative Permissions for Scheduling Tasks on page 238
— Administrative Permissions for Microsoft Servers on page 239
• Administrative Permissions for IPAM Resources on page 240
— Administrative Permissions for IPv4 and IPv6 Networks on page 240
— Administrative Permissions for Hosts on page 241
• Administrative Permissions for DNS Resources on page 241
— Administrative Permissions for DNS Views on page 242
— Administrative Permissions for Zones on page 243
— Administrative Permissions for Resource Records on page 244
— Administrative Permissions for Adding Blank A or AAAA Records on page 245
— Administrative Permissions for Shared Record Groups on page 245
— Administrative Permissions for DNS64 Synthesis Groups on page 246
• Administrative Permissions for DNS Resources with Associated IP addresses in Networks and Ranges on page
247
— Best Practices for Configuring Permissions in Networks and Ranges on page 247
— Changes to Default Behavior on page 248
— Enabling Permissions for DNS Resources in Networks and Ranges on page 250
— Configuring Permissions for DNS Resources in Networks and Ranges on page 250
• Administrative Permissions for DHCP Resources on page 253
— Administrative Permissions for Network Views on page 254
— Administrative Permissions for IPv4 and IPv6 Networks and Shared Networks on page 255

184 NIOS Administrator Guide (Rev. A) NIOS 7.3

 — Administrative Permissions for IPv4 or IPv6 Fixed Addresses and IPv4 Reservations on page 257
— Administrative Permissions for IPv4 or IPv6 DHCP Enabled Host Addresses on page 258
— Administrative Permissions for IPv4 and IPv6 DHCP Ranges on page 258
— Administrative Permissions for IPv4 or IPv6 DHCP Templates on page 259
— Administrative Permissions for Roaming Hosts on page 260
— Administrative Permissions for MAC Address Filters on page 261
— Administrative Permissions for the IPv4 and IPv6 DHCP Lease Histories on page 262
• Administrative Permissions for File Distribution Services on page 262
• Administrative Permissions for Dashboard Tasks on page 263
• Administrative Permissions for OCSP Server Groups and CA Certificates on page 264
• Administrative Permissions for Load Balancers on page 264
• Administrative Permissions for Named ACLs on page 265
• Administrative Permissions for DNS Threat Protection on page 265

NIOS 7.3 NIOS Administrator Guide (Rev. A) 185

Managing Administrators

About Admin Accounts

A user must have an admin account to log in to the NIOS appliance. Each admin account belongs to an admin group,
which contains roles and permissions that determine the tasks a user can perform. For information, see About Admin
Groups on page 188.
When an admin connects to the appliance and logs in with a username and password, the appliance starts a two-step
process that includes both authentication and authorization. First, the appliance tries to authenticate the admin
using the username and password. Second, it determines the authorized privileges of the admin by identifying the
group to which the admin belongs. It grants access to the admin only when it successfully completes this process.
The NIOS appliance can authenticate users that are stored on its local database as well as users stored remotely on
an Active Directory domain controller, a RADIUS server, a TACACS+ server or an LDAP server. The group from which
the admin receives privileges and properties is stored locally.
The appliance can also authenticate users with smart cards that contain X.509 client certificates. The status of these
certificates is stored remotely on OCSP (Online Certificate Status Protocol) responders. NIOS uses two-factor
authentication to validate these users. For more information about two-factor authentication and how to configure it,
see Authenticating Admins Using Two-Factor Authentication on page 228.
The tasks involved in configuring administrator accounts locally and remotely are listed in Table 4.1.

Table 4.1 Storing Admin Accounts Locally and Remotely

RADIUS server/AD Domain

NIOS Appliance Controller/TACAS+ server/LDAP server
• Use the default admin group
(“admin-group”) or define a new group
To store admin • Set the privileges and properties for
accounts locally
the group
• Add admin accounts to the group
• Configure communication settings with • Configure communication settings with
a RADIUS server, an Active Directory the NIOS appliance
domain controller, TACACS+ server, or If you use admin groups:
LDAP server
• Import Infoblox VSAs (vendor-specific
If you use admin groups on the RADIUS attributes) (if RADIUS)
server, Active Directory domain controller,
• Define an admin group with the same
TACACS+ server, or LDAP server:
name as that on the NIOS appliance
To store admin • Configure admin groups that match the
accounts remotely • Define admin accounts and link them
remote admin groups
to an admin group
• Set the privileges and properties for
If you do not use admin groups:
the groups
• Define admin accounts
If you do not use admin groups on the
RADIUS server, Active Directory domain
controller, TACACS+ server, or LDAP server:
• Assign an admin group as the default

The admin policy defines how the appliance authenticates the admin: with the local database, RADIUS, Active
Directory, TACACS+, or LDAP. You must add RADIUS, Active Directory, TACACS+, or LDAP as one of the authentication
methods in the admin policy to enable that authentication method for admins. See Defining the Authentication Policy
on page 227 for more information about configuring the admin policy.

186 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Admin Accounts

Figure 4.1 illustrates the relationship of local and remote admin accounts, admin policy, admin groups, and
permissions and properties.

Figure 4.1 Privileges and Properties Applied to Local and Remote Admin Accounts

RADIUS, Active Directory, TACACS+,

NIOS appliance
or LDAP

The NIOS appliance first

checks the remote admin
Admin Local policy to determine which Remote
Users Admin of the following Admin
Groups authentication methods to Groups
use and where to get
Access permissions and properties come membership information When remote admin
from local admin group definitions. from: local-admin accounts are not in 
database, RADIUS, an admin group (or in a
Login Active Directory, group whose name does
TACACS+, or LDAP. not match that of a local
group), the NIOS
appliance applies the
Admin-Group1 default admin group
permissions and
Adam properties (if configured).
Login

Default
Admin-Group When admin
accounts are in 
Balu an admin group
Login that matches a
group configured
Group locally, the
names appliance selects
Admin-Group2 must Admin-Group2 the first group
match. (based on remote
Christine admin policy) and
Login applies the
Login permissions and
properties to the
admin belonging 
to that group.
Admin-Group3 Admin-Group3

Dan Eve

Assigned from local admin group definitions: There can be admin

accounts in a local and
Admin Permissions
remote admin group with
(for resources, such as zones, networks,
the same group name. Note:
members and DHCP lease history)
Properties (for page size) = Admin Account

Complete the following tasks to create an admin account:

1. Use the default admin group or create an admin group. See About Admin Groups on page 188.
2. Define the administrative permissions of the admin group. See About Administrative Permissions on page 195.
3. Create the admin account and assign it to the admin group.
— To add the admin account to the local database, see Creating Local Admins on page 208.
— To configure the appliance to authenticate the admin account stored remotely, see About Remote Admins
on page 211.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 187

Managing Administrators

About Admin Groups

All administrators must belong to an admin group. The permissions and properties that you set for a group apply to
all administrators assigned to that group. You can assign a dashboard template to an admin group. A dashboard
template specifies the tasks an admin group can access through the Tasks Dashboard tab when they log in to Grid
Manager. For information about dashboard templates, see About Dashboard Templates on page 128. You can also
restrict certain user groups to manage specific tasks in the Tasks Dashboard tab only. These users cannot manage
other core network services through Grid Manager. For information about how to apply this restriction, see Creating
Limited-Access Admin Groups on page 190.
To define admins who can perform specific core network service tasks, you can set up admin groups and assign them
permissions for those tasks. To control when and whether certain tasks should be performed, you can add an admin
group to an approval workflow and define the admins as submitters or approvers. A submitter is an admin whose
tasks require approvals before execution, and an approver is an admin who can approve the submitted tasks. When
you add submitter and approver groups to an approval workflow, you have control over who can perform which
mission critical tasks and whether and when the tasks should be executed. For more information about how to create
and configure approval workflows, see Configuring Approval Workflows on page 86.
There are three types of admin groups:
• Superuser – Superuser admin groups provide their members with unlimited access and control of all the
operations that a NIOS appliance performs. There is a default superuser admin group, called admin-group, with
one superuser administrator, admin. You can add users to this default admin group and create additional admin
groups with superuser privileges. Superusers can access the appliance through its console, GUI, and API. In
addition, only superusers can create admin groups.
• Limited-Access – Limited-access admin groups provide their members with read-only or read/write access to
specific resources. These admin groups can access the appliance through the GUI, API, or both. They cannot
access the appliance through the console.
• Default – When upgrading from previous NIOS releases, the appliance converts the ALL USERS group to the
Default Group when the ALL USERS Group contains admin accounts. The appliance does not create the Default
Group if there is no permission in the ALL USERS group. The permissions associated with the ALL USERS group
are moved to a newly created role called Default Role. Supported in previous NIOS releases, the ALL USERS
group was a default group in which you defined global permissions for all limited-access users. This group
implicitly included all limited-access users configured on the appliance.
All limited-access admin groups require either read-only or read/write permission to access certain resources, such
as Grid members, and DNS and DHCP resources, to perform certain tasks. Therefore, when you create an admin
group, you must specify which resources the group is authorized to access and their level of access.
Only superusers can create admin groups and define their administrative permissions. There are two ways to define
the permissions of an admin group. You can create an admin group and assign permissions directly to the group, or
you can create roles that contain permissions and assign the roles to an admin group.
You must create admin groups and assign them access to the cloud API and applicable permissions so they have
authority over delegated objects. When you assign permissions for objects that have not been delegated, these
admin groups or admin users assume applicable permissions to these un-delegated objects. For example, you can
create an admin group that can access a specific set of networks while another can access another set of networks.
Note that you cannot create a new admin group using the same name. For information about Cloud Network
Automation, see Deploying Cloud Network Automation on page 339.
Complete the following tasks to assign permissions directly to an admin group:
1. Create an admin group, as described in Creating Limited-Access Admin Groups on page 190.
2. Assign permissions to the admin group, as described in About Administrative Permissions on page 195.
Complete these tasks to assign admin roles to an admin group:
1. Create an admin role, as described in About Admin Roles on page 192.
2. Define permissions for the newly created admin role, as described in Creating Admin Roles on page 192.
3. Create an admin group and assign the role to the group, as described in Creating Limited-Access Admin Groups
on page 190.

188 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Admin Groups

After you have created admin groups and defined their administrative permissions, you can assign administrators to
the group.
• For local admins, see Creating Local Admins on page 208.
• For remote admins, see About Remote Admins on page 211.

Creating Superuser Admin Groups

Superusers have unlimited access to the NIOS appliance. They can perform all operations that the appliance
supports. There are some operations, such as creating admin groups and roles, that only superusers can perform.
Note that there must always be one superuser admin account, called “admin”, stored in the local database to ensure
that at least one administrator can log in to the appliance in case the NIOS appliance loses connectivity to the remote
admin databases such as RADIUS servers, AD domain controllers, TACACS+ servers, LDAP servers, or OCSP
responders.
NIOS comes with a default superuser admin group (admin-group). It also automatically creates a new admin group,
fireeye-group, when you add the first FireEye RPZ (Response Policy Zone). Infoblox recommends that you do not add
another admin group with the same name as the default or FireEye admin group. Note that the FireEye admin group
is read-only and you cannot assign permissions to it. For more information about FireEye RPZs, see About FireEye
Integrated RPZs on page 1637.
You can create additional superuser admin groups, as follows:
1. From the Administration tab, select the Administrators tab -> Groups tab, and then click the Add icon.
2. In the Add Admin Group wizard, complete the following:
— Name: Enter a name for the admin group.
— Comment: Enter useful information about the group, such as location or department. For fireeye-group,
NIOS displays Group used to receive FireEye alerts in this field.
— Disable: Select this to retain an inactivated profile for this admin group in the configuration. For example,
you may want to define a profile for recently hired administrators who have not yet started work. Then when
they do start, you simply need to clear this check box to activate the profile.
3. Click Next and complete the following:
— Superusers: Select this to grant the admin accounts that you assign to this group full authority to view and
configure all types of data and perform all tasks.
— Allowed Interfaces: Superusers admin groups are automatically granted access to the Infoblox GUI (Grid
Manager) and API. You can specify which API the superusers group can access. Note that you must have the
Cloud Network Automation or Cloud Platform license installed to configure access to the cloud API.
GUI: This is selected by default. The superusers admin group automatically has full access to Grid Manager.
API: This is selected by default. Note that the following options are displayed only if a cloud license is
installed in the Grid.
— API (WAPI/PAPI only): The superusers admin group has full access to the RESTful API and the Infoblox
API by default.
— Cloud API: Select this to allow the superusers admin group to use the cloud API. This option is available
only if a cloud license is installed in the Grid. Select one of the following:
• Cloud API only (no PAPI): Select this to allow the admin group to use WAPI (RESTful API) to send
cloud API requests. Note that the Cloud API uses WAPI exclusively. The group has no access to the
Infoblox API.
• Cloud API and PAPI (No WAPI): Select this to allow the admin group to send API requests and have
access to the Infoblox API. However, the group cannot use WAPI to send cloud API calls.

Note: When you assign cloud API access to an admin group, the group assumes full authority over all delegated
objects. You must however specifically assign object permissions to the admin group for the group to gain
authority over non-delegated objects. For information about how to assign object permissions, see
Defining Object Permissions on page 200.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 189

Managing Administrators

4. Click Next and complete the following to define the dashboard template:
— Dashboard Template: From the drop-down list, select the dashboard template you want to assign to this
superuser group. When you apply a dashboard template to an admin group, the template applies to all
users in the group. The default is None, which means that users in this group can access all licensed tasks
in the Tasks Dashboard tab if they have the correct permissions to the task-related objects. Note that if you
want to delete a template, you must first unassign the template from an admin group, or select None,
before you can delete it. For more information about dashboard templates, see About Dashboard
Templates on page 128.
5. Click Next to add admin email addresses if you want the appliance to send approval workflow notifications to a
list of email addresses for the admin group. Complete the following in the Email Address table:
Click the Add icon and Grid Manager adds a row to the table. Enter the email address of the admin who should
receive workflow notifications. You can click the Add icon again to add more email addresses. You can also
select an email address and click the Delete icon to delete it. To modify an email address, click the Email
Address column and modify the existing address.

Note: When you configure an approval workflow and select Group Email Address(es) as the approver
notification addresses, the appliance sends workflow notifications to all email addresses you have added
to this table. For information, see Configuring Approval Workflows on page 86.

6. Optionally, click Next to add extensible attributes to the admin group. For information, see About Extensible
Attributes on page 393.
7. Save the configuration and click Restart if it appears at the top of the screen.
You can do one of the following after you create a superuser admin group:
• Add local admins to the superuser group. For information, see Creating Local Admins on page 208.
• Assign the superuser group to remote admins. For information, see About Remote Admins on page 211.

Creating Limited-Access Admin Groups

When you create a limited-access admin group, you can assign roles to it. The group then inherits the permissions of
its assigned roles. In addition, you can assign permissions directly to the group. Only superusers can create admin
groups.
To create a limited-access admin group:
1. From the Administration tab, select the Administrators tab -> Groups tab, and then click the Add icon.
2. In the Add Admin Group wizard, complete the following:
— Name: Enter a name for the admin group.
— Comment: Enter useful information about the group, such as location or department.
— Disable: Select this to retain an inactivated profile for this admin group in the configuration. For example,
you may want to define a profile for recently hired administrators who have not yet started work. Then when
they do start, you simply need to clear this check box to activate the profile.
3. Click Next and complete the following:
— Superusers: Clear this check box to create a limited-access admin group.
— Roles: Optionally, click the Add icon to add an admin role to the admin group. In the Role Selector dialog
box, select the roles you want to assign to the admin group, and then click the Select icon. Use Shift+click
and Ctrl+click to select multiple admin roles. You can assign up to 21 roles to an admin group. The
appliance displays the selected roles in the list box.
When an admin group is assigned multiple roles, the appliance applies the permissions to the group in the
order the roles are listed. Therefore if there are overlapped permissions among the roles, the appliance
uses the permission from the role that is listed first and ignores the others. You can reorder the list by
selecting a role and clicking the arrow keys to move the role up and down the list. To delete a role, select it
and click the Delete icon.

190 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Admin Groups

— Allowed Interfaces: Specify whether the admin group can use the Infoblox GUI (Grid Manager) and the API
(application programming interface) to configure the appliance. Note that you must have the Cloud Network
Automation or Cloud Platform license installed to configure access to the cloud API.
GUI: Select this to allow the admin group to use the Infoblox GUI, Grid Manager.
API: Select this to allow the admin group access to the Infoblox API. The following options are available only
if a Cloud Network Automation or Cloud Platform license is active in the Grid. You must first select this
option to enable the following options.
— API (WAPI/PAPI only): Select this to allow the admin group to use only the RESTful API and Infoblox API.
— Cloud API: Select this to allow the admin group to use the cloud API. This option is available only if a
Cloud Network Automation or Cloud Platform license is installed in the Grid. Select one of the following:
• Cloud API only (No PAPI): Select this to allow the admin group to use WAPI (RESTful API) to send
cloud API requests. Note that the Cloud API uses WAPI exclusively. The group has no access to the
Infoblox API.
• Cloud API and PAPI (No WAPI): Select this to allow the admin group to send API requests and have
access to the Infoblox API. However, the group cannot use RESTful API to send cloud API calls.

Note: When you assign cloud API access to an admin group, the group assumes full authority over all delegated
objects. You must however specifically assign object permissions to the admin group for the group to gain
authority over non-delegated objects. For information about how to assign object permissions, see
Defining Object Permissions on page 200.

4. Click Next and complete the following to define the dashboard template:
— Dashboard Template: From the drop-down list, select the dashboard template you want to assign to this
superuser group. When you assign a dashboard template to an admin group, the template applies to all
users in the group. The default is None, which means that users in this group can perform all licensed tasks
in the Tasks Dashboard tab if they have the correct permissions to the task-related objects. Note that if you
want to delete a template, you must first unassign the template from an admin group, or select None,
before you can delete it. For more information about dashboard templates, see About Dashboard
Templates on page 128.
— Display Taskflow Dashboards Only: Select this check box if you want to restrict this admin group to access
only the Tasks Dashboard in Grid Manager. Note that when you select this check box, users in this admin
group have access to the tasks you specified in the selected dashboard template, if applicable. They cannot
perform any other tasks or manage any core network services in Grid Manager the next time they log in to
the system.
5. Click Next to add admin email addresses if you want the appliance to send approval workflow notifications to a
list of email addresses for the admin group. Complete the following in the Email Address table:
Click the Add icon and Grid Manager adds a row to the table. Enter the email address of the admin who should
receive workflow notifications. You can click the Add icon again to add more email addresses. You can also
select an email address and click the Delete icon to delete it. To modify an email address, click the Email
Address column and modify the existing address.

Note: When you configure an approval workflow and select Group Email Address(es) as the approver
notification addresses, the appliance sends workflow notifications to all email addresses you have added
to this table. For information, see Creating Approval Workflows on page 87.

6. Optionally, click Next to add or delete extensible attributes for this admin group. For information, see About
Extensible Attributes on page 393.
7. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 191

Managing Administrators

About Admin Roles

An admin role is a group of permissions that you can apply to one or more admin groups. Roles allow you to quickly
and easily apply a suite of permissions to an admin group. You can define roles once and apply them to multiple
admin groups. The appliance contains the following system-defined admin roles:
• DHCP Admin: Provides read/write access to all network views, all DHCP MAC filters, all Grid members, and all
Microsoft servers that are managed by the Grid. It also provides read-only access to all DHCP templates and
DHCP lease history.
• DNS Admin: Provides read/write access to all Grid members, all Microsoft servers that are managed by the Grid,
all shared record groups, and all DNS views.
• DTC Admin: Provides read/write access to all DTC objects, such as LBDNs, LBDN records, pools, servers,
monitors, certificates, GeoIP, and topologies.
• File Distribution Admin: Provides read/write access to Grid file distribution properties.
• Grid Admin: Provides read/write access to all DNS views, all shared record groups, all members, all Microsoft
servers that are managed by the Grid, all network views, all DHCP MAC filters, all DHCP templates, DHCP lease
history, Grid File distribution properties, network discovery, task scheduling, and all Dashboard tasks.
• Load Balancer Admin: Provides read/write access to all load balancer resources.
• PKI Admin: Provides read/write access to all HSM groups, all OCSP groups, and all CA certificates.
• DHCP Fingerprint: Provides read/write access to all DHCP fingerprint related objects.
You can assign these system-defined roles to admin groups and create additional roles based on the job functions in
your organization. If you are creating a role that has similar permissions to an existing role, you can copy the role and
then make the necessary modifications to the new role. Thus you do not have to create each new role from scratch.
You can assign up to 21 roles to an admin group, and you can assign a role to more than one admin group. When you
make a change to a role, the appliance automatically applies the change to that role in all admin groups to which the
role is assigned.

Creating Admin Roles

There are two ways to create an admin role. You can create a new role and define its permissions, or you can copy an
existing role and redefine the configuration for the new role.
To create a new role from scratch:
1. From the Administration tab, select the Administrators tab -> Roles tab, and then click the Add icon.
2. In the Add Role wizard, complete the following:
— Name: Enter a name for the role.
— Comment: Enter useful information about the role. For example, if you are creating a role for IT personnel,
you can put the information here.
— Disable: Select this to retain an inactivated profile for this admin role in the configuration.
3. Optionally, click Next to add extensible attributes to this role. For information, see About Extensible Attributes
on page 393.
4. Click Next and select one of the following:
— Save & Add Permissions: Save the entry and add permissions to the role. Grid Manager displays the
Permissions tab with the newly created role selected. You can then add permissions to this role. For
information, see About Administrative Permissions on page 195.
— Save & Close: Save the entry and close the wizard.
— Save & Edit: Save the entry and continue to edit.
— Save & New: Save the entry and open a new wizard.

192 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Admin Groups and Admin Roles

To copy an existing role:

1. From the Administration tab, select the Administrators tab -> Roles tab -> admin_role check box, and then click
Clone from the Toolbar.
2. The Copy Role editor provides the following tabs from which you can modify data for the new role:
— General: Enter the name and information about the new role. You can also disable the role in this tab.
— Admin Groups: Displays a list of admin groups that are currently using this role. You cannot modify the list.
— Extensible Attributes: Add and delete extensible attributes that are associated with the admin role. You can
also modify the values of the extensible attributes. For information, see About Extensible Attributes on
page 393.
3. Save the configuration and click Restart if it appears at the top of the screen.
The appliance displays the new role in the Roles tab.
After you create roles, you can do the following:
• Define their permissions. For information and guidelines on defining permissions, see About Administrative
Permissions on page 195.
• Assign roles to admin groups, as described in Creating Limited-Access Admin Groups on page 190.

Managing Admin Groups and Admin Roles

After you create an admin group or an admin role, you can view, modify, and delete it.

Modifying Admin Groups and Roles

To modify an admin group:
1. From the Administration tab, select the Administrators tab -> Groups tab -> admin_group check box, and then
click the Edit icon.
2. The Admin Group editor provides the following tabs from which you can modify data:
— General: You can modify the following data.
— Name: Modify the name of the admin group.
— Comment: Enter useful information about the group, such as location or department.
— Disable: Select this to retain an inactivated profile for this admin group in the configuration. For
example, you may want to define a profile for recently hired administrators who have not yet started
work. Then when they do start, you simply need to clear this check box to activate the profile.
— Roles: Modify the data as described in Creating Limited-Access Admin Groups on page 190.
— Extensible Attributes: Add and delete extensible attributes that are associated with the admin group. You
can also modify the values of the extensible attributes. For information, see About Extensible Attributes on
page 393.
3. Save the configuration and click Restart if it appears at the top of the screen.

Deleting Admin Groups and Roles

You can remove any default or custom admin group as long as it is not your own admin group or the last admin group.
You can also delete any default or custom admin role. The appliance puts the deleted roles in the Recycle Bin, if
enabled.
To delete an admin group:
1. From the Administration tab, select the Administrators tab -> Groups tab -> admin_group check box, and then
click the Delete icon.
2. In the Delete Confirmation dialog box, click Yes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 193

Managing Administrators

To delete an admin role:

1. From the Administration tab, select the Administrators tab -> Roles tab -> admin_role check box, and then click
the Delete icon.
2. In the Delete Confirmation dialog box, click Yes.

Viewing Admin Groups

You can view the list of admin groups that are currently in the Grid. To view admin groups, from the Administration
tab, select the Administrators tab -> Groups tab.
Grid Manager displays the following information:
• Name: The name of the admin group.
• Superuser: Indicates whether the admin accounts that you assign to this group have full authority to view and
configure all types of data. The value can be Yes or No.
• Comment: The information about the admin group.
You can select the additional fields, Disabled and Site, for display.
You can also do the following:
• Sort the data in ascending or descending order by column.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 69.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 63.
• Print or export the data.

Viewing Admin Roles

You can view the list of admin roles that are currently in the Grid. To view admin roles, from the Administration tab,
select the Administrators tab -> Roles tab.
Grid Manager displays the following information:
• Name: The name of the admin role.
• System: Indicates whether the admin role is system defined or not. The value can be Yes or No.
• Comment: The information about the admin role.
You can select the additional fields, Disabled and Site, for display. You can also do the following:
• Sort the data in ascending or descending order by column.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 69.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 63.
• Print or export the data.

194 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Administrative Permissions

Viewing Admin Group Assignments

After you define permissions for an admin role, you can assign it to multiple admin groups. You can view the list of
admin groups to which an admin role is assigned, as follows:
1. From the Administration tab, select the Administrators tab -> Roles tab -> admin_group check box, and then click
the Edit icon.
2. In the Role editor, select the Admin Groups tab.
Grid Manager displays the list of admin groups to which the role is assigned.

About Administrative Permissions

You can assign permissions to admin roles which you then assign to admin groups, or you can assign permissions
directly to an admin group. The following are permissions you can grant admin groups and roles:
• Read/Write (RW): Allows admins to add, modify, delete, view, and search for a resource.
• Read-Only (RO): Allows admins to view and search for a resource. Admins cannot add, modify, or delete the
resource.
• Deny: Prevents admins from adding, modifying, deleting, and viewing a resource. This is the default permission
level for all resources.
By default, the superuser group (admin-group) has full access to all resources on the appliance. Superusers can
create limited-access admin groups and grant them permissions to resources at the global and object levels.
Limited-access admin groups must have either read-only or read/write permissions assigned in order to view
information or perform tasks on any supported objects.
When you assign permissions at the global level, the permissions apply to all objects that belong to the specified
resource. For example, when you define a read/write permission to all DHCP networks, the permission applies to all
DHCP ranges and fixed addresses in the networks. For information about global permissions, see Defining Global
Permissions on page 196.
You can also define permissions at a more granular level, such as for a specific Grid member, DNS zone, Response
Policy Zone, network, and even an individual database object, such as a resource record or fixed address. When you
define a permission at the object level, admins with this permission can only manage the specified object and its
associated objects. For information about object permissions, see Defining Object Permissions on page 200.
You can use global and object permissions to restrict admins to specific DNS and DHCP resources on specific Grid
members by assigning the appropriate permissions. You can use this feature to separate DNS and DHCP
administration on selected Grid members. For more information, see Defining DNS and DHCP Permissions on Grid
Members on page 202.
You can configure global permissions, object permissions, and member DNS and DHCP permissions for default and
custom admin groups and roles. You cannot however define permissions for the factory default roles, such as DHCP
Admin.
The appliance supports the following permissions:
• Grid permissions: Includes Grid DNS properties, Grid DHCP properties, all Grid members, Microsoft servers that
are managed by the Grid, network discovery, task scheduling, CSV imports, and all dashboard tasks.
• IPAM permissions: Includes network views, IPv4 and IPv6 networks, and host records.
• DHCP permissions: Includes Grid DHCP properties, network views, IPv4 networks, host records, DHCP ranges,
DHCP fixed addresses/reservations, DHCP enabled host addresses, Mac filters, shared networks, DHCP
templates, lease history, and roaming hosts.
• DNS permissions: Includes Grid DNS properties, DNS views, DNS zones, Response Policy Zones, host records,
bulk hosts, all DNS resource records, all shared records, and adding a blank A/AAAA record.
• File distribution permissions: Includes Grid-level file distribution properties.
• Reporting permissions: Includes Grid-level reporting properties.
• Administration permissions: Includes all OCSP server groups and CA certificates.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 195

Managing Administrators

• GLB (Global Load Balancer) permissions: Includes all NIOS managed GLB objects.
• DHCP fingerprint permissions: Includes all DHCP fingerprint related objects.
• Named ACL permissions: Includes all named ACLs (access control lists).
• Cloud permissions: Includes all tenant objects.
NIOS applies permissions hierarchically in a parent-child structure. When you define permissions for a resource, all
objects within that resource inherit the same permissions. For example, when you grant an admin group read/write
permission for a network, the admin group automatically has read/write permission for objects in that network. To
override permissions set at a higher level, you define permissions at a more specific level. For example, you can
override the read/write network-level permission by setting read-only or deny permission for a fixed address or a
DHCP-enabled host address. To define permissions for a more specific level, see the following:
• Permissions for common tasks, as described in Administrative Permissions for Common Tasks on page 234.
• Permissions for the Grid and Grid members, as described in Administrative Permission for the Grid on page
237.
• Permissions for IPAM resources, such as IPv6 networks, as described in Administrative Permissions for IPAM
Resources on page 240.
• Permissions for DNS resources, such as DNS views and A records, as described in Administrative Permissions
for DNS Resources on page 241.
• Permissions for DNS resource with associated IP addresses in networks and ranges, as described in
Administrative Permissions for DNS Resources with Associated IP addresses in Networks and Ranges on page
247.
• Permissions for DHCP resources, such as network views and fixed addresses, as described in Administrative
Permissions for DHCP Resources on page 253.
• Permissions for file distribution services, as described in Administrative Permissions for File Distribution
Services on page 262
• Permissions for OCSP server groups and CA certificates, as described in Administrative Permissions for OCSP
Server Groups and CA Certificates on page 264.
• Permissions for GLB and GLB objects, as described in Administrative Permissions for Load Balancers on page
264
• Permissions for Cloud objects, as described in Administrative Permissions for Cloud Objects on page 267.
When you set permissions that overlap with existing permissions, Grid Manager displays a warning about the
overlaps. You can view detailed information and find out which permissions the appliance uses and which ones it
ignores. For information, see Applying Permissions and Managing Overlaps on page 204.

Defining Global Permissions

You can define permissions at a global level for an admin group or admin role.
To define global permissions:
1. For an admin group: From the Administration tab, select the Administrators tab -> Permissions tab -> admin_group
in the Groups table, and then click the Add icon -> Global Permissions from the Create New Permission area or
select Add -> Global Permissions from the Toolbar.
or
For an admin role: From the Administration tab, select the Administrators tab -> Permissions tab -> admin_role in
the Roles table, and then click Add icon -> Global Permissions from the Create New Permission area or select
Add -> Global Permissions from the Toolbar.
2. Grid Manager displays the Manage Global Permissions editor. For an admin group, the appliance displays the
selected admin group in the Group Permission field. For an admin role, the appliance displays the selected
admin role in the Role Permission field. You can also select a different group or role from the drop-down list.
3. Select the resources that you want to configure from the Permission Type drop-down list. Depending on your
selection, Grid Manager displays the corresponding resources for the selected permission type in the table.

196 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Administrative Permissions

4. Select Read/Write, Read-Only, or Deny for the resources you want to configure. By default, the appliance denies
access to resources if you do not specifically configure them.
5. Optionally, select additional resources from the Permission Type drop-down list. Grid Manager appends the new
resources to the ones that you have already configured. Define the permissions for the resources you select.
6. Save the configuration and click Restart if it appears at the top of the screen.
Table 4.2 lists global permissions you can assign to admin groups or admin roles:

Table 4.2 Global Permissions

Permissions (Read/Write, Read-Only, or Deny)

Administration All OCSP Services For more information, see Administrative Permissions
Permissions for OCSP Server Groups and CA Certificates on page
All CA Certificates
264.
Cloud Permissions All Tenants For more information, see Administrative Permissions
for Cloud Objects on page 267.
Named ACL Permissions Named ACL For more information, see Administrative Permissions
for Named ACLs on page 265.
DHCP Permissions Grid DHCP Properties For more information, see Administrative Permissions
for Common Tasks on page 234.
All Network Views For more information, see Administrative Permissions
for Network Views on page 254.
All IPV4/IPv6 Networks For more information, see Administrative Permissions
for IPv4 and IPv6 Networks and Shared Networks on
page 255.
All Hosts For more information, see Administrative Permissions
for Hosts on page 241.
All DHCP Fingerprints For more information, see Administrative Permissions
on page 1292.
All DHCP MAC Filters For more information, see Administrative Permissions
for MAC Address Filters on page 261.
All IPv4/IPv6 DHCP For more information, see Administrative Permissions
Fixed for IPv4 or IPv6 Fixed Addresses and IPv4 Reservations
Addresses/Reservation on page 257.
s
All IPv4/IPv6 Host For more information, see Administrative Permissions
Addresses for IPv4 or IPv6 DHCP Enabled Host Addresses on page
258.
All IPv4/IPv6 Ranges For more information, see Administrative Permissions
for IPv4 and IPv6 DHCP Ranges on page 258.
All IPv4/IPv6 Shared For more information, see Administrative Permissions
Networks for IPv4 and IPv6 Networks and Shared Networks on
page 255.
All IPv4/IPv6 DHCP For more information, see Administrative Permissions
Templates for IPv4 or IPv6 DHCP Templates on page 259.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 197

Managing Administrators

Permissions (Read/Write, Read-Only, or Deny)

All Microsoft For more information, see Administrative Permissions
Superscopes for IPv4 or IPv6 DHCP Templates on page 259.
All Roaming Hosts For more information, see Administrative Permissions
for Roaming Hosts on page 260.
DHCP IPv4/IPv6 Lease For more information, see Administrative Permissions
History for the IPv4 and IPv6 DHCP Lease Histories on page 262.
DNS Permissions Grid DNS Properties For more information, see Administrative Permissions
for Common Tasks on page 234.
All DNS Views For more information, see Administrative Permissions
for Common Tasks on page 234.
All DNS Zones For more information, see Administrative Permissions
for Common Tasks on page 234.
All Hosts For more information, see Administrative Permissions
for Hosts on page 241.
All IPV4/IPV6 Host For more information, see Administrative Permissions
Addresses for DNS Resources with Associated IP addresses in
Networks and Ranges on page 247.
All Resource Records (A, For more information, see Administrative Permissions
AAAA, CNAME, DNAME, for Common Tasks on page 234.
NAPTR, MX, PTR, SRV,
TXT and Bulkhost)
All Shared Record For more information, see Administrative Permissions
Groups for Shared Record Groups on page 245.
All Shared Records (A, For more information, see Administrative Permissions
AAAA, MX, SRV and TXT) for Common Tasks on page 234.
All Rulesets (BLACK List For more information, see Administrative Permissions
Rulesets and for DHCP Resources on page 253.
NXDOMAIN Rulesets)
All DNS64 Synthesis For more information, see Administrative Permissions
Groups for DNS64 Synthesis Groups on page 246.
All Response Policy For more information, see Administrative Permissions
Zones for Zones on page 243 and License Requirements and
Admin Permissions on page 1615.
All Response Policy For more information, see Administrative Permissions
Rules for Zones on page 243 and License Requirements and
Admin Permissions on page 1615.
All DTC Objects (LBDN For more information, see License Requirements and
Records, LBDNs, Pools, Admin Permissions on page 940
Servers, Monitors,
Certificates, GeoIP and
Topologies)
Adding a blank A/AAAA For more information, see Administrative Permissions
record for Common Tasks on page 234.

198 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Administrative Permissions

Permissions (Read/Write, Read-Only, or Deny)

File Distribution Grid File Distribution For more information, see Administrative Permissions
Permissions Permissions for File Distribution Services on page 262.
Grid Permissions All Members For more information, see Administrative Permissions
for Common Tasks on page 234.
Network Discovery For more information, see Administrative Permissions
for Network Discovery on page 238.
Schedule Tasks For more information, see Administrative Permissions
for Scheduling Tasks on page 238.
CSV Import For more information, see Administrative Permissions
for CSV Import on page 267.
All Microsoft Servers For more information, see Administrative Permissions
for Microsoft Servers on page 239.
All Dashboard Tasks For more information, see Administrative Permissions
for Dashboard Tasks on page 263.
All Kerberos keys For more information, see Admin Permissions for
Configuring GSS-TSIG keys on page 887.
All Active Directory For more information, see Managing Active Directory
Domains Sites on page 1201.
IPAM Permissions All Network Views For more information, see Administrative Permissions
for Common Tasks on page 234.
All IPv4 Networks For more information, see Administrative Permissions
for IPv4 and IPv6 Networks on page 240.
All IPv6 Networks For more information, see Administrative Permissions
for IPv4 and IPv6 Networks on page 240.
All Hosts For more information, see Administrative Permissions
for Hosts on page 241.
All IPv4 Host Addresses For more information, see Administrative Permissions
for DNS Resources with Associated IP addresses in
Networks and Ranges on page 247.
All IPv6 Host Addresses For more information, see Administrative Permissions
for DNS Resources with Associated IP addresses in
Networks and Ranges on page 247.
Port Control For more information, see Administrative Permissions
for Network Discovery on page 238.
Security Permissions Grid Security For more information, see Administrative Permissions
Permissions on page 1589.
Reporting Permissions Grid Reporting For more information, see Administrative Permissions
Permissions for Common Tasks on page 234.
Reporting Dashboard For more information, see Administrative Permissions
for Reporting on page 267.
Reporting Search For more information, see Administrative Permissions
for Reporting on page 267.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 199

Managing Administrators

Defining Object Permissions

You can add permissions to specific objects for selected admin groups or roles. When you add permissions to
objects, you can select multiple objects with the same or different object types. When you select multiple objects with
the same object type, you can apply permissions to the selected objects as well as the sub object types that are
contained in the selected objects. As described in Figure 4.2, when you select five DNS forward-mapping
authoritative zones, the appliance displays the object type “AuthZone” for all the zones. Since all five DNS zones are
of the same object type, you can also apply permissions to all the resource records in these zones. The appliance
displays the resources in the resource section of the Create Object Permissions editor. You can choose one or more
of the resources to which you want to apply permissions.
In Cloud Network Automation, admin groups and admin users who have cloud API access have full permissions to
delegated. However, you must specifically assign permissions for objects that have not been delegated in order for
any admin groups or admin users to gain permission to these objects. Therefore, an admin group that has access to
the cloud API would have full permissions to all delegated objects but limited permissions to non-delegated objects.
For information about how to allow cloud API access to an admin group, see Creating Limited-Access Admin Groups
on page 190. For information about guidelines for authority delegation, see About Authority Delegation on page 376.

Figure 4.2 Selecting Multiple Objects with the Same Object Type

1 You select five forward-mapping The appliance displays the common

3
authoritative DNS zones that have resources in the Resources in
resource records such as A records, Selected Objects column.
Hosts, and CNAME records.

2 Since all DNS zones

corp100.com have the same
object type, you
can apply object
corp200.com permissions to
all the DNS zones
as well as to all the
resource records
corp300.com in the DNS zones.

corp400.com

corp500.com

When you select multiple objects with more than one object type, you can add permissions to the selected objects
as well as to the sub object types that are common among the selected objects. For example, when you select three
DNS forward-mapping authoritative zones and two DNS IPv4 reverse-mapping authoritative zones as illustrated in
Figure 4.3, you can apply permissions to all the five DNS zones as well as to the CNAME, DNAME, and host records in
these zones because CNAME, DNAME, and host records are the common sub object types in these zones.

200 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Administrative Permissions

Figure 4.3 Multiple Objects with Common Sub Object Types

When you select three DNS forward-mapping authoritative zones and two IPv4 reverse-mapping
authoritative zones, you can apply object permissions to all the DNS zones as well as the CNAME,
DNAME and Host records in these DNS zones.

CNAME records in
corp100.com 0.0.10.in-addr.arpa selected objects

DNAME records in
corp200.com 0.0.127.in-addr.arpa selected objects

Hosts in selected
corp300.com objects

To define object permissions for an admin group or role:

1. For an admin group: From the Administration tab, select the Administrators tab -> Permissions tab -> admin_group
in the Groups table, and then click the Add icon -> Object Permissions from the Create New Permission area or
select Add -> Object Permissions from the Toolbar.
or
For an admin role: From the Administration tab, select the Administrators tab -> Permissions tab -> admin_role in
the Roles table, and then click Add icon -> Object Permissions from the Create New Permission area or select
Add -> Object Permissions from the Toolbar.
2. Grid Manager displays the Create Object Permissions wizard. For an admin group, the appliance displays the
selected group in the Group Permission field. For an admin role, the appliance displays the selected admin role
in the Role Permission field. You can also select a different group or role from the drop-down list.
3. Click Select Object(s). Grid Manager displays the Object Selector dialog box.
4. In the Object Selector dialog box, complete the following:
— Enter a value or partial value of an object in the first field. This field is not case-sensitive. For example, if the
object to which you want to define permissions contains “Infoblox”, enter Infoblox here.
— Select the object type for which you are searching in the Type drop-down list. By default, the appliance
searches all object types.
— In the operator drop-down list, select an operator for the filter criteria. Depending on what you select in the
first filter field, this list displays the relevant operators for the selection.
— In the value field, enter or select the attribute value for the first filter field. Depending on what you select for
the first two filter fields, you can either enter a value or select a value from a drop-down list.
5. Click Search. The appliance lists all matching objects in the table. You can select multiple object types by clicking
the Add icon to add more filter criteria. You can also click Reset to clear all entries.
6. Select the check boxes of the objects to which you are defining permissions, and then click the Select icon.
7. In the Create Object Permissions wizard, do the following:
— Object: Displays the name of the selected object. When you select multiple objects, the appliance displays
Multiple here. Mouse over to the information icon to view the list of objects to which you are defining
permissions.
— Object Type: Displays the object type of the selected object. When you select more than one object type,
the appliance displays Multiple here.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 201

Managing Administrators

— Resource: Displays the selected objects. When you select more than one object type, the appliance
displays Multiple Selected Objects here. Mouse over to the information icon to view the list of objects to
which you are defining permissions. Grant the resources an appropriate permission: Read/Write, Read
Only, or Deny.
8. Save the configuration and click Restart if it appears at the top of the screen.
Grid Manager displays a warning message when the permissions you define here overlap with other permissions in
the system. Click See Conflicts to view the overlapping permissions in the Permissions Conflict dialog box. For
information, see Applying Permissions and Managing Overlaps on page 204.
You can also set permissions for specific objects from the objects themselves. For example, to define permissions for
a particular Grid member, navigate to that Grid member and define its permissions.
To define the permissions of a specific object:
1. Navigate to the object. For example, to define permissions for a particular network, from the Data Management
tab, select the IPAM tab -> network check box, and then click the Edit icon.
2. In the editor, select the Permissions tab, and then do one of the following:
— Click the Add icon to add permission to the object. In the Admin Group/Role Selector dialog box, select an
admin group or role to which you want to assign the permission, and then click the Select icon.
— Modify the permission and resource type of a selected admin group or role.
— Select an admin group or role and click the Delete icon to delete it.
3. Save the configuration and click Restart if it appears at the top of the screen.

Defining DNS and DHCP Permissions on Grid Members

You can restrict certain admin groups or roles to perform specific DNS and DHCP tasks on specific Grid members by
assigning the correct global and object permissions. You can use this feature to separate the DNS and DHCP
administration on different Grid members. For example, you can create an admin group or role that can only create,
modify, and delete DHCP ranges in a specific network on a specific member in the Grid. This admin group or role is
restricted to the specified tasks on the selected Grid member. It cannot perform other DNS or DHCP tasks on this
member, and it cannot perform the specified tasks on other Grid members.
For example, you can define permissions that allow admins to create, modify, and delete DHCP ranges in network
10.0.0.0/8 on Grid member “sales.infoblox.com” by granting read/write object permissions to all DHCP ranges,
network 10.0.0./8, and member DHCP on sales.infoblox.com. Admins with these permissions can only add, modify,
and delete DHCP ranges in network 10.0.0.0/8 on Grid member sales.infoblox.com. They cannot perform other DHCP
or DNS tasks on the member, and they cannot perform these tasks on other Grid members.
For information about required permissions for specific DNS and DHCP tasks, see Administrative Permissions for
Common Tasks on page 234.
You can define the following DNS and DHCP permissions for an admin group or role:
• Grid DNS or Grid DHCP: Admins with read/write permissions can manage any DNS or DHCP resources on any
Grid members. They can also modify Grid DNS or Grid DHCP properties and any member DNS and member DHCP
properties. Admins with read-only permissions can only view DNS or DHCP resources. They cannot modify any
DNS or DHCP resources or restart related services.
• Member DNS or Member DHCP: Admins with read/write permissions can perform the defined DNS or DHCP
tasks only on the specified Grid member, not any other members. They can also modify DNS or DHCP properties
on the specified member. Admins with read-only permission cannot assign the Grid member to any DNS or
DHCP resources.
• Restart DNS or Restart DHCP on member: Admins with read/write permissions can restart the DNS or DHCP
service on the specified Grid member, not any other members. However, they cannot modify DNS or DHCP
properties on the member. They can assign the specified Grid member to any DNS or DHCP resources, but they
cannot assign any other Grid members to DNS or DHCP resources.

202 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Administrative Permissions

To specify member DNS and DHCP permissions, define DNS or DHCP permissions at the global or object level for an
admin group or admin role, as described in Defining Global Permissions on page 196 and Defining Object
Permissions on page 200. Ensure that you include the Grid member object to which you want to restrict DNS or DHCP
administration. You can assign valid permissions to administrators to manage kerberos keys. For more information,
see Admin Permissions for Configuring GSS-TSIG keys on page 887.
You can also control whether the admins can modify DNS or DHCP properties on a member, as described in Modifying
Permissions on a Grid Member on page 203.

Modifying Permissions on a Grid Member

Admins can perform different tasks on a Grid member based on the permissions they have. Table 4.3 outlines the
permissions and the tasks admins can perform on a Grid member:

Table 4.3 Member Permissions and Tasks

Member DNS or DHCP Restart DNS or DHCP on Grid

Grid Member
Properties Member
Read/Write • Modify member • Modify member DNS or • Restart member DNS or
properties DHCP properties DHCP service
• Restart, reboot, and • Restart member DNS or • Assign and un-assign
shutdown member DHCP service member to DNS or DHCP
• Modify member DNS and • Assign and un-assign objects
DHCP properties member to DNS or DHCP
• Restart member DNS and objects
DHCP services
• Assign and un-assign
member to DNS and
DHCP objects
Read-only • View member DNS and • View member DNS or • N/A (You cannot define a
DHCP properties DHCP properties read-only permission)
Deny • Cannot modify member, • Cannot modify member, • Cannot modify member,
DNS, and DHCP DNS, and DHCP DNS, and DHCP
properties properties properties
• Cannot restart related • Cannot restart related • Cannot restart related
services services services
• Cannot assign member • Cannot assign member • Cannot assign member
to DNS and DHCP objects to DNS and DHCP objects to DNS and DHCP objects

After you add permissions to an admin group or role for a specific Grid member, you can modify the member
permissions and resources. Note that when you modify the member permissions and resources, the appliance
updates the permissions of the admin group or role accordingly.
To modify Grid member permissions:
1. From the Data Management tab, select the DHCP or DNS tab -> Members tab -> Grid_member, and then click the
Edit icon.
2. In the Member DHCP Properties or Member DNS Properties editor, select the Permissions tab.
3. Click a permission in the Permissions table, select a different permission from the Permissions drop-down list or
select a different resource from the Resources drop-down list. Note that when you select Restart DNS or Restart
DHCP, the admins with this permission can only restart the DNS or DHCP service on the selected member. They
cannot modify DNS or DHCP properties of this member.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 203

Managing Administrators

4. Save the configuration. Note that the appliance automatically updates the permissions of the corresponding
admin group or role in the Administration tab.

Applying Permissions and Managing Overlaps

When an admin tries to access an object, the appliance checks the permissions of the group to which the admin
belongs. Because permissions at more specific levels override those set at a higher level, the appliance checks object
permissions hierarchically—from the most to the least specific. In addition, if the admin group has permissions
assigned directly to it and permissions inherited from its assigned roles, the appliance checks the permissions in the
following order:
1. Permissions assigned directly to the admin group.
2. Permissions inherited from admin roles in the order they are listed in the Roles tab of the Admin Group editor.
For example, an admin from the DNS1 admin group tries to access the a1.test.com A record in the test.com zone in
the Infoblox default view. The appliance first checks if the DNS1 admin group has a permission defined for the
a1.test.com A record. If there is none, then the appliance checks the roles assigned to DNS1. If there is no permission
defined for the a1.test.com A record, the appliance continues checking for permissions in the order listed in
Table 4.4. The appliance uses the first permission it finds.

Table 4.4 Permission Checking

The appliance checks object permissions from For each object, the appliance checks permissions
the most to the least specific, as listed. in the order listed.
1. a1.test.com A record a. DNS1 admin group
2. A records in test.com b. Role 1, Role, 2, Role 3…
3. test.com
4. All zones in the default view
5. Default view
6. All A records
7. All zones
8. All DNS views

An admin group that is assigned multiple roles and permissions can have overlaps among the different permissions.
As stated earlier, the appliance uses the first permission it finds and ignores the others. For example, as shown in
Table 4.5, if an admin group has read/write permission to all A records in the test.com zone and a role assigned to it
is denied permission to test.com, the appliance provides read/write access to A records in the test.com zone, but
denies access to the test.com zone and all its other resource records.

Table 4.5 Directly-Assigned Permissions and Roles

Permission assigned to the admin group Read/Write to all A records in the test.com
zone
Permission inherited from an admin role Deny to the test.com zone
Effective permissions Deny to the test.com zone
Read/Write to all A records in test.com zone
Deny to all other resource records in test.com
zone

204 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Administrative Permissions

If the group has multiple roles, the appliance applies the permissions in the order the roles are listed. If there are
overlaps in the permissions among the roles, the appliance uses the permission from the role that is listed first. For
example, as shown in Table 4.6, the first role assigned to the admin group has read-only permission to all A records
in the test.com zone and the second role has read/write permission to the same records. The appliance applies the
permission from the first admin role.

Table 4.6 Multiple Roles

Role 1 permission Read-only to all A records in the test.com zone

Role 2 permission Read/Write to all A records in test.com zone
Read/Write to all MX records in test.com zone
Effective permissions Deny to the test.com zone
Read-only to all A records in the test.com zone
Read/Write to all MX records in test.com zone

You can check for overlapped permissions when you add permissions to roles and to admin groups, and when you
assign roles to an admin group. When you create a permission that overlaps with existing permissions, Grid Manager
displays a warning message and the See Conflicts link on which you click to view the overlapped permissions. For
information, see Viewing Overlapping Permissions on page 205. You can also use the quick filter Overlaps to filter
overlapped permissions, the appliance lists permissions that overlap with other permissions. If you want to change
the permission the appliance uses, you must change the order in which the roles are listed or change the permissions
that are directly assigned to the admin group. For information, see Creating Limited-Access Admin Groups on page
190.

Viewing Overlapping Permissions

When you click See Conflicts to view overlapping permissions, Grid Manager displays the following information in the
Permission Overlap dialog box:
• Resource: The name of the object or resource.
• Type: The object type.
• Permission: The permission granted. This can be Read/Write, Read-Only, or Deny.
• Inherited From: Indicates the source from which the permission is inherited.
• Conflict Status: Indicates whether the permission is being used or ignored. In a permission overlap, the group
permission always overrides the role permission if both permissions are set at the same level (global or object).
However, if the permissions are set at different levels, the permission at a more specific level overrides that set
at a higher level.
• Role/Group Name: The name of the admin group or admin role.
You can click the arrow key next to the resource to view the permission that is being ignored in the overlap.

Managing Permissions
After you define permissions for an admin group and role, you can do the following:
• View the permissions, as described in Viewing Permissions on page 206.
• Modify the permissions, as described in Modifying Permissions on page 206.
• Delete the permission, as described in Deleting Permissions on page 206.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 205

Managing Administrators

Viewing Permissions
Only superusers can view the permissions of all admin groups.
To view the permissions of an admin group or role:
1. From the Administration tab, select the Administrators tab -> Permissions tab.
2. For an admin group: Select an admin group in the Groups table.
or
For an admin role: Select an admin role in the Roles table.
3. Grid Manager displays the following information in the Permissions table:
— Group/Role: The name of the admin group or role.
— Permission Type: The type of permissions. This can be Administration Permissions, Analytics Permissions,
Cloud Permissions, Named ACL Permissions, DHCP Permissions, DNS Permissions, File Distribution
Permissions, Grid Permissions, IPAM Permissions, Reporting Permissions, or Security Permissions.
— Resource: The name of the object. For example, this field displays All Hosts if you have defined permissions
for all the hosts in the Grid.
— Resource Type: The object type. For example, this can be Host, PTR record, or Shared Network.
— Permission: The defined permission for the resource.
When you click Show All for Admins, Groups, and Roles, Grid Manager displays all the admin accounts, admin groups,
and admin roles in their respective tables.

Filtering the List of Permissions

You can filter the permissions you want to view by selecting one of the following from the quick filter menu:
• Effective Permissions: Select to view only the permissions that the appliance is using for this group. The
permissions that were ignored due to overlaps are not listed in this view.
• Overlaps: Select to view only the overlapped permissions.
• All Configured Permissions: Select to view all permissions.

Modifying Permissions
You can modify the permissions of user-defined admin roles and admin groups. You cannot modify the permissions
of system-defined admin roles. When you change the permissions of a role that has been assigned to multiple admin
groups, the appliance automatically applies the change to the role in all admin groups to which it is assigned.
To modify the existing permissions of a role or an admin group:
1. From the Administration tab, select the Administrators tab -> Permissions tab.
2. For an admin group: Select an admin group in the Groups table.
or
For an admin role: Select an admin role in the Roles table.
3. In the Permissions table, select the resource that you want to modify, and then click the Edit icon.
4. In the Mange Global Permissions or Create Object permissions editor, select the new permission: Read/Write,
Read-Only or Deny for the resource.
5. Save the configuration and click Restart if it appears at the top of the screen.

Deleting Permissions
You can remove permissions from user-defined admin roles and admin groups. You cannot remove permissions from
system-defined admin roles. When you remove permissions from a role, they are removed from the role in all admin
groups to which the role is assigned. You can remove a permission from a group as long as it is not inherited from a
role. You cannot remove permissions that are inherited from a role.

206 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Administrators

To delete a permission:
1. From the Administration tab, select the Administrators tab -> Permissions tab.
2. For an admin group: Select an admin group in the Groups table.
or
For an admin role: Select an admin role in the Roles table.
3. In the Permissions table, select the resource that you want to modify, and then click the Delete icon.
4. In the Delete Permission Confirmation dialog box, click Yes.

Authenticating Administrators
The NIOS appliance supports the following authentication methods: local database, RADIUS, Active Directory, LDAP,
and TACACS+. The appliance can use any combination of these authentication methods. It authenticates admins
against its local database by default. Therefore, if you want to use local authentication only, you must configure the
admin groups and add the local admin accounts, as described in Creating Local Admins on page 208.
Depending on where admin user credentials are stored, you can configure the NIOS appliance to authenticate admins
locally or remotely. When you configure the authentication type as "local," NIOS authenticates admins against its
local database. When you configure the authentication type as "remote," NIOS authenticates admins whose user
credentials are stored remotely on authentication servers, such as RADIUS servers, AD domain controllers, LDAP
servers, or TACACS+ servers.
Note the following when you configure remote authentication type for local admins:
• You cannot define two local admins that have the same name and belong to different authentication server
groups.
• Only superusers can modify the authentication type for other admin accounts.
• At least one superuser account must use the remote authentication type.
To authenticate admins using RADIUS, Active Directory, TACACS+, or LDAP in addition to local authentication, you
must define those services on the appliance and define the admin authentication policy. For information, see About
Remote Admins on page 211.
The appliance also supports two-factor authentication that validates smart card users, such as the U.S. Department
of Defense (CAC) Common Access Card users. In two-factor authentication, NIOS first authenticates admins through
the admin authentication policy, and then validates the admin client certificates through the OCSP service. For more
information about two-factor authentication and how to configure it, see Defining the Authentication Policy on page
227.

Note: If you are using remote authentication, you must always have at least one local admin in a local admin group
to ensure connectivity to the NIOS appliance in case the remote servers become unreachable.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 207

Managing Administrators

Creating Local Admins

When you create an admin account, you must specify the authentication type, name, password, and admin group of
the administrator. You can also control in which time zone the appliance displays the time in the audit log and the
DHCP and IPAM tabs of Grid Manager, such as the DHCP Lease History and DHCP Leases panels. The appliance can
use the time zone that it automatically detects from the management system that the admin uses to log in.
Alternatively, you can override the time zone auto-detection feature and specify the time zone.
To create an admin account and add it to an admin group:
1. Log in as a superuser.
2. From the Administration tab, select the Administrators tab -> Admins tab, and then click the Add icon.
or
From the Administration tab, select the Administrators tab -> Groups tab -> admin_group, and then click the Add
icon.
3. In the Add Administrator wizard, complete the following:
— Authentication Type: You can select either Local or Remote from the drop-down list. The default is Local.
When you select Local, NIOS authenticates admins against its local database. When you select Remote,
NIOS authenticates admins based on the user credentials stored remotely on authentication servers, such
as RADIUS servers, AD domain controllers, LDAP servers, or TACACS+ servers.
Local: The following fields are displayed when you select Local authentication type. Enter the following:
— Login: Enter a name for the administrator. This is the username that the administrator uses to log in to
the appliance. This username is stored in the NIOS local database.
— Password: Enter a password for the administrator. This is the password that the administrator uses to
log in to the appliance. This password is stored in the NIOS local database.
— Confirm Password: Enter the same password.
Remote: The following field is displayed when you select Remote authentication type. Enter the following
login credentials:
— Login: Enter a name for the administrator that is stored in the database of the remote server. This is the
username that the administrator uses to log in to the appliance.

Note: You cannot configure the Remote authentication type for NIOS admin users who belong to the
fireeye-group admin groups.

— Email Address: Enter the email address for this administrator. The appliance uses this email address to
send scheduling notifications.
— Admin Group: Click Select to specify an admin group. If there are multiple admin groups, Grid Manager
displays the Admin Group Selector dialog box from which you can select one. An admin can belong to only
one admin group at a time.
NIOS appliance creates a new group, fireeye-group, when you add the first FireEye zone. The FireEye admin
group is read-only and you cannot assign permissions to it. Select fireeye-group for the admin group and
add users to this group. For more information, see About FireEye Integrated RPZs on page 1637.

Note: You cannot add a NIOS admin user that uses the Remote authentication type to the fireeye-group admin
group.

— Comment: Enter useful information about the administrator.

— Disable: Select this check box to retain an inactive profile for this administrator in the configuration. For
example, you might want to define a profile for a recently hired administrator who has not yet started work.
Then when he or she does start, you simply need to clear this check box to activate the profile.

208 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating Local Admins

4. Optionally, click Next to add extensible attributes to the admin account. For information, see About Extensible
Attributes on page 393.
5. Save the configuration and click Restart if it appears at the top of the screen.

Managing Passwords
Superusers can define requirements for the passwords of local admins according to your organization’s policies. In
addition to specifying the minimum password length, you can define rules that specify the character types that are
allowed in the password. You can also specify whether passwords expire, their duration, and when reminders are
sent to the users. Additionally, you can require admins to change their passwords when they first log in or after their
passwords are reset.
You set the requirements at the Grid level, so they apply to all local admins who log in to the Grid. The requirements
that you define appear in the User Profile of all local admins and when users are required to change their password.
To define the password requirements for local admins:
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and select Grid Properties -> Edit.
3. In the Grid Properties editor, select the Password tab and complete the following:
— Minimum Password Length: Specify the minimum number of characters that are required in a password.
— Password Complexity: You can set up some requirements around how users compose a password by
specifying the category and the number of characters and/or symbols the password must contain. The
default is 0 for all categories, which means the password is not required to contain those characters.
Specify the minimum number of characters the password must contain for the following:
— lowercase characters [a-z]
— uppercase characters [A-Z]
— numeric characters [0-9]
— symbol characters. Allowed characters are: ! @ # $ % ^ & * ( )
— character changes from previous passwords. To discourage users from reusing previous passwords,
you can require a minimum change of characters from previous passwords.
— Password must expire: Select this check box to enable passwords to expire after a specified period. Specify
the duration of each password and the number of days before the expiration that the appliance sends a
reminder.
— Force password change at next login: Select this check box to force all new users to change their passwords
when they first log in and to force existing users whose passwords were just reset to change their
passwords.

Note: The “force password change at next login” feature does not apply to admin users in the fireeye-group.
These users will not be prompted to change their passwords at the next login. Their original passwords
continue to work. For information about FireEye integrated RPZs, see About FireEye Integrated RPZs on
page 1637.

4. Click Save & Close.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 209

Managing Administrators

Modifying and Deleting Admin Accounts

You can modify and delete admin accounts that you create, but you can only partially modify the default superuser
account “admin”—and only when you are logged in as a superuser account. Furthermore, because there must always
be a superuser account on the appliance, you can only remove the default “admin” account after you create another
superuser account.
To modify an admin account:
1. From the Administration tab, select the Administrators tab -> Admins tab -> admin_account check box, and then
click the Edit icon.
or
From the Administration tab, select the Administrators tab -> Groups tab -> admin_group -> admin_account
check box, and then click the Edit icon.
2. The Administrator editor provides the following tabs from which you can modify data:
— General: In the General Basic tab, modify data of the admin account as described in Creating Local Admins
on page 208.
In the General Advanced tab, complete the following:
— Time Zone: Select a time zone from the drop-down list if you want to specify the time zone for the
administrator. By default, the appliance automatically detects the time zone from the management
system that the administrator uses to connect to the appliance. The appliance uses this time zone
when it displays the timestamps for relevant data.
— Extensible Attributes: Add and delete extensible attributes that are associated with the admin account. You
can also modify the values of the extensible attributes. For information, see About Extensible Attributes on
page 393.
3. Save the configuration and click Restart if it appears at the top of the screen.
To delete an admin account:
1. From the Administration tab, select the Administrators tab -> Admins tab -> admin_account check box, and then
click the Delete icon.
or
From the Administration tab, select the Administrators tab -> Groups tab -> admin_group -> admin_account
check box, and then click the Delete icon.
2. In the Delete Confirmation dialog box, click Yes.

210 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Remote Admins

About Remote Admins

NIOS can authenticate admins whose user credentials are stored remotely on RADIUS servers, AD domain controllers,
LDAP servers, or TACACS+ servers. You can configure authentication server groups for each type of server to which
NIOS sends authentication requests. For example, you can create a server group for RADIUS servers and another
server group for AD domain controllers. Then in the admin authentication policy, you can list which authentication
server groups to use and in what order.
In addition, if admin groups are configured on the remote authentication server, you can configure admin groups with
the same names on the NIOS appliance and list them in the authentication policy as well. Then if the remote
authentication server provides the admin group name while authenticating an admin, NIOS can automatically assign
the admin to the matching admin group specified in the authentication policy. You can also create a default admin
group for all admins that are authenticated through a remote authentication service.
Figure 4.4 illustrates the authentication and authorization process for remote admins. In the example, two
authentication server groups are configured—a RADIUS server group and an AD server group. When an admin logs in
with a user name and password, the appliance uses the first service listed in the admin policy to authenticate the
admin. If authentication fails, the appliance tries the next service listed, and so on. It tries each service on the list
until it is successful or all services fail. If all services fail, then the appliance denies access and generates an error
message in syslog.
If authentication succeeds, the NIOS appliance tries to match the admin group names in the admin policy to any
groups received from the remote server. If it finds a match, the NIOS appliance applies the privileges of that group to
the admin and allows access. If the appliance does not find a match, then it applies the privileges of the default
group. If no default group is defined, then the appliance denies access.

Figure 4.4 Authenticating Remote Admins

NIOS Appliance
Admin
2 The appliance first checks the local admin
policy, and then the admin policy for the
authentication service, which can be a RADIUS
1 An admin enters his user name RADIUS, AD, LDAP, or TACACS+ service. Server
and password to log in to the The appliance sends an Access-Request
appliance. packet to the RADIUS server.

Admin
Policy 3 The RADIUS server responds with an
Access-Reject package because the admin’s user
name and password are not in its database.

AD Server
4 The appliance tries the next authentication
service on the list, which is an Active Directory
(AD) service. It sends a request to the AD server.

5 The AD server finds the user name and password

in its database and sends an access accept
together with the admin’s group memberships.
Remote Admin Groups User Name Member Of
Eng admin10 IT-Bldg1
IT-Bldg2 IT-Bldg2

7 The appliance allows the admin 6 The appliance matches one of the
to log in and applies the admin’s groups with a group in the
privileges of the IT-BLDG2 admin policy.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 211

Managing Administrators

Only superusers can perform the following tasks to configure NIOS to authenticate admins using remote
authentication servers:
• Configure the authentication server groups. You can create multiple RADIUS, LDAP, and AD server groups, but
only one TACACS+ server group.
— For information about RADIUS authentication, see Authenticating Admins Using RADIUS on page 213.
— For information about AD authentication, see Authenticating Admins Using Active Directory on page 217.
— For information about TACACS+ authentication, see Authenticating Admin Accounts Using TACACS+ on
page 220.
— For information about LDAP authentication, see Authenticating Admins Using LDAP on page 223.
• Configure admin groups with names that match those on the remote server. For information about admin
groups, see About Admin Groups on page 188.
• Configure the admin policy, as described in Defining the Authentication Policy on page 227.

Note: Infoblox strongly recommends that even if you are using remote authentication, you always have at least one
local admin in a local admin group to ensure connectivity to the appliance in case the remote servers become
unreachable. Also, when you delete an authentication server group, the appliance removes it from the system.
Deleted authentication server groups are not moved to the Recycle Bin. Once deleted, the authentication
server groups no longer exist in the system.

When remote authentication is successful, the appliance creates a remote admin user object in the NIOS database,
which stores user preferences such as time zone, table size, and active Dashboard widgets for the remote user. If the
remote user does not log in to the appliance for more than 180 days, the appliance removes the corresponding admin
user object from the database. Although the remote user can still log in to the appliance, user preferences are lost.
The Grid Master performs this clean up action once a day.
You can also authenticate users with smart cards that contain X.509 client certificates. The status of these certificates
is stored remotely on OCSP responders. You can configure NIOS to authenticate these admins through the two-factor
authentication method. For more information about two-factor authentication and how to configure it, see Defining
the Authentication Policy on page 227.

212 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Admins Using RADIUS

Authenticating Admins Using RADIUS

RADIUS provides authentication, accounting, and authorization functions. The NIOS appliance supports
authentication using the following RADIUS servers: FreeRADIUS, Microsoft, Cisco, and Funk.
When NIOS authenticates administrators against RADIUS servers, NIOS acts similarly to a network access server
(NAS), which is a RADIUS client that sends authentication and accounting requests to a RADIUS server. Figure 4.5
illustrates the RADIUS authentication process.

Figure 4.5 Authentication using a RADIUS server

Administrator NIOS Appliance RADIUS Server

The appliance checks the remote admin

1 A user makes an HTTPS connection 2 policy which lists the RADIUS server
to the NIOS appliance and sends a
group.
user name and password.

3 The appliance sends an

Access-Request packet to the first
RADIUS server in the group.

The appliance lets the user log in and 4a If the RADIUS server authenticates the
applies the authorization profile. user, it sends back an Access-Accept
packet.

The appliance does not allow the user 4b If the RADIUS server rejects the
to log in. authentication request, it sends back an
Access-Reject packet.

Authentication Protocols
When you configure the NIOS appliance to authenticate admins against a RADIUS server group, you must specify the
authentication protocol of each RADIUS server, which can be either PAP (Password Authentication Protocol) or CHAP
(Challenge Handshake Authentication Protocol).
PAP tries to establish the identity of a host using a two-way handshake. The client sends the user name and password
in clear text to the NIOS appliance. The appliance uses a shared secret to encrypt the password and sends it to the
RADIUS server in an Access-Request packet. The RADIUS server uses the shared secret to decrypt the password. If the
decrypted password matches a password in its database, the user is successfully authenticated and allowed to log
in.
With CHAP, when the client tries to log in, it sends its user name and password to the NIOS appliance. The appliance
then creates an MD5 hash of the password together with a random number that the appliance generates. It then
sends the random number, user name, and hash to the RADIUS server in an Access-Request package. The RADIUS
server takes the password that matches the user name from its database and creates its own MD5 hash of the
password and random number that it received. If the hash that the RADIUS server generates matches the hash that
it received from the appliance, then the user is successfully authenticated and allowed to log in.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 213

Managing Administrators

You can configure one of the following modes to send the authentication request to the RADIUS server:
• Ordered: In this mode, the authentication request is sent to the first server in the list. The authentication
request is sent to the next server only when the first server is out of service or unavailable.
• Round Robin: In this mode, the first authentication request is sent to a server chosen randomly in a group. If
there is no response from the server, continued attempts are performed sequentially until it selects the last
server in the list. Then it starts with the first server in the list and continues the selection process until all the
servers have been attempted.

Accounting Activities Using RADIUS

You can enable the accounting feature on the RADIUS server to track whether an administrator has initiated a session.
After an administrator successfully logs in, the appliance sends an Accounting-Start packet to the RADIUS server.

Configuring Remote RADIUS Servers

For NIOS to communicate with a RADIUS server, you must also set up the remote RADIUS server to communicate with
the NIOS appliance.

Note: If you have two Infoblox appliances in an HA pair, enter both the members of the HA pair as separate access
appliances and use the LAN or MGMT IP address of both appliances (not the VIP address), if configured.

Depending on your particular RADIUS server, you can configure the following RADIUS server options to enable
communication with the NIOS appliance:
• Authentication Port
• Accounting Port
• Domain Name/IP Address of the NIOS appliance
• Shared Secret Password
• Vendor Types

Configuring Admin Groups on the Remote RADIUS Server

Infoblox supports admin accounts on one or more RADIUS servers.
On the remote RADIUS server, do the following to set up admins and associate them with an admin group:
• Import Infoblox VSAs (vendor-specific attributes) to the dictionary file on the RADIUS server
• For third-party RADIUS servers, import the Infoblox vendor file (the Infoblox vendor ID is 7779)
• Define the admin group
• Associate one or more remote admin accounts with the admin group
• Add and activate a policy for the admin accounts, but do not associate the policy with a policy group that
contains an infoblox-group-info attribute.
Refer to the documentation for your RADIUS server for more information.

214 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Admins Using RADIUS

Configuring RADIUS Authentication

To configure NIOS to use one ore more RADIUS server groups to authenticate administrators, you must do the
following:
• Configure at least one RADIUS authentication server group. For more information, see Configuring a RADIUS
Authentication Server Group on page 215.
• Define admin groups for the admins that are authenticated by the RADIUS servers and specify their privileges
and settings. The group names in NIOS must match the admin group names on the RADIUS server. See About
Admin Groups on page 188 for information about defining admin groups.
• In the authentication policy, add the RADIUS server groups and the admin groups that match those on the
RADIUS server. You can also designate an admin group as the default group for remote admins. NIOS assigns
admins to this group when it does not find a matching group for a remote admin. See Defining the
Authentication Policy on page 227 for more information about configuring the policy.

Configuring a RADIUS Authentication Server Group

You can add multiple RADIUS servers to the group for redundancy. When you do, the appliance tries to connect to the
first RADIUS server on the list and if the server does not respond within the maximum retransmission limit, then it
tries the next RADIUS server on the list. NIOS tries to connect to each RADIUS server in the order the servers are listed.
If it does not receive a response within the configured timeout period and has tried to connect the specified retry
value, then it tries the next RADIUS server on the list. It logs an error to syslog when it fails to connect to any of the
servers in the group.
After you add a RADIUS server to the NIOS appliance, you can validate the configuration. The appliance uses a
pre-defined username and password when it tests the connection to the RADIUS server. The pre-defined user name
is “Infoblox_test_user” and the password is “Infoblox_test_password”. Do not use these as your administrator
username and password.
To configure a RADIUS authentication server group :
1. From the Administration tab, click the Authentication Server Groups tab.
2. Click the Add icon in the RADIUS Services subtab.
3. In the Add RADIUS Authentication Service wizard, complete the following:
— Name: Enter the name of the server group.
— RADIUS Servers: Click the Add icon and enter the following:
— Server Name or IP Address: Enter the FQDN or the IP address of the RADIUS server that is used for
authentication.
— Comment: Enter additional information about the RADIUS server.
— Authentication Port: The destination port on the RADIUS server. The default is 1812. This field is
required only if you do not enable accounting on the RADIUS server. This field is not required if you
enable accounting to configure an accounting-only RADIUS server.
— Authentication Type: Select either PAP or CHAP from the drop-down list. The default is PAP.
— Shared Secret: Enter the shared secret that the NIOS appliance and the RADIUS server use to encrypt
and decrypt their messages. This shared secret is a value that is known only to the NIOS appliance and
the RADIUS server.
— Enable Accounting: Select this to enable RADIUS accounting for the server so you can track an
administrator’s activities during a session. When you enable accounting, you must enter a valid port
number in the Accounting Port field.
— Accounting Port: The destination port on the RADIUS server. The default is 1813.
— Connect through Management Interface: Select this so that the NIOS appliance uses the MGMT port for
administrator authentication communications with just this RADIUS server.
— Disable server: Select this to disable the RADIUS server if, for example, the connection to the server is
down and you want to stop the NIOS appliance from trying to connect to this server.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 215

Managing Administrators

— Click Test to test the configuration. If the NIOS appliance connects to the RADIUS server using the
configuration you entered, it displays a message confirming the configuration is valid. If it is unable to
connect to the RADIUS server, the appliance displays a message indicating an error in the
configuration.
— Click Add to add the server to the list.
When you add multiple RADIUS servers, the appliance lists the servers in the order you added them. This
list also determines the order in which the NIOS appliance attempts to contact a RADIUS server. You can
move a server up or down the list by selecting it and clicking the up or down arrow.
You can also delete a RADIUS server by selecting it and clicking the Delete icon.
— Authentication: Optionally, modify the authentication settings. These settings apply to all RADIUS servers
that you configure on the NIOS appliance.
— Timeout(s): Specify the number of seconds that the appliance waits for a response from the RADIUS
server.
— Retries: Specify how many times the appliance attempts to contact an authentication RADIUS server.
The default is 5.
If you have configured multiple RADIUS servers for authentication and the NIOS appliance fails to contact
the first server in the list, it tries to contact the next server, and so on.
— Accounting: Optionally, modify the Accounting settings.
— Timeout(s): Specify the number of seconds that the appliance waits for a response from the RADIUS
server.
— Retries: Specify how many times the appliance attempts to contact an accounting RADIUS server. The
default is 1000.
— Mode: Specifies how the appliance contacts the RADIUS servers. The default is Ordered List.
— Ordered List: The Grid member always selects the first RADIUS server in the list when it sends an
authentication request. It queries the next server only when the first server is considered down.
— Round Robin: The Grid member sends the first authentication request to a server chosen randomly in a
group. If there is no response from the server, the Grid member selects the next server in the group.
Continued attempts are performed sequentially until it selects the last server in the group. Then it
starts with the first server in the group and continues the selection process until all the servers have
been attempted.
— Comment: Enter useful information about the RADIUS service.
— Disable: Select this to disable RADIUS authentication for the servers listed in the table.
4. Save the configuration and click Restart if it appears at the top of the screen.
Note that the following fields in the wizard do not apply to this feature: Enable NAC Filter, Cache Time to Live, and
Recovery Interval. They are used with the NAC Integration feature described in Chapter 32, Authenticated DHCP, on
page 1145.

216 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Admins Using Active Directory

Authenticating Admins Using Active Directory

Active Directory™ (AD) is a distributed directory service that is a repository for user information. The NIOS appliance
can authenticate admin accounts by verifying user names and passwords against Active Directory. In addition, the
NIOS appliance queries the AD domain controller for the group membership information of the admin. The appliance
matches the group names from the domain controller with the admin groups on its local database. It then authorizes
services and grants the admin privileges, based upon the matching admin group on the appliance.
Figure 4.6 illustrates the Active Directory authentication process.

Figure 4.6 Authentication Using a Domain Controller

Administrator NIOS Appliance Domain Controller

1 A user makes an HTTPS connection to 2 The appliance checks the authentication

policy to determine which authentication
the NIOS appliance and sends an service to use. The authentication policy
account name and password. specifies an AD authentication service.

3 The appliance sends an authentication

request to the first domain controller in
the AD server group. The appliance also
requests the group membership
information of the admin.

The appliance lets the user log in and

applies the authorization profile. 4a Authentication is successful. The
domain controller successfully
The appliance grants all permissions authenticates the admin user. The
specific to the administrator based on group membership information for the
the group membership sent from the administrator is sent to the appliance.
domain controller associated with the The first group in the list that matches
admin account. If there is no group the groups returned by the domain
membership information for the admin, controller is assigned to the admin,
the default group is assigned (if along with the associated permissions
configured). after that admin logs in.

4b Authentication is unsuccessful. The

domain controller sends back a deny
The appliance does not allow the user access result to the appliance. No
to log in. group membership information is sent.

To configure NIOS to authenticate administrators using Active Directory domain controller groups, you must first
configure user accounts on the domain controller. Then, on the NIOS appliance, do the following:
• Configure one or more AD authentication server group on the appliance and add AD domain controllers to the
group. For information about configuring an AD authentication service group for admins, see Configuring an
Active Directory Authentication Service Group on page 218.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 217

Managing Administrators

• If you configured admin groups on the AD controller, you must create those same groups on the NIOS appliance
and specify their privileges and settings. Note that the admin group names must match those on the AD domain
controller. You can specify a default group as well. The NIOS appliance assigns admins to the default group if
none of the admin groups on the NIOS appliance match the admin groups on the AD domain controller or if
there are no other admin groups configured. For information about configuring group permissions and
privileges, see About Admin Groups on page 188.
• Add the newly configured Active Directory service to the list of authentication services in the admin policy, and
add the admin group names as well. See Defining the Authentication Policy on page 227 for more information
about configuring an admin policy.

Configuring an Active Directory Authentication Service Group

You can add multiple domain controllers to an AD authentication server group for redundancy. The NIOS appliance
tries to connect with the first domain controller on the list. If it is unable to connect, it tries the next domain controller
on the list, and so on.
To configure an Active Directory authentication server group on the NIOS appliance:
1. From the Administration tab, click the Authentication Server Groups tab.
2. Click the Active Directory Services subtab and click the Add icon.
3. In the Add Active Directory Authentication Service wizard, complete the following:
— Name: Enter a name for the service.
— Active Directory Domain: Enter the AD domain name.
— Domain Controllers: Click the Add icon and complete the following to add an AD domain controller:
— Server Name or IP Address: Enter the FQDN or the IP address of the AD server that is used for
authentication.
— Comment: Enter additional information about the AD server.
— Authentication Port: Enter the port number on the domain controller to which the appliance sends
authentication requests. The default is 389.
— Encryption: Select SSL from the drop-down list to transmit through an SSL (Secure Sockets Layer)
tunnel. When you select SSL, the appliance automatically updates the authentication port to 636.
Infoblox strongly recommends that you select this option to ensure the security of all communications
between the NIOS appliance and the AD server. If you select this option, you must upload a CA
certificate from the AD server. Click CA Certificates to upload the certificate. In the CA Certificates dialog
box, click the Add icon, and then navigate to the certificate to upload it.
— Connect through Management Interface: Select this so that the NIOS appliance uses the MGMT port for
administrator authentication communications with just this AD server.
— Disable server: Select this to disable an AD server if, for example, the connection to the server is down
and you want to stop the NIOS appliance from trying to connect to this server.
— Click Test to test the configuration. If the NIOS appliance connects to the domain controller using the
configuration you entered, it displays a message confirming the configuration is valid. If it is unable to
connect to the server, the appliance displays a message indicating an error in the configuration.
— Click Add to add the domain controller to the group.
When you add multiple domain controllers, the appliance lists the servers in the order you added them.
This list also determines the order in which the NIOS appliance attempts to contact a domain controller. You
can move a server up or down the list by selecting it and clicking the up or down arrow.
You can also delete a domain controller by selecting it and clicking the Delete icon.
— Timeout(s): The number of seconds that the NIOS appliance waits for a response from the specified
authentication server. The default is 5.
— Comment: Enter additional information about the service.
— Disable: Select this to retain an inactive AD authentication service profile.
4. Save the configuration and click Restart if it appears at the top of the screen.

218 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Admins Using Active Directory

Enabling Active Directory Authentication for Nested Groups

Windows servers support nesting groups in which you can add a group of admin users as a member of another group.
Nested groups consolidate admin accounts and help reduce the number of permissions required for individual users
or groups. In NIOS, you can enable nested group query so the appliance can recursively look up and use AD
authentication service to authenticate members or admin accounts that are part of a nested group. When an admin
belongs to multiple paths of hierarchy, you can enable nested group query in order to apply AD authentication service
hierarchically in a parent-child structure. This enables the NIOS appliance to apply AD authentication service to all
the groups of which an admin is a member. For example, if User 1 is a member of nested Group C, and Group C is a
member of Group B, and Group B is a member of Group A, then the authentication service is applicable to all the
groups of which User 1 is a member. In this example, the appliance performs a recursive lookup in Group C, Group B,
and Group A while authenticating User 1.
To enable AD authentication for nested groups on the NIOS appliance:
1. From the Administration tab, click the Authentication Server Groups tab.
2. Click the Active Directory Services subtab and click the Add icon.
3. In the Add Active Directory Authentication Service wizard, complete the following:
— Nested Group Query: This check box is deselected by default, meaning the nested group query is disabled.
When nested group query is disabled, AD authentication service is applied to only one group of which the
AD admin is a member. When you select this check box, AD authentication service is applied to all the
nested groups of which an AD admin is a member. This setting is applicable to all the AD servers configured
for the Active Directory authentication service.
4. Save the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 219

Managing Administrators

Authenticating Admin Accounts Using TACACS+

You can configure NIOS to authenticate admins against TACACS+ (Terminal Access Controller Access-Control System
Plus) servers. TACACS+ provides separate authentication, authorization, and accounting services. To ensure reliable
delivery, it uses TCP as its transport protocol, and to ensure confidentiality, all protocol exchanges between the
TACACS+ server and its clients are encrypted. For detailed information about TACACS+, refer to the Internet draft
http://tools.ietf.org/html/draft-grant-tacacs-02.
In addition, you can configure a custom service, infoblox, on the TACACS+ server, and then define a user group and
specify the group name in the custom attribute infoblox-admin-group. Ensure that you apply the user group to the
custom service infoblox. On NIOS, you define a group with the same name and add it to the authentication policy.
Then when the TACACS+ server responds to an authentication and authorization request and includes the
infoblox-admin-group attribute, NIOS can match the group name with the group in the authentication policy and
automatically assign the admin to that group.
Figure 4.7 illustrates the TACACS+ authentication and authorization process when PAP/CHAP authentication is used.

Figure 4.7 TACACS+ Authentication

Administrator NIOS Appliance TACACS+ Servers

A user makes an HTTPS connection to The appliance checks the authentication

1 the NIOS appliance and sends an 2
policy, which specifies the TACACS+
account name and password. authentication server group.

3 The appliance sends an

AUTHENTICATION START message
with the user’s credentials.

4 The TACACS+ server sends an

AUTHENTICATION REPLY indicating
the admin was successfully
authenticated.

5 The appliance sends an

AUTHORIZATION REQUEST with the
attribute-value string for the “infoblox”
service.

NIOS allows the user to log in and

assigns it to the admin group in the 6a The TACACS+ server sends an
authentication policy that matches the AUTHORIZATION RESPONSE
group in the custom attribute. indicating authorization succeeded and
includes the custom attribute
If NIOS does not find a matching group “infoblox-admin-group”.
in the authentication policy, it assigns the
user to the default admin group.

The appliance does not allow the user to The TACACS+ server sends a REPLY
log in. 6b
message indicating authentication
and/or authorization is unsuccessful.

220 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Admin Accounts Using TACACS+

TACACS+ Accounting
When you enable TACACS+ accounting, NIOS sends the TACACS+ accounting server a TACACS+ accounting event with
the same information that it sends to the Audit Log for any user command/event. NIOS sends an accounting start
packet when a user first logs in successfully using TACACS+ authentication, and it sends an accounting STOP packet
when a user logs out of the GUI or CLI or when a GUI or CLI session times out. If a product restarts or software failure
occurs, NIOS drops any outstanding accounting packets. Note that audit log entries that are greater than 3,600
characters are truncated in accounting events sent to TACAS+ servers.

Configuring TACACS+
Complete the following tasks to enable NIOS and the TACACS+ servers to communicate.
On each TACACS+ server that you are adding to the authentication server group:
• For Windows TACACS+ servers, add the NIOS appliance as an AAA client. This step is not required for LINUX
TACACS+ servers.
• Determine which user group on the TACACS+ server is used to match the admin group in NIOS, and then
configure the following settings for the user group:
— Add “infoblox” as a custom service.
— Define the custom attribute for the group, in the format: infoblox-admin-group=group_name. For example,
infoblox-admin-group=remoteadmins1. The group name can have a maximum of 64 characters.
On the NIOS appliance:
• Create a TACACS+ authentication server group. You can create only one TACACS+ server group. For more
information, see Configuring a TACACS+ Authentication Server Group on page 221.
• Create the local admin group in NIOS that matches the user group on the TACACS+ server. Note that the NIOS
admin group name must match the group name specified in the TACACS+ server and in the custom attribute. For
example, if the custom attribute is infoblox-admin-group=remoteadmins1, then the admin group name must be
remoteadmins1. In addition, you can designate a default admin group for remote admins. For information about
configuring group permissions and privileges, see About Admin Groups on page 188.
• In the authentication policy, add the newly configured TACACS+ server group and the TACACS+ admin group
name. See Defining the Authentication Policy on page 227 for more information about configuring an admin
policy.

Configuring a TACACS+ Authentication Server Group

You can add multiple TACACS+ servers to the TACACS+ authentication server group. NIOS sends authentication
requests to the TACACS+ servers in the order they are listed. NIOS sends authentication requests to the first server
on the list. If that server is unreachable or generates an error, then NIOS sends the request to the next server in the
list that has not been previously queried, and so on. NIOS logs an error message in syslog if all servers have been
queried and they all generate errors or are unreachable.
To configure a TACACS+ authentication server group:
1. From the Administration tab, click the Authentication Server Groups tab.
2. Click the TACACS+ Services subtab and click the Add icon.
3. In the Add TACACS+ Service wizard, complete the following:
— Name: Enter a name for the server group.
— TACACS+ Servers: Click the Add icon and complete the following:
— Server Name or IP address: The name or IP address of the TACACS+ server.
— Comment: You can enter additional information about the server.
— Port: The TCP destination port for TACACS+ communication. This port is used for authentication,
accounting and authorization packets. The default is port 49.
— Authentication Type: Select ASCII, PAP or CHAP. The default is CHAP.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 221

Managing Administrators

— Shared Secret: The shared key that the NIOS appliance and the TACACS+ server use to encrypt and
decrypt messages.
— Enable Accounting: Select this to enable NIOS to send accounting information to the TACACS+ server.
— Connect through Management Interface: Select this check box to enable the appliance to use the
MGMT port to communicate with the TACACS+ server. Ensure that the MGMT port is configured.
Otherwise, the appliance will use the LAN interface
— Disable Server: Select this to prevent queries from being sent to this server. You can retain the
configuration, but disable the service.
Click Test to test the configuration. Click Add to add the TACACS+ server to the list.
When you add multiple TACACS+ servers, the appliance lists the servers in the order you added them. This
list also determines the order in which the NIOS appliance attempts to contact a TACACS+ server. You can
move a server up or down the list by selecting it and clicking the up or down arrow.
— Authentication/Authorization: Optionally, modify the authentication and authorization settings. These
settings apply to all TACACS+ servers that you configure on the NIOS appliance.
— Timeout(s): Specify the number of seconds or milliseconds that the appliance waits for a response
from the TACACS+ server before it tries to contact it again. The amount of time before the server is
retried. The default and minimum is 5000, and the maximum is 60000.
— Retries: Specify how many times NIOS attempts to contact a TACACS+ server and fails before it tries to
contact the next server on the list. The default is 0. The maximum is 5.
— Accounting: Optionally, modify the Accounting settings.
— Timeout(s): Specify the number of seconds or milliseconds that the appliance waits for a response
from the TACACS+ server. The amount of time before the server is retried. The default and minimum is
1000, and the maximum is 30000.
— Retries: Specify how many times the appliance attempts to contact an accounting TACACS+ server and
fails before it tries to contact the next accounting server on the list. The default is 0. The maximum is 5.
— Comment: Enter additional information about the service.
— Disable: Select this to retain an inactive TACACS+ authentication service profile.
4. Save the configuration.

222 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Admins Using LDAP

Authenticating Admins Using LDAP

LDAP (Lightweight Directory Access Protocol) is an internet protocol for accessing distributed directory services. The
NIOS appliance can authenticate admin accounts by verifying user names and passwords against LDAP. The NIOS
appliance queries the LDAP server for the group membership information of the admin. The appliance matches the
group names from the LDAP server with the admin groups in its local database. It then authorizes services and grants
the admin privileges, based upon the matching admin group on the appliance. Figure 4.8 illustrates the LDAP
authentication process.

Figure 4.8 Authenticating using an LDAP server

Administrator NIOS Appliance LDAP Server

A user makes an HTTPS connection to The appliance checks the authentication

1 the NIOS appliance and sends an 2
policy, which specifies the LDAP
account name and password. authentication server group.

3 The appliance sends an authentication

request to the first LDAP server in the
group.

3a If authentication type is authenticated,

the appliance uses bind DN and bind
password of the LDAP server.

3b Iftheauthentication type is anonymous,

appliance connects anonymously
to the LDAP server.

The appliance lets the user log in and applies 4 Authentication is successful. If the
the authorization profile. LDAP server authenticates the user, the
group membership information for the
The appliance grants all permissions specific
administrator is sent to the appliance.
to the administrator based on the group
The first group in the list that matches
membership sent from the LDAP server
the groups returned by the LDAP is
associated with the admin account. If there is
assigned to the admin, along with the
no group membership information for an
associated permissions after the admin
admin, the default group is assigned (if
logs in.
configured).

The appliance does not allow the user to Authentication is unsuccessful. The LDAP
5 server sends back a deny access result to
log in.
the appliance. No group membership
information is sent.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 223

Managing Administrators

Authentication Protocols
When you configure the NIOS appliance to authenticate admins against an LDAP server group, you must specify the
authentication protocol of each LDAP server, which can be either anonymous or authenticated. The NIOS appliance
connects anonymously to the LDAP server when the authentication type is anonymous. With authenticated type, the
NIOS appliance connects using the bind DN and bind password defined for that server.
You can configure one of the following modes to send the authentication request to the LDAP server:
• Ordered: In this mode, the authentication request is sent to the first server in the list. The authentication
request is sent to the next server only when the first server is out of service or unavailable.
• Round Robin: In this mode, the first authentication request is sent to a server chosen randomly in a group. If
there is no response from the server, continued attempts are performed sequentially until it selects the last
server in the list. Then it starts with the first server in the list and continues the selection process until all the
servers have been attempted.
You can also specify the authentication type, for admins who belong to specific groups. The NIOS appliance uses the
selected group authentication type to query the LDAP server and retrieve the group names to which the admin
belongs. In LDAP, you can group users by any custom object classes. Example: objectclass groupofNames,
objectclass posixGroup, etc. In NIOS, when you select Member Group Attribute as the group authentication type, the
appliance uses custom LDAP group attributes to query the LDAP server and retrieve the group names for
authentication. Example: memberOf, isMemberOf, etc. When you select Posix Group as the authentication type, the
appliance uses "memberuid" and "objectClass" to query the server and retrieve the group names for authentication.

Configuring LDAP
Do the following to configure NIOS to use one or more LDAP server groups to authenticate administrators:
• Configure at least one LDAP authentication server group. For more information, see Configuring an LDAP Server
Group on page 224.
• Define admin groups for the admins that are authenticated by the LDAP servers and specify their privileges and
settings. The group names in NIOS must match the admin group names on the LDAP server. For more
information about defining admin groups, see About Admin Groups on page 188.
• In the authentication policy, add the LDAP server groups and the admin groups that match those on the LDAP
server. You can also designate an admin group as the default group for remote admins. NIOS assigns admins to
this group when it does not find a matching group for a remote admin. For more information about configuring
the policy, see Defining the Authentication Policy on page 227.

Configuring an LDAP Server Group

You can add one or more LDAP servers to an LDAP group for redundancy. The NIOS appliance tries to connect with the
LDAP server based on the method you configure for the authentication request. If it does not receive a response
within the configured timeout period and has tried to connect the specified retry value, then it tries the next LDAP
server on the list. The appliance makes a syslog entry when it fails to connect to any of the servers in the group and
sends an SNMP trap and an email notification if configured.
To configure an LDAP server group on the NIOS appliance:
1. From the Administration tab, click the Authentication Server Groups tab.
2. Click the Add icon in the LDAP Services subtab.
3. In the Add LDAP Authentication Service wizard, complete the following:
— Name: Enter the name of the server group.
— LDAP Servers: Click the Add icon and enter the following:
— Server Name or IP Address: Enter the FQDN (fully-qualified domain name) of the server or enter the
IPv4/IPv6 address.
— LDAP Version: Select the LDAP version. The NIOS appliance supports both LDAPv2 and LDAPv3. The
default LDAP version is v3.

224 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Admins Using LDAP

— Base DN: Enter the base DN (Distinguished Name) value. All entries stored in an LDAP directory have a
unique DN.
— Authentication Type: Select the authentication type from the drop-down list. The supported
authenticated types are as follows:
• Anonymous: Select this to connect to the LDAP server anonymously. This is selected by default.
• Authenticated: Select this to connect using the bind DN and bind password defined for that server.
• Bind User DN: Enter the bind user DN.
• Bind Password: Enter the bind password.
— Encryption: Select the encryption type from the drop-down list.
• SSL: This is selected by default. All the network traffic is encrypted through an SSL (Secure Sockets
Layer) protocol. The appliance automatically updates the authentication port to 636 for SSL. You
must upload a CA certificate that verifies the LDAP server certificate. Click CA Certificates to upload
the certificate. In the CA Certificates dialog box, click the Add icon, and then navigate to the
certificate to upload it.
• NONE: Select this to unencrypt the connection. Note that Infoblox strongly recommends that you
select the SSL option to ensure the security of all communications between the server and the
member.
— Network Port: Enter the authentication port number on the LDAP server to which the appliance sends
authentication requests. The default value is 636. When you select NONE from the Encryption
drop-down list, the appliance automatically updates the authentication port to 389.
— Comment: Enter useful information about the LDAP server.
— Connect through Management Interface: Select this so that the NIOS appliance uses the MGMT port for
administrator authentication communications with just this LDAP server.
— Disable Server: Select this to disable the LDAP server if, for example, the connection to the server is
down and you want to stop the NIOS appliance from trying to connect to this server. You cannot disable
the only server in a group if it is already being used by the remote authentication policy.
— Click Test to test the configuration. If the NIOS appliance connects to the LDAP server using the
configuration you entered, it displays a message confirming the configuration is valid. If it is unable to
connect to the server, the appliance displays a message indicating an error in the configuration.
— Click Add to add the LDAP server to the group.
When you add multiple LDAP servers, the appliance lists the servers in the order you added them. This
list also determines the order in which the NIOS appliance attempts to contact an LDAP server. You can
move a server up or down the list by selecting it and clicking the up or down arrow.
You can also delete a server by selecting it and clicking the Delete icon.
— Server Timeout(s): Specify the number of seconds that the appliance waits for a response from the LDAP
server. The default value is 5 seconds.
— Retries: Specify how many times the appliance attempts to contact an authentication LDAP server. The
default value is 5.
If you have configured multiple LDAP servers for authentication and the NIOS appliance fails to contact the
first server in the list, it tries to contact the next server after completing the specified number of attempts,
and so on.
— Mode: Specifies the order in which a Grid member connects to an LDAP server.
— Ordered List: The Grid member always selects the first LDAP server in the list when it sends an
authentication request. It queries the next server only when the first server is considered down. This is
the default.
— Round Robin: The Grid member sends the first authentication request to a server chosen randomly in a
group. If there is no response from the server, the Grid member selects the next server in the group.
Continued attempts are performed sequentially until it selects the last server in the group. Then it
starts with the first server in the group and continues the selection process until all the servers have
been attempted.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 225

Managing Administrators

— Recovery Interval: Specify the number of seconds that the appliance waits to recover from the last failed
attempt in connecting to an LDAP server. Select the time unit from the drop-down list. The default is 30
seconds. This is the time interval that NIOS waits before it tries to contact the server again since the last
attempt when the appliance could not connect to the LDAP server or when the LDAP server did not send a
reply within the configured response timeouts and retry attempts.
— Group Authentication Type: Select the group authentication type for LDAP authentication service from the
drop-down list. By default, Member Group Attribute authentication type is selected.
When you select Member Group Attribute, you can specify custom LDAP group attribute in the Group
Membership Attribute field. For example, memberOf, isMemberOf, etc. The appliance uses this attribute to
retrieve the group names to which the admin belongs. When you select Posix Group, the appliance uses
"memberuid" and "objectClass" to retrieve the group names to which the admin belongs.
— Group Membership Attribute: Specify the LDAP group attribute (such as "memberOf" and "isMemberOf").
This is used to query the server and retrieve the group names to which the admin belongs. This field is
enabled only when you select Member Group Attribute in the Group Authentication Type drop-down list.
The default value is memberOf.
— LDAP Search Scope: To search for an admin user name in the LDAP directory, select one of the following
LDAP search scope:
• Base: Specify Base to perform search only on base in the LDAP directory. This is the top level of the
LDAP directory tree.
• One Level: Specify One Level to perform search on base DN and one level below the base in the
LDAP directory.
• Sub tree: Specify Sub tree to perform search on base and all the entries below the base DN in the
LDAP directory.
The default value is One Level.
— User ID: Specify the attribute associated with the user object in the LDAP server, such as "uid" and "cn".
This attribute is used to match the NIOS user name.
— Map LDAP Field to Extensible Attribute (for Captive Portal Users only): If you configure the LDAP
authentication server group to authenticate the captive portal users, you can map an LDAP attribute value
to an existing extensible attribute. This mapping is optional. By doing so, the LDAP attribute value will be
queried from the LDAP server once the captive portal user authentication is successful. The attribute value
received from the LDAP server is mapped to the corresponding extensible attribute. NIOS updates or
creates a MAC address filter depending on the captive portal user or the client’s hardware and name.
Click the Add icon and enter the following:
— LDAP Field: Enter the LDAP attribute. This attribute is queried in the LDAP directory server.
— Extensible Attributes: Select an attribute from the drop-down list. The drop-down list displays only the
extensible attributes configured with attribute type as string. Infoblox recommends that you avoid
confidential data while mapping extensible attribute to an LDAP attribute because this data is visible in
the extensible attribute field of the corresponding MAC address filter.

Note: Mapping an extensible attribute to an LDAP attribute must be unique for a given LDAP server. Attribute not
defined in the LDAP directory for a given user is considered as null and is mapped to the corresponding
extensible attribute with a default value. The default value of extensible attribute is Not Found. This
default value is not configurable and they do not cause the authentication to fail.

— Comment: Enter useful information about the LDAP server group.

— Disable: Select this to disable the LDAP authentication server group. Note that you cannot disable an LDAP
group if it is already being used to authenticate one or more administrators and/or captive portal users.
4. Save the configuration and click Restart if it appears at the top of the screen.

226 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Defining the Authentication Policy

Defining the Authentication Policy

The authentication policy defines which authentication server groups the appliance uses to authenticate admins and
lists the local admin groups that map to the remote admin groups.
By default, the appliance provides the “Local Admin” service for authenticating users against the local database. You
cannot modify or delete this default service.

Configuring a List of Authentication Server Groups

To enable NIOS to use multiple authentication server groups, define a prioritized list as follows:
1. From the Administration tab, select the Administrators tab -> Authentication Policy tab.
2. From the Authenticate users against these services in this order section, click the Add icon to add an
authentication server group.
3. Select one of the following in the Add Authentication Service section:
— Active Directory: Select this to add an AD authentication server group, and then select a group from the
drop-down list.
— RADIUS: Select this to add a RADIUS authentication server group, and then select a group from the
drop-down list.
— TACACS+: Select this to add the TACACS+ authentication server group, and then select a group from the
drop-down list.
— LDAP: Select this to add the LDAP authentication server group, and then select a group from the drop-down
list.
4. Click Add.
You can reorder the list by selecting an authentication server group and moving it up or down the list using the
arrow keys.

Configuring a List of Remote Admin Groups

In order for NIOS to assign a remote admin to the correct group, you must list the admin groups in the local database
that match the remote admin groups. You can also define a default admin group to which NIOS assigns remote users
with no admin groups listed.
The appliance matches a remote admin to a group in the order the groups are listed. When the appliance receives
information that an admin belongs to one or more groups, the appliance assigns the user to the first group in the list
that matches. It assigns the admin to the default group, if specified, if no groups are returned by the authentication
server, or if the appliance does not find a group in the local database that matches the group returned by the
authentication server.
To configure the remote admin group list:
1. From the Administration tab, select the Administrators tab -> Authentication Policy tab.
2. In the Authentication Server Groups is the authority for section, select one of the following:
— Remote users, their passwords and their groups ownership: Select this to use the authentication server
groups to define the list of remote users, their passwords and their group ownerships. This is selected by
default. You can add the list of admin groups to map the remote admin group to a local group in the Map
the remote admin group to the local group in this order section.
— Passwords of Local users: Select this to authenticate a remote user when you do not know to which remote
admin group the user belongs.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 227

Managing Administrators

— Map the remote admin group to the local group in this order: In order for the appliance to assign a remote
admin to the correct group, you must list the admin groups in the local database that match the remote
admin groups. The appliance matches a remote admin to a group in the order the groups are listed. You can
also define a default admin group to which NIOS assigns remote users with no admin groups listed. This
section is disabled when you select Passwords of Local users in the Authentication Server Groups is the
authority for section.
When the appliance receives information that the admin belongs to one or more groups, the appliance
selects the first group in the list that matches, and assigns that group to the admin. If no groups are
returned by the authentication server, the default group is assigned (if specified).
Complete the following to configure the remote admin group list:
— Click the Add icon to add an admin group to the list. In the Admin Group Selector dialog box, select an
admin group. Use Shift+click and Ctrl+click to select multiple admin groups.
— You can reorder the list by selecting an admin group and using the arrow keys to move it up or down the
list.
— Assign user to this group if remote admin group cannot be found: Click Select to assign a user to a
specific admin group if the remote admin group is not found. In the Admin Group Selector dialog box,
select an admin group. You can also click Clear Selection to clear the displayed member and select a
new one.

Authenticating Admins Using Two-Factor Authentication

NIOS can authenticate users, such as U.S. Department of Defense CAC users, with smart cards that contain X.509
client certificates. The status of these certificates is stored remotely on OCSP responders. You can configure NIOS to
use the two-factor authentication method to authenticate these users. In two-factor authentication, NIOS first
negotiates SSL/TLS client authentication to validate client certificates. It then authenticates the admins based on the
configured authentication policy. Finally, NIOS validates the status of the client certificate through the OCSP service.
Note that you cannot add OCSP validation as part of the authentication policy. You must first configure the
authentication policy, and then configure and enable the OCSP service for the two-factor authentication to take
effect. For information about how to set up an authentication policy, see Defining the Authentication Policy on page
227.
OCSP is an internet protocol that validates certificate status for X.509 digital certificates that are assigned to specific
admins. For more information about OCSP, refer to RFC 2560 at http://tools.ietf.org/html/rfc2560. The status of
these client certificates is stored on OCSP responders to which NIOS sends requests about certificate status. A
certificate status can be “good,” revoked,” or “unknown.” After a successful SSL/TLS client authentication, NIOS
authenticates the admin based on the configured authentication policy. If the authentication fails at this point, the
appliance denies access to the admin. If the authentication policy has passed, the appliance sends a request to the
OCSP responder for client certificate status about the admin. If the appliance receives a “good” status from the OCSP
responder, the two-factor authentication is successful. The admin can now access the appliance. If the appliance
receives a “revoked” or “unknown” status from the OCSP responder, the two-factor authentication fails. The admin
cannot access the appliance even though the admin authentication policy has passed.
When there are multiple OCSP responders configured, the appliance contacts the responders based on their
configured order. For the same client certificate, the appliance always takes the status reported by the first responder
on the list that actually responds, even when there are different OCSP replies from different responders. When the
appliance cannot contact the first responder or if the first responder does not reply, the appliance then takes the
OCSP reply from the second responder and so on.

Note: Authentication for both the admin authentication policy and OCSP validation must be successful before a
smart card admin can access the appliance.

228 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Admins Using Two-Factor Authentication

Figure 4.7 illustrates the two-factor authentication and authorization process.

Administrator NIOS Appliance Authentication Servers

1 User inserts a smart card, establishes a 2 The appliance checks the authentication
successful SSL/TLS client authenticated policy.
HTTPS connection to the appliance
(through the client certificate and private
key from the smart card), and sends a
username, password, and client
certificate,

3 Based on the authentication policy, the

appliance sends authentication
messages to the corresponding servers.

4a Authentication servers send responses

indicating the admin is successfully
authenticated.

The appliance does not allow the admin 4b Authentication servers send messages
to log in. indicating authentication and/or
authorization is unsuccessful.

5 The appliance sends a request that

contains the admin certificate serial
number to the OCSP responder to
request for client certificate status.

NIOS allows the admin to log in and 6b The OCSP responder returns a “good”
assigns it to the admin group that certificate status indicating
matches the smart card user and applies authentication is successful. In a Direct
the authorization profile. trust model, the appliance uses the
OCSP responder certificate to validate
the OCSP reply. In a Delegated trust
model, it uses the CA certificate to
validate the reply.

The appliance does not allow the admin 6b The OCSP responder returns a
to log in. “revoked” or “unknown” certificate status
indicating authentication is unsuccessful.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 229

Managing Administrators

Best Practices for Configuring Two-Factor Authentication

Only superusers and limited-access users with the correct permissions can configure two-factor authentication. For
information about admin roles and permissions, see Managing Admin Groups and Admin Roles on page 193. To
configure two-factor authentication, consider the following:
• You must first set up an OCSP authentication server group and enable it.
• You can configure only one OCSP authentication server group that contains one or multiple OCSP responders to
which NIOS sends requests about client certificate status. The appliance supports IPv4 and IPv6 OCSP
responders.
• When you configure multiple OCSP responders, you can put them in an ordered list. The appliance contacts the
first responder on the list. If the connection fails, it moves on to the second one, and so on. The result of the
status check for a client certificate is based on the status reported by the first responder that replies.
• You can configure the timeout value and retry attempts that the appliance waits and tries before it moves on to
the next OCSP responder.
• You can upload server certificates for each responder for OCSP response validation. You must upload an OCSP
server certificate if you select the direct trust model.
• You can disable a specific responder if the server is out of service for a short period of time.
• Before you add an OCSP responder to the server group, you can test the server credentials.
To configure and enable two-factor authentication, complete the following tasks:
1. For local and remote authentication, ensure that the admin names for smart card users match the CNs (Common
Names) used in the client certificates. For information about local and remote authentication, see About Admin
Accounts on page 186.
2. Upload the CA (Certificate Authority) certificate, as described inAbout CA Certificates on page 57. The CA-signed
certificates are used to validate OCSP server certificates and admin OCSP client certificates. Ensure that the CA
certificate is in .PEM format. The .PEM file can contain more than one certificate.

Note: The uploaded CA certificates must be the ones that issued the client certificates to be authenticated.
Otherwise, clients such as browsers, cannot establish a successful SSL/TLS client authenticated HTTPS
session to the appliance.

3. Configure an OCSP authentication server group and enable it, as described in Configuring the OCSP
Authentication Server Group on page 230.
Note that once you save the OCSP authentication server group configuration, the appliance terminates administrative
sessions for all admin users. After you enable the OCSP service, you can verify whether two-factor authentication is
enabled. Go to the Administration -> Administrators -> Authentication Policy tab, Grid Manager displays the
“Two-Factor Authentication Enabled” banner in this tab.

Configuring the OCSP Authentication Server Group

To configure and enable the OCSP authentication service, complete the following:
1. From the Administration tab, click the Authentication Server Groups tab.
2. Click the OCSP Services subtab and click the Add icon.
3. In the Add OCSP Service wizard, complete the following:
— Name: Enter a name for the service.
— OCSP Responders: Click the Add icon and complete the following in the Add OCSP Responder section:
— Server Name or IP Address: Enter the FQDN or the IP address of the OCSP responder that is used for
authentication. The appliance supports IPv4 and IPv6 OCSP responders.
— Comment: Enter useful information about the OCSP responder.
— Port: Enter the port number on the OCSP responder to which the appliance sends authentication
requests. The default is 80.

230 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Authenticating Admins Using Two-Factor Authentication

— Server Certificate: Click Select to upload a server certificate. In the Upload dialog box, click Select to
navigate to the certificate, and then click Upload. The appliance validates the certificate when you save
the configuration. A server certificate is required for the direct trust model.
— Disable: Select this check box to disable the OCSP responder if, for example, the connection to the
server is down and you want to stop the NIOS appliance from trying to connect to this server.

Note: You cannot save the OCSP configuration when you disable all OCSP responders, thus the OCSP service is
disabled and two-factor authentication is no longer in effect.

Click Add to save the configuration and add the responder to the table. You can add multiple OCSP
responders for failover purposes. You can use the up and down arrows to place the responders in the order
you desire. The appliance tries to connect with the first responder on the list. If the connection fails, it tries
the next responder on the list, and so on. Grid Manager displays the following for each responder:
— Responder: The FQDN or the IP address of the OCSP responder.
— Comment: Information you entered about the OCSP responder.
— Port: The port number on the OCSP responder to which the appliance sends authentication requests.
— Disable: Indicates whether the responder is disabled or not. Note that you must enable at least one
responder to enable the OCSP service.
You can also click Test to test the configuration. If the appliance connects to the responder using the
configuration you entered, it displays a message confirming the configuration is valid. If it is unable to
connect to the responder, the appliance displays a message indicating an error in the configuration.
— Response Timeout(s): Enter the time the appliance waits for a response from the specified OCSP responder.
The default is 1 second. You can select the time unit from the drop-down list.
— Retries: Enter the number of times the appliance tries to connect to the responders after a failed attempt.
The default is 5.
— Recovery Interval: Enter the time the appliance waits to recover from the last failed attempt in connecting to
an OCSP responder. Select the time unit from the drop-down list. The default is 30 seconds. This is the time
interval that NIOS waits before it tries to contact the responder again since the last attempt when the
appliance could not connect with the responder or when the responder did not send a reply within the
configured response timeouts and retry attempts.
— Trust Model: From the drop-down list, select Direct or Delegated as the trust model for OCSP responses. In a
direct trust model, OCSP responses are signed with an explicitly trusted OCSP responder certificate. You
must upload the OCSP responder certificate if you select Direct. In a delegated trust model, OCSP
responses are signed with a trusted CA certificate. A server certificate is not required when you select
Delegated. The default is Direct.
— SSH Remote Console Authentication: Select a method for admins to log in to the appliance through the CLI.
From the drop-down list, select No Login to disable SSH remote connection through CLI, or select Login no
Certificate to authenticate admins using their user names and passwords without authenticating their
client certificates through the OCSP service. The default is No Login.

Note: To enable SSH remote console authentication, you must also enable remote console access in the Grid or
member settings.

— Enable Superuser login when all responders are unavailable: Select this check box to enable superuser
login when all OCSP responders are unavailable. As long as the superusers are authenticated through the
configured authentication policy, enabling this allows superusers to log in to the appliance if all OCSP
responders were disconnected or did not reply within the configured response timeouts and retry attempts.
— Comment: Enter useful information about the OCSP authentication service.
— Disable: Select this to retain an inactive OCSP authentication service profile.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 231

Managing Administrators

Note that enabling the OCSP authentication service terminates administrative services for all users. Ensure that you
have uploaded the correct CA certificates before enabling the service. Your login names must also match the CN
(Common Name) used in the certificate. When you configure multiple OCSP responders, ensure that you place them
in the correct order because the status check for a client certificate is based on the OCSP reply sent by the first OCSP
responder that replies.

Viewing the OCSP Authentication Server Group

To view the OCSP authentication server group, complete the following:
1. From the Administration tab, click the Authentication Server Groups tab.
2. Grid Manager displays the following about the OCSP authentication server group:
— Name: The name of the OCSP server group.
— Comment: Comments about the OCSP server group
You can also display the following column:
— Disabled: Indicates if the OCSP server group is enabled or disabled.
You can do the following in this tab:
• Sort the data in ascending or descending order by column.
• Select the OCSP server group and click the Edit icon to modify data, or click the Delete icon to delete it.
• Print and export the data in this tab.
• Create a bookmark for this page.

Changing Password Length Requirements

Password length requirements control how long a password must be for a NIOS appliance admin account. Increasing
this value reduces the likelihood of hackers gaining unauthorized access.
To change password length requirements:
1. From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
2. In the Grid Properties editor, select the Password tab.
3. Enter a number from 4 to 64 in the Minimum Password Length field.
4. Save the configuration and click Restart if it appears at the top of the screen.

Notifying Administrators
You can notify individual administrators about system status through email, or notify a group of people using an alias
email address. If you have configured DNS resolution on your network, the E-mail relay configuration function is not
required. If you did not configure the settings on the DNS Resolver section, you must enter a static IP address of the
target system in the Relay Name/IP Address field. The appliance sends e-mail to administrators when certain events
occur. This functionality supports both IPv4 and IPv6 networks. Here is a list of events that trigger e-mail notifications:
• Changes to link status on ports and online/offline replication status
• Events that generate traps, except for upgrade failures (ibUpgradeFailure). For a list of events, see Infoblox MIBs
on page 1312
The appliance attempts to send the email notification once after an event. It does not try to send the notification
again, if the first attempt fails. Infoblox recommends that you use the Test Email settings button to test the email
settings and to verify that the recipient received the notification.
You can define the email settings at the Grid and member levels.

232 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Notifying Administrators

Grid Level
To notify an administrator of an independent appliance or a Grid:
1. From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
2. In the Grid Properties editor, select the Email tab, and then complete the following:
— Enable Email notification: Select this.
— Email address: Enter the email address of the administrator. Use an email alias to notify multiple
people.
— Use SMTP Relay: Select this if the NIOS appliance must send email to an intermediary SMTP (Simple Mail
Transfer Protocol) server that relays it to the SMTP server responsible for the domain name specified in the
email address. Some SMTP servers only accept email from certain other SMTP servers and might not allow
email from the NIOS appliance. In this case, specify the DNS name or IP address of a different SMTP server
that does accept email from the NIOS appliance and that will then relay it to the SMTP server that can
deliver it to its destination.
Clear this if it is unnecessary to use an email relay server.
— SMTP Relay Name or Address: If you have configured DNS resolution, enter the DNS name of the relay
server.
If DNS resolution is not configured, enter the IP address of the relay server.
3. Optionally, click Test Email settings to confirm this feature is operating properly.
4. Save the configuration and click Restart if it appears at the top of the screen.

Member Level
To define email settings for a member:
1. From the Grid tab, select the Grid Manager tab -> member check box, and then select the Edit icon.
2. In the Grid Member Properties editor, select the Email tab, and then click Override to override Grid-level settings.
3. Complete the email configuration as described in Grid Level on page 233.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 233

Managing Administrators

Administrative Permissions for Common Tasks

Table 4.7 lists some of the common tasks admins can perform and their required permissions. Table 4.12 lists tasks
related to device discovery, with their required permissions.
All the permission tables in this chapter use the following definitions:
• RW = Read/Write permission
• RO = Read-only permission

Table 4.7 Permissions for Common Tasks

Adding a blank A/AAAA record

All Shared Record Groups
Member DHCP Properties
Specific Grid Member(s)

Member DNS Properties

Restart Member DHCP

Grid DHCP Properties

All Resource Records

Restart Member DNS
Grid DNS Properties

Specific Network(s)

Network Discovery
All Network Views
All Grid Members

Scheduling Task
Fixed Addresses
DHCP Range(s)
All DNS Zones
All DNS Views

All Networks
Tasks

For Grid and

Members

Restart services for RO

the entire Grid

Configure Grid DNS RW

properties,
configure member
DNS properties,
assign members to
DNS objects, and
restart DNS service
on members
Configure Grid RW

DHCP properties,
configure member
DHCP properties,
assign members to
DHCP objects, and
restart DHCP
service on
members
Configure a Grid RW

member

Restart services on RW

a Grid member
Configure member RW

DNS properties,
assign member to
DNS objects, and
restart DNS service
on member

234 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for Common Tasks

Adding a blank A/AAAA record

All Shared Record Groups
Member DHCP Properties
Specific Grid Member(s)

Member DNS Properties

Restart Member DHCP

Grid DHCP Properties

All Resource Records

Restart Member DNS
Grid DNS Properties

Specific Network(s)

Network Discovery
All Network Views
All Grid Members

Scheduling Task
Fixed Addresses
DHCP Range(s)
All DNS Zones
All DNS Views

All Networks
Tasks

Configure member RW

DHCP properties,
assign member to
DHCP objects, and
restart DHCP
service on member
Restart member RW

DNS service

Restart member RW

DHCP service
Initiate and control RW RW

network discovery
on all networks

Scheduling tasks RW RW RW

for all supported

objects
For DNS resources

Create, modify, RW

and delete DNS

views
View and search RO

for DNS views

Create, modify, RW RW

and delete DNS

zones with
assigned members
View and search RO RO

for DNS zones with

assigned members
Create, modify, RW RW

and delete all

resource records

Create and modify RW

blank A/AAAA
records and shared
A/AAAA records.
View and search RO RO

for all resource

records

Assign member to RW

DNS objects

NIOS 7.3 NIOS Administrator Guide (Rev. A) 235

Managing Administrators

Adding a blank A/AAAA record

All Shared Record Groups
Member DHCP Properties
Specific Grid Member(s)

Member DNS Properties

Restart Member DHCP

Grid DHCP Properties

All Resource Records

Restart Member DNS
Grid DNS Properties

Specific Network(s)

Network Discovery
All Network Views
All Grid Members

Scheduling Task
Fixed Addresses
DHCP Range(s)
All DNS Zones
All DNS Views

All Networks
Tasks

For DHCP
Resources

Create, modify, RW RW RW

and delete network

views and their
associated DNS
views
View network RO RO

properties and
statistics
Create, modify, RW RW

and delete
networks with
assigned members
Create, modify, RW

and delete
networks without
assigned members
Create, modify, RW RW RW

and delete DHCP

ranges in a specific
network with
assigned members
Create, modify, RW RW

and delete fixed

addresses in a
specific network
without assigned
members
Assign member to RW

DHCP objects

236 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permission for the Grid

Administrative Permission for the Grid

By default, the Grid Master denies access to Grid members when a limited-access admin group does not have defined
permissions. You can grant an admin group read-only or read/write permission, or deny access to all Grid members
or you can grant permission to specific Grid members, as described in Applying Permissions and Managing Overlaps
on page 204.

Note: Only superusers can modify DNS and DHCP Grid properties.

The following sections describe the types of permissions that you can set with Grid permissions:
• Administrative Permissions for Grid Members on page 237
• Administrative Permissions for Network Discovery on page 238
• Administrative Permissions for Scheduling Tasks on page 238
• Administrative Permissions for Microsoft Servers on page 239

Administrative Permissions for Grid Members

Table 4.8 lists the tasks admins can perform and the required permissions for Grid members.

Table 4.8 Grid Member Permissions

Member DHCP Properties

Member DNS Properties

Restart Member DHCP

Restart Member DNS
Grid Member(s)

DHCP Ranges
DNS Zones
DNS Views

Networks
Tasks

Assign member to DNS zones RW RW

Assign member to networks RW RW

Assign member to DHCP ranges RW

Configure member properties RW

Add a member to a Match Members list of a DNS view RW

Delete a view with members in a Match Members list RO

View DNS and DHCP member properties RO RO

View and download syslog RO

View DNS and DHCP configuration file RO RO

View network statistics RO

Restart DNS service on the member RW

Restart DHCP service on the member RW

NIOS 7.3 NIOS Administrator Guide (Rev. A) 237

Managing Administrators

Administrative Permissions for Network Discovery

Limited-access admin groups can initiate a discovery and manage discovered data based on their administrative
permissions.
You can set global permissions for network discovery as described in Defining Global Permissions on page 196. The
following table lists the tasks admins can perform and the required permissions for network discovery.

Table 4.9 Permissions for Network Discovery

Networks Selected
Network Discovery

for Discovery

Port Control
DNS Zones
Tasks
Initiate and control a discovery on selected networks RW RW

View discovered data RO

Add unmanaged data to existing hosts, and resolve conflicting IP addresses RW

Convert unmanaged data to a host, fixed address, reservation, A record, or PTR record RW RW

Configure device interfaces, provision networks on interfaces, de-provision networks RW RW

Administrative Permissions for Scheduling Tasks

You can schedule tasks, such as adding hosts or modifying fixed addresses, for a future date and time. To schedule
tasks, you must first enable the scheduling feature at the Grid level, and then define administrative permissions for
admin groups and admin roles. For information, see Scheduling Tasks on page 77. Only superusers can enable and
disable this feature and grant scheduling permissions to admin groups. Limited-access admin groups can schedule
tasks only when they have scheduling permissions.
Superusers can do the following:
• Enable and disable task scheduling at the Grid level
• Grant and deny scheduling permissions to admin groups and admin roles
• Schedule tasks for all supported object types
• Reschedule and delete any scheduled task
You can set global permissions to schedule tasks as described in Defining Global Permissions on page 196. The
following table lists the tasks admins can perform and the required permissions. Users with read/write permission
to scheduling can view, reschedule, and delete their own scheduled tasks.

Table 4.10 Scheduling Task Permissions

Scheduling Task

Record Groups
All DNS Views
All Networks

All Shared

Tasks
Schedule the addition, modification, and deletion of all supported object types RW RW RW RW

View, reschedule, and delete scheduled tasks RW RW RW RW

Convert unmanaged data to a host, fixed address, reservation, A record, or PTR record RW RW RW

238 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permission for the Grid

To schedule tasks for specific resources, admins must have Read/Write permission to scheduling tasks, plus the
required permissions to the supported resources. For information about permissions for specific resources, see the
following:
• Grid members—See Administrative Permission for the Grid on page 237.
• DNS resources—See Administrative Permissions for DNS Resources on page 241.
• DHCP resources—See Administrative Permissions for DHCP Resources on page 253.
Note that the appliance deletes all pending scheduled tasks when superusers disable task scheduling at the Grid
level. The appliance deletes an admin’s scheduled tasks when superusers do the following:
• Set the scheduling permission of admin groups and roles to “Deny”
• Delete or disable an admin group or an admin role
• Delete or disable local admins
• Delete the scheduling permission from any admin group or admin role that contains users with pending
scheduled tasks
• Change the admin group of a limited-access admin

Administrative Permissions for Microsoft Servers

By default, only superusers can add Microsoft servers as managed servers to the Grid. Limited-access admins can
add and manage Microsoft servers from the Grid based on their administrative permissions.
The following table lists the tasks admins can perform and the required permissions. Note that only superusers can
add a Microsoft server to a name server group.

Table 4.11 Microsoft Server Permissions

Microsoft Server(s)

Resource Records
Grid Member(s)

Network Views

DHCP Ranges

Superscopes
DNS Zones
DNS Views

Networks
Tasks
Assign Microsoft server to member RW RW

Assign a network view to the Microsoft server RW RW RW

Assign a DNS view to the Microsoft server RW RW RW

Assign Microsoft server as primary or secondary to DNS zones RW RW RW

Remove a Microsoft server as the primary or secondary server of a zone RW

Remove a zone from a Microsoft server RW

Edit zones and resource records of Microsoft servers RW RW

Assign a Microsoft server to a network RW RW

Assign a Microsoft server to a DHCP range RW RW

Remove a network served by a Microsoft server RW RW

Remove a DHCP range (scope) from a Microsoft server RW RW

Add, modify and remove Microsoft superscopes RW RW RW

Clear leases from Microsoft server RW RW

Edit Microsoft server properties RW

View Microsoft server properties RO

NIOS 7.3 NIOS Administrator Guide (Rev. A) 239

Managing Administrators

Microsoft Server(s)

Resource Records
Grid Member(s)

Network Views

DHCP Ranges

Superscopes
DNS Zones
DNS Views

Networks
Tasks
View and download Microsoft logs RO

Start/Stop DNS or DHCP on the Microsoft server RW

Remove a Microsoft server from the Grid RW

Administrative Permissions for IPAM Resources

Limited-access admin groups can access certain IPAM resources only if their administrative permissions are defined.
By default, the appliance denies access when a limited-access admin group does not have defined permissions. You
can grant admin groups read-only or read/write permission, or deny access to the following IPAM resources:
• Network views
• IPv4 networks
• IPv6 networks
• Hosts
The appliance applies permissions for IPAM resources hierarchically. Permissions to a network view apply to all
networks and resources in that view. You can also grant an admin group broad permissions to IPAM resources, such
as read/write permission to all IPv4 networks and IPv6 networks in the database. In addition, you can grant
permission to a specific host in a network. Permissions at more specific levels override global permissions.
The following sections describe the types of permissions that you can set for IPAM resources:
• Administrative Permissions for Network Views on page 254
• Administrative Permissions for IPv4 and IPv6 Networks on page 240
• Administrative Permissions for Hosts on page 241

Administrative Permissions for IPv4 and IPv6 Networks

Limited-access admin groups can access IPv4 and IPv6 networks only if their administrative permissions are defined.
Permissions for a network apply to all its DNS and DHCP resources, if configured. To override network-level
permissions, you must define permissions for specific objects within the networks. You can also define permissions
for specific DHCP objects and Grid member to restrict admins to perform only the specified DHCP tasks on the
specified member. For more information, see Defining DNS and DHCP Permissions on Grid Members on page 202.
You can grant read-only or read/write permission, or deny access to networks, as follows:
• All IPv4 or IPv6 networks—Global permission that applies to all networks in the database.
• A specific network—Network permissions apply to all objects in the network. This overrides global permissions.
• A specific network on a specific member—Network permissions apply to all objects in the network and member
permissions apply to the specific member. For information about member permissions, see Modifying
Permissions on a Grid Member on page 203.

240 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DNS Resources

Administrative Permissions for Hosts

A host record can contain both DNS and DHCP attributes if you configure them. When applying administrative
permissions to host records, the permissions apply to all relevant DNS and DHCP resources within the host records.
You can define global permissions to all hosts. To override global permissions, you must define permissions for
specific hosts.
You can grant read-only or read/write permission, or deny access to host records, as follows:
• All hosts—Global permission that applies to all host records in the Grid.
• A specific host—Object permission that applies only to a selected host.

Administrative Permissions for DHCP Fingerprint Permissions

NIOS provides a global permission for all All DHCP Fingerprints; however, it does not support object level permissions
for fingerprints. To use fingerprint filters, you must have superuser privileges.

Administrative Permissions for Network Insight Tasks

Table 4.12 summarizes the permissions you need to perform various tasks related to device discovery.

Table 4.12 Permissions for Network Discovery

All Network Views/

All IPv4 Networks/
Networks Selected
Network Discovery

All IPv6 Networks

for Discovery

Permissions
Port Control
DNS Zones

for Object
Tasks

Initiate and control a discovery on selected networks RW RW

View discovered data RO

Resolve conflicting IP addresses RW

Convert unmanaged objects to a host, fixed address, reservation, A record, RW RW

or PTR record
Configure device interfaces, provision networks on interfaces RW RW

Configure a Blackout schedule for networks or DHCP ranges RW RO

Creating/editing port reservations for a Grid member, host, fixed address, RW RO

reservation, A record, or PTR record

Administrative Permissions for DNS Resources

You can grant roles and admin groups read-only or read/write permission, or deny access to the following DNS
resources:
• DNS Views
• DNS Zones
• Response Policy Zones
• All RPZ Rules
• Hosts

NIOS 7.3 NIOS Administrator Guide (Rev. A) 241

Managing Administrators

• Bulk Hosts
• A records
• AAAA records
• CNAME records
• DNAME records
• MX records
• PTR records
• SRV records
• TXT records
• Hosts
• Bulk Hosts
• Shared Record Groups
• Shared A records
• Shared AAAA records
• Shared CNAME records
• Shared MX records
• Shared SRV records
• Shared TXT records
• DNS64 synthesis groups
• Adding a blank A/AAAA record
The appliance applies permissions for DNS resources hierarchically. Permissions to a DNS view apply to all zones and
resource records in that view. Permissions for a zone apply to all its subzones and resource records, and resource
record permissions apply to those resource records only. To override permissions set at higher level, you must define
permissions at a more specific level. To assign permissions, see Applying Permissions and Managing Overlaps on
page 204.
You can also define permissions for specific DNS objects and Grid member to restrict admins to perform only the
specified DNS tasks on the specified member. For more information, see Defining DNS and DHCP Permissions on Grid
Members on page 202.
The following sections describe the different types of permissions that you can set for DNS resources:
• Administrative Permissions for DNS Views on page 242
• Administrative Permissions for Zones on page 243
• Administrative Permissions for Resource Records on page 244

Administrative Permissions for DNS Views

Limited-access admin groups can access DNS views, including the default view, only if their administrative
permissions are defined. Permissions to a DNS view apply to all its zones and resource records. To override view-level
permissions, you must define permissions for its zones and resource records. For example, you can grant an admin
group read-only permission to a view and read/write permission to all its zones. This allows the admins to display the
view properties, but not edit them, and to create, edit and delete zones in the view.
You can grant read-only or read/write permission, or deny access to DNS views, as follows:
• All views—Global permission that applies to all DNS views in the database.
• A specific view—Applies to its properties and its zones, if you do not define zone-level permissions. This
overrides the global view permissions.
• All zones in a view—If you do not define permissions for zones, they inherit the permissions of the view they are
in.
For information on setting permissions for a view and its zones, see Applying Permissions and Managing Overlaps
on page 204.

242 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DNS Resources

The following table lists the tasks admins can perform and the required permissions for DNS views.

Table 4.13 Permissions for DNS Views

Specific DNS View

Grid Member(s)

All DNS Zones

All DNS Views
Tasks
Create, modify, and delete DNS views RW

Create, modify, and delete DNS zones with assigned members RW RW

Create, modify, and delete DNS zones without assigned members RW

Modify and delete a specific DNS view RW

Create, modify, and delete DNS zones, subzones, and resource records in a specific DNS view RW RW

Add Grid members to a Match Members list of a DNS view RW RW

Delete a DNS view with Grid members in a Match Members list RW RW

View DNS view properties, DNS zones, and resource records RO

View DNS zone properties, subzones, and resource records RO

Restart services from the DNS tab RO RW

Administrative Permissions for Zones

By default, zones inherit administrative permissions from the DNS view in which they reside. You can override
view-level permissions by setting permissions for specific zones. Permissions set for a zone are inherited by its
subzones and resource records. To override zone-level permissions, set permissions for specific subzones and
resource records.
For example, you can grant an admin group the following permissions:
• Read-only to a zone and to all its A, AAAA, and PTR records (in reverse and forward-mapping zones)
• Read/Write permission to all MX and SRV records in the zone
• Deny to all the other resource records—CNAME, DNAME, TXT, host, and bulk host
You can grant read-only or read/write permission, or deny access to zones as follows:
• All zones —Global permission that applies to all zones in all views.
• All zones in a view—Permissions at this level override the global permissions.
• A specific zone—Applies to the zone properties and resource records, if you do not define permissions for its
resource records. This overrides global and view-level permissions. If you delete a zone and reparent its
subzone, the subzone inherits the permissions of the new parent zone.
• All Response Policy Zones—Global permission that applies to all the Response Policy Zones.
• All Response Policy Rules—Global permission that applies to all the local Response Policy Zone rules.

Note: Object permissions are not applicable to Response Policy Zone rules.

• Each resource record type in a zone—For example, you can define permissions for all A records and for all PTR
records in a zone. if you do not define permissions for resource records, they inherit the permissions of the zone
in which they reside.
For information on setting permissions for zones and resource records, see Applying Permissions and Managing
Overlaps on page 204.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 243

Managing Administrators

The following table lists the tasks admins can perform and the required permissions for zones.

Table 4.14 DNS Zone Permissions

Shared Record Group

Specific DNS Zone
Specific DNS View

Resource Records
Grid Member(s)

All DNS Zones

Tasks
Create, modify, and delete zones, subzones and resource records with assigned members RW RW

Create, modify, and delete zones, subzones and resource records without assigned RW

members

Lock and unlock a zone RW

Delete a zone with assigned Grid members RW RW

Create, modify, and delete all zones, subzones, and resource records in a specific view RW RW

Assign a name server group (member) to a zone RW RW

Delete a zone with name server groups assigned RW RW

Assign a shared record group to a zone RW RW

View zone properties, subzones, and resource records of a specific zone RO

Search for zones, subzones, and resource records in a specific DNS view RO RO

Copy resource records from one zone to another: Source zone RO RO

Copy resource records from one zone to another: Destination Zone RW RW

Administrative Permissions for Resource Records

Resource records inherit the permissions of the zone to which they belong. You can override zone-level permissions
by setting permissions for specific resource records.
You can grant read-only or read/write permission, or deny access to resource records as follows:
• Each resource record type in all zones and in all views—Global permission that applies to all resource records of
the specified type; for example, all A records in the database.
• Each resource record type in a zone— Permissions at this level override global permissions.
• A specific resource record—Overrides zone-level permissions.
For information on setting permissions for resource records, see Applying Permissions and Managing Overlaps on
page 204. The following table lists the tasks admins can perform and the required permissions for resource records.

244 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DNS Resources

Table 4.15 DNS Resources

Specific Resource Record

Resource Record Type
Tasks
Create, modify, and delete resource records for a specified type, RW

such as all A records or all PTR records

View resource records for a specified type only RO

Search for records of a specified type RO

View a specific resource record RO

View, modify, and delete a specific resource record RW

The following are additional guidelines:

• Only admins with read/write permission to bulk host records and read/write permission to reverse zones can
create bulk host records and automatically add reverse-mapping zones.
• To create host records, admins must have read/write permission to the network and zone of the host.
• Admins must have read-only permission to the host records in a zone to view the Host Name Compliance
Report. Admins must have read/write permission to the resource records in a zone to modify host names that
do not comply with the host policy.

Administrative Permissions for Adding Blank A or AAAA Records

By default, only superusers can add and edit A, AAAA, shared A, and shared AAAA records with a blank name.
Limited-access admin groups can add and edit A, AAAA, shared A, and shared AAAA records with a blank name, only
if their administrative permissions are defined. You can grant read/write or deny permission to Adding a blank
A/AAAA record for specific admin groups, which applies to all admin roles in the group. You can define global
permissions for specific admin groups and roles to allow limited-access users to add and edit blank A, AAAA, shared
A, and shared AAAA records, as described in Defining Global Permissions on page 196.

Administrative Permissions for Shared Record Groups

By default, only superusers can add, edit, and delete shared record groups. Limited-access admin groups can access
shared record groups, only if their administrative permissions are defined.
You can set different permissions for a shared record group and for each type of shared resource record in the group.
For example, you can grant a role or an admin group the following permissions:
• Read-only to a shared record group and to all its shared A, AAAA, and CNAME records
• Read/Write permission to all the shared MX and SRV records in the shared record group
• Deny to the TXT records
You can grant read-only or read/write permission, or deny access to shared record groups, as follows:
• All shared record groups—Global permission that applies to all shared record groups in the database.
• A specific shared record group—Overrides global permissions.
• Each shared record type in all shared record groups — The shared resource record types include shared A
records, shared AAAA records, shared CNAME records, shared MX records, shared SRV records, and shared TXT
resource records.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 245

Managing Administrators

• Each shared record type in a shared record group— Permissions at this level override global permissions.
• A specific shared record—Overrides zone-level permissions.
Note the following guidelines:
• Shared record group permissions override zone permissions.
• Even if a zone is locked, superusers and limited-access users with read/write access can still edit or delete a
shared record in the zone.
For information on setting permissions for shared record groups, see Applying Permissions and Managing Overlaps
on page 204. The following table lists the tasks admins can perform and the required permissions for shared record
groups.

Table 4.16 Permissions for Shared Record Groups

Specific Shared REcord Group

All Shared Record Groups

Specific Shared Record

Shared Record Type

Specific DNS Zone

Tasks
Create, modify, and delete shared record groups RW

Modify and delete a shared record group RW

View a shared record group RO

Create, modify, and delete shared records for a specific type RW

View or search for shared records of a specific type RO

Create, modify, and delete shared records for a specific type in a specified shared record group RW RW

View shared records for a specific type in a specified shared record group only RO RO

Create, modify, and delete a shared record RW

View a specific shared record RO

Assign a shared record group to DNS zones RW RW

Change the DNS zones associated with a shared record RW RW

Delete zones with a shared record group assigned. Before you delete a shared record group, you RW RW

must remove all zones associated with it.

Administrative Permissions for DNS64 Synthesis Groups

By default, only superusers can add, edit, and delete DNS64 synthesis groups. Limited-access admin groups can
access synthesis groups, only if their administrative permissions are defined.
You can grant read-only or read/write permission, or deny access to synthesis groups, as follows:
• All synthesis groups—Global permission that applies to all shared record groups in the database.
• A specific synthesis group—Overrides global permissions.
For information on setting permissions for synthesis groups, see Applying Permissions and Managing Overlaps on
page 204. The following table lists the tasks admins can perform and the required permissions for synthesis groups.

246 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DNS Resources with Associated IP addresses in Networks and Ranges

Table 4.17 Permissions for DNS64 Synthesis Groups

Specific Synthesis Group

All Synthesis Groups

Specific DNS View

Specific Member
Grid
Tasks
Create, modify, and delete synthesis groups RW

Modify and delete a specific synthesis group RW

View a synthesis group RO

Apply a synthesis group to the Grid RO RW

Apply a synthesis group to a member RO RW

Apply a synthesis group to a DNS view RO RW

Administrative Permissions for DNS Resources with Associated IP

addresses in Networks and Ranges
You can further control permissions for DNS resources that have associated IP addresses in a network container,
network, or address range. These DNS resources include A records, AAAA records, PTR records, and DNS hosts.
Permissions for these resources have been added so you now have more control over who can perform which tasks
for these DNS resources without affecting permissions defined for the networks and ranges to which the resources
belong. For example, if you want to allow an admin to add, modify, and delete A records associated with IP addresses
within a specific network but you do not want the same admin to modify or delete the network, you can grant the
admin read-only permission for the specified network and read/write permission for A records in that network.
Similar behavior applies to AAAA records, PTR records, and DNS hosts.
As a superuser, you can now grant permissions to admin groups for more granular access to the following resources:
• IPv4 and IPv6 DHCP fixed addresses and IPv4 reservations in a range
• IPv4 and IPv6 host addresses in a range
• A and AAAA records in a network container, network, or range
• IPv4 and IPv6 PTR records in a network container, network, or range
For information about how to configure new permissions for these resources, see Configuring Permissions for DNS
Resources in Networks and Ranges on page 250.

Best Practices for Configuring Permissions in Networks and Ranges

Before using permissions for DNS resources in networks and ranges, consider the following:
• You can enable and disable these permissions using the set dns_perm_for_nw_range CLI command.
When you disable permissions after you have enabled and defined them, the appliance retains the permissions
in an inactive mode. Inactive permissions are not verified nor displayed in Grid Manager. When you re-enable
the permissions, the appliance activates them and displays them in Grid Manager. You can also use the show
dns_perm_for_nw_range CLI command to verify the status of new permissions.
Note that permissions for fixed addresses and reservations are not controlled by the CLI command; they are
always enabled.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 247

Managing Administrators

You can also enable and disable permissions for DNS Resources in Networks and Ranges through Grid Manager,
as described in Enabling Permissions for DNS Resources in Networks and Ranges on page 250.
• When you switch between enabling and disabling these permissions, changes take effect immediately and a
service restart in Grid Manager is not required. However, you may need to refresh Grid Manager to view the
changes.
• You can assign these permissions when DNS, DHCP, or Microsoft Management licenses are installed. If you
remove all of these licenses after you have configured relevant permissions for supported resources, the
appliance retains the permissions, but you will not be able to see the permissions nor configure them.

Changes to Default Behavior

This section describes changes to the default behavior when you enable permissions for DNS resources with
associated IP addresses in networks and ranges. The following table lists behavior in previous releases and changes
made in this release for supported resources. Review these changes before you configure permissions for these
resources. For more information about how to define these permissions, see Permission Examples on page 251.

Resources Behavior in Previous NIOS Releases Changes in NIOS 6.10.4

A Records • Admins can add, modify, and • When you enable new permissions, you
AAAA Records delete A, AAAA, PTR records and can define the following permissions for
DNS hosts that have associated the admins to add, modify, and delete
PTR Records
IP addresses in a network or A, AAAA, PTR records and DNS hosts
DNS Hosts range when they have read/write that have associated IP addresses in a
permission for the respective network container, network, or range:
zone or a higher level DNS — Read/write permission for the
parent object (even if they have specific records in the zone or a
deny or read-only permission for higher level DNS parent object.
the network to which the DNS and
resources belong).
— Read/write permission for the
records in the specified network
container, network, or range to
which the resources belong.

Note: Fields for A, AAAA, PTR records and

DNS hosts in a zone or a higher level
DNS parent object, except Name, IP
Address, MAC Address, DUID and
Disabled, can be modified by admins
who do not have write permission for
the same records in the specified
network container, network, or range.

• You cannot define read-only permission

for A, AAAA, and PTR records in a range.
The read operation for A, AAAA, PTR,
and host records is based on DNS
permission hierarchy. In other words,
read-only permission for a parent DNS
zone allows you to view DNS objects,
regardless of the permission you have
defined for these resources in their
associated ranges.

248 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DNS Resources with Associated IP addresses in Networks and Ranges

Resources Behavior in Previous NIOS Releases Changes in NIOS 6.10.4

DHCP-enabled Hosts • Admins can add, modify, and • When you enable new permissions and
delete DHCP-enabled host you want to allow the admin to add,
addresses when they have modify, and delete DHCP-enabled hosts
read/write permission for hosts that fall within a specific address range,
in the specified zone and define read/write permission for hosts
read/write permission for the in that specified range. Note that if the
network to which the IP admin has read/write permission for the
addresses belong. (This network, they can add, modify, and
behavior stays the same in NIOS delete hosts that do not fall within a
6.10.4.) specific address range.

Note: Fields for DHCP-enabled host

addresses, except Name, Enable in
DNS, IPv4/IPv6 Address, MAC
Address, DUID, and Disabled, can be
modified by admins who do not have
write permission for the same
addresses in the specified network
container, network, or range.

• Regardless of whether new permissions

are enabled, DHCP-enabled host
addresses always appear in their
respective network containers or
networks. However, host addresses in a
range appear in the range only when
new permissions are enabled.
Fixed Addresses/ • Admins can add, modify, and • When you enable new permissions and
Reservations delete fixed addresses and you want to allow the admin to add,
reservations in an address range modify, and delete fixed addresses and
when they have read/write reservations in a specific address range,
permission for DHCP fixed define read/write permission for fixed
addresses for the network to addresses or reservations in that
which the range belongs. specified range. Note that if the admin
has read/write permission for the
network, they can add, modify, and
delete fixed addresses and reservations
that do not fall within a specific address
range.
• Fixed addresses appear in their
respective network containers,
networks, and ranges regardless of
whether new permissions are enabled.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 249

Managing Administrators

Enabling Permissions for DNS Resources in Networks and Ranges

To enable permission for DNS Resources in Networks and Ranges:
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and select Grid Properties -> Edit.
3. In the Grid Properties editor, select the General tab -> Advanced tab, and then complete the following:
— Enable DNS Object Permissions in Networks and Ranges: Select this check box to enable DNS object
permissions in networks and ranges. When you enable this, admins with Read/Write permission for specific
records in a zone or a higher-level DNS parent object, and admins with Read/Write permission for resource
records in specified network containers, networks, or ranges can add, modify, and delete A, AAAA, PTR
records, and DNS hosts that have associated IP addresses in the network containers, networks, or ranges.
4. Save the configuration and click Restart if it appears at the top of the screen.

Configuring Permissions for DNS Resources in Networks and Ranges

To define permissions for resources that are associated with IP addresses in a network container, network, or address
range, complete the following:
1. Log in to the appliance through the Infoblox CLI and use the set dns_perm_for_nw_range command to
enable new permissions, as follows:
Infoblox > set dns_perm_for_nw_range on
You can also enable permission for DNS resources in networks and ranges through the Infoblox GUI, as
described in Enabling Permissions for DNS Resources in Networks and Ranges on page 250.
2. Log in to Grid Manager and depending on which permission you want to define, do one of the following:
Network View: From the Administration tab, select the Networks View tab -> network_view check box and click
the Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box and
click the Edit icon.
Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon.
DHCP Range: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
addr_range check box, and then click the Edit icon.
Fixed Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
fixed_address check box, and then click the Edit icon.
Reservation: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
reservation check box, and then click the Edit icon.
Zone: From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and then click the Edit
icon.

Note: You cannot assign permissions for zones that are auto-created.

2. In the editor, click the Permissions tab, and select the supported permission from the Permissions drop-down
list for the admin group or role.
3. Select a resource from the drop-down list in the Resources column.
4. Save the configuration.

250 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DNS Resources with Associated IP addresses in Networks and Ranges

Permission Examples
The following table lists examples for configuring new permissions for fixed addresses (or reservations) in network
10.1.2.0/24 and range 10.1.2.1-10.1.2.10.

Permission for Action

Permission for
Action range Allowed? Comment
network 10.1.2.0/24
10.1.2.1-10.1.2.10 (Yes/No)
Add, modify, or No No No N/A
delete fixed
address
10.1.2.5
Add, modify, or No Read/write for Yes Read/write permission at
delete fixed “Fixed addresses in the range level is sufficient
address 10.1.2.1-10.1.2.10 for creating a fixed address
10.1.2.5 Range” that falls within the range.
Add, modify, or Read/write for “Fixed Deny for “Fixed Yes Since fixed address
delete fixed addresses in addresses in 10.1.2.100 does not belong
address 10.1.2.0/24 Network” 10.1.2.1-10.1.2.10 to the 10.1.2.1-10.1.2.10
10.1.2.100 Range” range, read/write
permission for “Fixed
addresses in 10.1.2.0/24
Network” is sufficient for
the operation.

The following table lists some examples for configuring DNS resources that have associated IP addresses in a network
or range:

Permission for Permission for Permission for Action

range
Action DNS zone network
10.1.2.1-10.1.2
Allowed? Comment
corp100.com 10.1.2.0/24 (Yes/No)
.10
Add, modify, or Read/write No No No Read/write
delete an A permission for permission for “A
record with IP corp100.com Records in 10.1.2.1-1
address 0.1.2.10 range” is
10.1.2.8 also required.
Add, modify, or Read/write No Read/write for Yes Since 10.1.2.8 falls
delete an A permission for “A Records in within the 10.1.2.1-
record with IP corp100.com 10.1.2.1- 10.1.2.10 range,
address 10.1.2.10 read/write permission
10.1.2.8 Range for “A Records in
10.1.2.1-1 0.1.2.10
Range” and
read/write for
corp100.com are both
required.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 251

Managing Administrators

Permission for
Permission for Permission for Action
range
Action DNS zone network
10.1.2.1-10.1.2
Allowed? Comment
corp100.com 10.1.2.0/24 (Yes/No)
.10
Add, modify, or Read/write Read-only Read/write for Yes for A Admins can add,
delete an A permission for permission for “A Records in record modify, and delete A
record with IP corp100.com network 10.1.2.1- No for records because they
address 10.1.2.0/24 10.1.2.10 network have read/write
10.1.2.8, and Range permissions for the
modify or zone and range; but
delete a they cannot modify or
network delete networks
because they have
read-only permission
for network
10.1.2.0/24.
Add, modify or Yes if the host is Read/write No Yes Host address
delete a DNS host. permission for 10.1.2.22 is within the
DHCP-enabled N/A if the host is “IPv4 Hosts in 10.1.2.0 network but
host address a DHCP host. 10.1.2.0 outside of the
10.1.2.22 network” 10.1.2.1- 10.1.2.10
range, so read/write
permission for “IPv4
Hosts in 10.1.2.0
network” is sufficient.
Add, modify, or Yes if the host is Read-only Read/write for Yes for A Admins can add,
delete a DNS host. permission for “Hosts in record modify, and delete
DHCP-enabled N/A if the host is network 10.1.2.1- No for DHCP-enabled hosts
host address a DHCP host. 10.1.2.0/24 10.1.2.10 network because they have
10.1.2.8, and Range read/write
modify or permissions for
delete a “Hosts in
network 10.1.2.1010.1.2.10
range”; but they
cannot modify or
delete networks
because they have
read-only permission
for network
10.1.2.0/24.

252 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DHCP Resources

Administrative Permissions for DHCP Resources

Limited-access admin groups can access certain DHCP resources only if their administrative permissions are defined.
By default, the appliance denies access when a limited-access admin group does not have defined permissions. You
can grant admin groups read-only or read/write permission, or deny access to the following DHCP resources:
• Network views
• IPv4 networks
• Hosts
• IPv4 DHCP ranges
• IPv4 DHCP fixed addresses
• IPv4 DHCP reservations
• MAC address filters
• IPv4 shared networks
• IPv4 network templates
• IPv4 DHCP range templates
• IPv4 fixed address templates
• IPv4 DHCP enabled host addresses
• IPv4 DHCP lease history
• Roaming hosts
• IPv6 networks
• IPv6 DHCP ranges
• IPv6 DHCP fixed addresses
• IPv6 DHCP enabled host addresses
• IPv6 shared networks
• IPv6 network templates
• IPv6 DHCP range templates
• IPv6 fixed address templates
• IPv6 DHCP lease history
You can grant an admin group broad permissions to DHCP resources, such as read/write permission to all IPv4 or IPv6
networks and shared networks in the database. In addition, you can grant permission to specific resources, such as
a specific IPv4 or IPv6 network or DHCP range, or an individual address in an IPv4 or IPv6 network. Permissions at
more specific levels override global permissions.
You can also define permissions for specific DHCP objects and Grid member to restrict admins to perform only the
specified DHCP tasks on the specified member. For more information, see Defining DNS and DHCP Permissions on
Grid Members on page 202.
The following sections describe the different types of permissions that you can set for DHCP resources:
• Administrative Permissions for Network Views on page 254
• Administrative Permissions for IPv4 and IPv6 Networks and Shared Networks on page 255
• Administrative Permissions for IPv4 or IPv6 Fixed Addresses and IPv4 Reservations on page 257
• Administrative Permissions for IPv4 and IPv6 DHCP Ranges on page 258
• Administrative Permissions for IPv4 or IPv6 DHCP Templates on page 259
• Administrative Permissions for Roaming Hosts on page 260
• Administrative Permissions for MAC Address Filters on page 261
• Administrative Permissions for the IPv4 and IPv6 DHCP Lease Histories on page 262

NIOS 7.3 NIOS Administrator Guide (Rev. A) 253

Managing Administrators

Administrative Permissions for Network Views

Limited-access admin groups can access network views, including the default network view, only if they have
read-only or read/write permission to a specific network view or to all network views. Permissions granted to a
network view apply to all its IPv4 and IPv6 networks, shared networks, DHCP ranges and fixed addresses.
You can grant admin groups read-only or read/write permission, or deny access to network views as follows:
• All network views—Global permission that applies to all network views in the database.
• A specific network view—Permission to a specific network view applies to the properties you set in the Network
View editor, and to all the IPv4 and IPv6 networks and shared networks in the network view. This overrides the
global permission to all network views. When you configure permissions for a network view, you can also set
permissions for the following:
— All IPv4 and IPv6 networks in the selected network view—If you do not define permissions for IPv4 or IPv6
networks, they inherit the permissions of their network view.
— All IPv4 and IPv6 shared networks in a specific network view—If you do not define permissions for IPv4 or
IPv6 shared networks, they inherit the permissions of their network view.
Note that you can grant an admin group read-only or read/write permission to specific IPv4 or IPv6 networks in a
network view, without granting them permission to that network view. For information, see Administrative
Permissions for IPv4 and IPv6 Networks and Shared Networks on page 255.
For information on how to define permissions for network views, see Applying Permissions and Managing Overlaps
on page 204.
The following table lists the tasks admins can perform and the required permissions for network views.

Table 4.18 Network View Permissions

All IPv4 or IPv6 Shared Networks

All IPv4 or IPv6 Networks
Specific Network View
Specific DNS View

All Network Views

All DNS Views

Tasks

Create and delete network views and their associated DNS views RW RW

Create and delete a network view and its associated DNS views RW RW

Create, modify, and delete IPv4 and IPv6 networks and shared networks in all network views RW

Create, modify, and delete IPv4 and IPv6 networks and shared networks in a network view RW

View the properties of all network views RO

View network statistics of all network views RO

View and search for all IPv4 and IPv6 networks and shared networks RO

View the properties of a network view RO

View and search for IPv4 and IPv6 networks and shared networks in a network view RO

Expand and join IPv4 and IPv6 networks RW

Expand and join IPv4 and IPv6 networks in a specific network view RW

Create, modify, and delete IPv4 and IPv6 networks, DHCP ranges and fixed addresses in a RW

specific network view

254 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DHCP Resources

All IPv4 or IPv6 Shared Networks

All IPv4 or IPv6 Networks
Specific Network View
Specific DNS View

All Network Views

All DNS Views
Tasks

View network statistics and properties of all networks in a network view RO

Search for IPv4 and IPv6 networks in a network view RO

Create, modify, and delete all IPv4 or IPv6 shared networks RW

View the properties of all IPv4 or IPv6 shared networks RO

View and search for IPv4 and IPv6 shared networks in a network view RO

Restart services from the DHCP tab RO RW

Administrative Permissions for IPv4 and IPv6 Networks and Shared Networks
Limited-access admin groups can access IPv4 and IPv6 networks, including shared networks, only if their
administrative permissions are defined. Permissions for a network apply to all its DHCP ranges and fixed addresses.
To override network-level permissions, you must define permissions for specific DHCP ranges and fixed addresses.
For example, you can grant an admin group read-only permission to a network, read/write permission to its DHCP
ranges, and read-only permission to its fixed addresses.
You can grant read-only or read/write permission, or deny access to networks, as follows:
• All IPv4 or IPv6 networks—Global permission that applies to all IPv4 or all IPv6 networks in the database.
• All IPv4 or IPv6 shared networks—Global permission that applies to all IPv4 or all IPv6 shared networks in the
database.
• A specific IPv4 or IPv6 network—Network permissions apply to its properties and to all DHCP ranges, fixed
addresses and hosts in the network, if they do not have permissions defined. This overrides global permissions.
• All IPv4 or IPv6 DHCP ranges in a network—If you do not define permissions for DHCP ranges, they inherit the
permissions of the network in which they reside.
• All IPv4 or IPv6 fixed addresses in a network—If you do not define permissions for fixed addresses, they inherit
the permissions of the network in which they reside.
To define permissions for a specific IPv4 or IPv6 network and its DHCP ranges and fixed addresses, see Applying
Permissions and Managing Overlaps on page 204.
The following table lists the tasks admins can perform and the required permissions for IPv4 and IPv6 networks.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 255

Managing Administrators

Table 4.19 Network Permissions

All IPv4 or IPv6 Shared Networks

All IPv4 or IPv6 Fixed Addresses

IPv4 or IPv6 Network Template

Specific IPv4 or IPv6 Network

All IPv4 or IPv6 DHCP Ranges

All IPv4 or IPv6 Networks

Specific DNS Zone

Grid Member(s)
Tasks

Create, modify, and delete IPv4 or IPv6 networks, DHCP ranges, and fixed RW

addresses without assigned Grid members

Create, modify, and delete IPv4 or IPv6 networks, DHCP ranges, and fixed RW RW

addresses with assigned Grid members

Assign a Grid member to a specific IPv4 or IPv6 network and its DHCP ranges RW RW

Expand and join IPv4 or IPv6 networks RW

Create IPv4 or IPv6 networks from templates RW RO

Create, modify, and delete an IPv4 or IPv6 network RW

View IPv4 or IPv6 network properties and statistics, and search for DHCP RO

ranges and fixed addresses in a specific network

Create, modify, and delete IPv4 or IPv6 DHCP ranges and fixed addresses in a RW

specific network
Create and split an IPv4 or IPv6 network and automatically create a reverse RW RW

DNS zone

Create, modify, and delete IPv4 or IPv6 shared networks RW

View IPv4 or IPv6 shared networks RO

Create, modify, and delete IPv4 or IPv6 DHCP ranges with an assigned RW RW

member in a specific network

Create, modify, and delete IPv4 or IPv6 DHCP ranges RW

View and search for IPv4 or IPv6 DHCP ranges in a specific network RO

Create, modify, and delete IPv4 or IPv6 fixed addresses RW

View and search for IPv4 or IPv6 fixed addresses in a specific network RO

256 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DHCP Resources

Administrative Permissions for IPv4 or IPv6 Fixed Addresses and IPv4 Reservations
IPv4 and IPv6 fixed addresses and IPv4 reservations inherit the permissions of the networks in which they reside. You
can override network-level permissions by defining permissions for fixed addresses.
You can grant read-only or read-write permission, or deny access to fixed addresses, as follows:
• All IPv4 fixed addresses/reservations—Global permission that applies to all IPv4 fixed addresses and
reservations in the database.
• All IPv6 fixed addresses—Global permission that applies to all IPv6 fixed addresses in the database.
• All IPv4 fixed addresses/reservations in a network— Permissions at this level override global permissions. If you
do not define permissions for fixed addresses and reservations, they inherit the permissions of the network in
which they reside.
• All IPv6 fixed addresses in a network— Permissions at this level override global permissions. If you do not
define permissions for IPv6 fixed addresses, they inherit the permissions of the network in which they reside.
• A single IPv4 fixed address/reservation—Overrides global and network-level permissions.
• A single IPv6 fixed address—Overrides global and network-level permissions.
For information on setting permissions for fixed addresses, see Applying Permissions and Managing Overlaps on
page 204.
The following table lists the tasks admins can perform and the required permissions for IPv4 and IPv6 fixed
addresses.

Table 4.20 Permissions for Fixed Addresses/Reservations

Specific IPv4 or IPv6 Fixed Address/

All IPv4 or IPv6 fixed Addresses/
Specific IPv4 or IPv6 Network

IPv4 Reservations

IPv4 Reservation

Tasks

Create, modify, and delete IPv4 fixed addresses/reservations or IPv6 fixed RW

addresses
Create, modify, and delete IPv4 fixed addresses/reservations or IPv6 fixed RW

addresses in a specific network

Modify and delete an IPv4 fixed address/reservation or IPv6 fixed address RW

View and search for all IPv4 fixed addresses/reservations or IPv6 fixed addresses RO

View and search for IPv4 fixed addresses/reservations or IPv6 fixed addresses in RO RO

a network

View and search for an IPv4 fixed address/reservation or IPv6 fixed address RO

NIOS 7.3 NIOS Administrator Guide (Rev. A) 257

Managing Administrators

Administrative Permissions for IPv4 or IPv6 DHCP Enabled Host Addresses

A read-write permission to IPv4 or IPv6 Host Address gives limited-access users the ability to create, modify, and
delete IPv4 and IPv6 DHCP enabled host addresses in a specified network. Admin users with a read-write permission
can create, modify, and delete IPv4 or IPv6 DHCP enabled host addresses only in the specified network. They do not
have the ability to create, modify or delete any networks or objects, such as fixed addresses, in those networks.
You can also grant admin users read-only permission or deny access to the following:
• IPv4 Host Address—Object permission that applies to all IPv4 DHCP enabled host addresses in a specified
network.
• IPv6 Host Address—Object permission that applies to all IPv6 DHCP enabled host addresses in a specified
network.
For information about setting permissions for DHCP enabled host addresses, see Applying Permissions and
Managing Overlaps on page 204.
The following table lists tasks that admins can perform and the required permissions for IPv4 and IPv6 DHCP enabled
host addresses.

Table 4.21 Permissions for DHCP Enabled Host Addresses

All IPv4 or IPv6 DHCP enabled 

Specific IPv4 or IPv6 Network

host Addresses
Tasks

Create, modify, and delete IPv4 or IPv6 DHCP enabled host addresses in a RW

specified network

Modify and delete a specific IPv4 or IPv6 DHCP enabled host address RW

View and search for all IPv4 or IPv6 DHCP enabled host addresses RO

View and search for IPv4 or IPv6 DHCP enabled host addresses in a specified RO

network

Administrative Permissions for IPv4 and IPv6 DHCP Ranges

DHCP ranges inherit the permissions of the networks in which they reside. You can override network-level
permissions by defining permissions for DHCP ranges. You can read-only or read/write permission, or deny access to
DHCP address ranges, as follows:
• All IPv4 or IPv6 DHCP ranges—Global permission that applies to all IPv4 or IPv6 DHCP ranges in the database.
• All IPv4 or IPv6 DHCP ranges in a network—Permissions at this level override global permissions. If you do not
define permissions for DHCP ranges, they inherit the permissions of the network in which they reside.
• A single IPv4 or IPv6 DHCP range—Overrides global and network-level permissions.
For information on setting permissions for DHCP ranges, see Applying Permissions and Managing Overlaps on page
204. The following table lists the tasks admin can perform and the required permissions for DHCP ranges.

258 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DHCP Resources

Table 4.22 DHCP Ranges

Specific IPv4 or IPv6 DHCP Range

Specific IPv4 or IPv6 Network

All DHCP IPv4 or IPv6 Ranges

MAC Address Filter

Grid Member(s)
Tasks

Create, modify, and delete IPv4 or IPv6 DHCP ranges with an assigned member or RW RW

a failover association
Create, modify, and delete IPv4 or IPv6 DHCP ranges in a network with assigned RW RW

members

Modify and delete an IPv4 or IPv6 DHCP range with an assigned member RW RW

View and search for all IPv4 or IPv6 DHCP ranges with an assigned member RO RO

View and search for IPv4 or IPv6 DHCP ranges in a network with assigned members RO RO

View and search for an IPv4 or IPv6 DHCP range with an assigned member RO RO

View and search for an IPv4 or IPv6 DHCP range without an assigned member RO

Apply relay agent and option filters to an IPv4 DHCP range RW

Apply a MAC address filter to an IPv4 DHCP range RW RO

Administrative Permissions for IPv4 or IPv6 DHCP Templates

There are three types of DHCP templates for IPv4 and IPv6 objects—network, DHCP range, and fixed
address/reservation templates. To access any of these templates, a limited-access admin group must have read-only
permission to the template. Limited-access admin groups cannot have read/write permission to the templates. Only
superusers can create, modify and delete network, DHCP range, and fixed address templates. An admin group with
read-only permission to the DHCP templates can view them and use them to create networks, DHCP ranges and fixed
addresses, as long as they have read/write permissions to those DHCP resources as well.
You can set global read-only permission that applies to all DHCP templates, and you can set permissions to specific
templates as well.
For information on setting permissions, see Applying Permissions and Managing Overlaps on page 204. The
following table lists the tasks admins can perform and the required permissions for DHCP templates.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 259

Managing Administrators

Table 4.23 Permissions for DHCP Templates

All IPv4 or IPv6 Fixed Addresses/

All IPv4 or IPv6 DHCP Ranges
IPv4 or IPv6 DHCP Templates

All IPv4 or IPv6 Networks

IPv4 Reservations
Tasks

Create IPv4 or IPv6 networks from templates RO RW

Create IPv4 or IPv6 DHCP ranges from templates RO RW

Create IPv4 fixed addresses/reservations or IPv6 fixed RO RW

addresses from templates

View templates RO

Note the following additional guidelines:

• DHCP range templates and fixed address templates do not inherit their permissions from network templates.
You must set permissions for each type of template.
• An admin group can create a network using a network template that includes a DHCP range template and a fixed
address template, even if it has no permission to access the DHCP range and fixed address templates.

Administrative Permissions for Roaming Hosts

Limited-access admin groups can access roaming hosts only if their administrative permissions are defined. The
appliance denies access to roaming hosts for which an admin group does not have defined permissions.
You can grant read-only or read/write permission, or deny access to roaming hosts as follows:
• All roaming hosts in the database—Global permission that applies to all the roaming hosts in the database.
• A specific roaming host—Permissions that applies to specific roaming host.
For information on setting permissions, see Applying Permissions and Managing Overlaps on page 204. The
following table lists the tasks admins can perform and the required permissions for roaming host.

260 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for DHCP Resources

Table 4.24 Permissions for Roaming Hosts

Specific IPv4 or IPv6 Roaming Host

Grid DHCP Properties

All Roaming Host

Tasks

Enable roaming hosts RW

View roaming host RO RO RO

Create, modify, and delete roaming hosts RO RW

Modify and delete roaming host RO RW

Administrative Permissions for MAC Address Filters

Limited-access admin groups can access MAC address filters only if their administrative permissions are defined. The
appliance denies access to MAC address filters for which an admin group does not have defined permissions.
You can grant read-only or read/write permission, or deny access to MAC address filters as follows:
• All MAC address filters in the database
• A specific MAC address filter
For information on setting permissions, see Applying Permissions and Managing Overlaps on page 204. The
following table lists the tasks admins can perform and the required permissions for MAC address filters.

Table 4.25 Permissions for MAC Filters

Specific MAC Address Filter

Specific IPv4 DHCP Ranges

All MAC Address Filters

Tasks
Create, modify, and delete MAC address filters RW

Create, modify, and delete MAC address entries for a MAC address filter RW

Modify and delete a MAC address filter RW

Apply a MAC address filter to an IPv4 DHCP range RO RW

Delete a MAC address filter from an IPv4 DHCP range RO RW

View MAC address filters and their MAC address entries RO

View a MAC address filter and its MAC address entries RO

NIOS 7.3 NIOS Administrator Guide (Rev. A) 261

Managing Administrators

Administrative Permissions for the IPv4 and IPv6 DHCP Lease Histories
A limited-access admin group can view and export the IPv4 and IPv6 DHCP lease histories if it has read-only
permission to the IPv4 and IPv6 DHCP lease history. Permissions to the IPv4 and IPv6 DHCP lease histories are
different from the network permissions. Therefore, an admin group can access the IPv4 and IPv6 DHCP lease
histories, regardless of its network permissions. Note that only superusers can import a DHCP lease history file.
To define permissions for the IPv4 and IPv6 DHCP lease histories:
1. For an admin group: From the Administration tab, select the Administrators tab -> Permissions tab -> admin_group
in the Groups table, and then click the Add icon -> Global Permissions from the Create New Permission area or
select Add -> Global Permissions from the Toolbar.
or
For an admin role: From the Administration tab, select the Administrators tab -> Permissions tab -> admin_role in
the Roles table, and then click Add icon -> Global Permissions from the Create New Permission area or select
Add -> Global Permissions from the Toolbar.
2. Complete the following in the Manage Global Permissions dialog box:
— Permission Type: Select DHCP Permissions from the drop-down list.
— In the table, select Read/Write, Read-only, or Deny for All IPv4 DHCP Lease History and All IPv6 DHCP Lease
History.
3. Save the configuration and click Restart if it appears at the top of the screen.

Administrative Permissions for File Distribution Services

You can restrict access to the TFTP, HTTP and FTP services provided by the appliance. By default, the appliance denies
access to the TFTP, HTTP and FTP services, unless an admin group has their administrative permissions defined.
You can grant read-only or read/write permission, or deny access to the following resources:
• Grid File Distribution Properties—Applies to the Grid and its members, directories, and files. You can set this
from the Administrators perspective only.
• Member File Distribution Properties—Applies to the Grid member properties only.
• A specific directory—Applies to the directory and its files.
For information on setting permissions, see Applying Permissions and Managing Overlaps on page 204. The
following table lists the tasks admins can perform and the required permissions for file distribution services.

Table 4.26 Permissions for File Distribution Services

Member Distribution Properties
Grid File Distribution

Specific Directory
Properties

Tasks

Create and remove directories and files RW

Modify the Grid and member file distribution properties RW

View the Grid and member file distribution properties, directories, and files RO

Modify the member file distribution properties RW

262 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for Dashboard Tasks

Member Distribution Properties

Grid File Distribution

Specific Directory
Properties
Tasks

View the member file distribution properties RO

Add and delete a directory, subdirectories, and files in the directory RW

View a directory and its subdirectories and files RO

Administrative Permissions for Dashboard Tasks

Limited-access admin groups can configure IPAM tasks on the Tasks Dashboard only if their administrative
permissions are defined. The appliance denies access to IPAM tasks for which an admin group does not have defined
permissions.
You can grant read-only or read/write permission, or deny access to IPAM tasks as follows:
• All IPAM tasks on the Tasks Dashboard
• A specific IPAM task
When you deny access to an IPAM task for an admin group, uses cannot configure the task on their dashboards. Users
must have at lease read-only permission to a specific task to see it in the task pack. To perform a specific task, users
must also have read/write permission to the objects associated with the task. For information about specific
permissions for IPAM, DNS, and DHCP objects, see Administrative Permissions for IPAM Resources on page 240,
Administrative Permissions for DNS Resources on page 241, and Administrative Permissions for DHCP Resources on
page 253.
For information about setting permissions, see Applying Permissions and Managing Overlaps on page 204. The
following table lists the tasks admins can perform and the required permissions for configuring IPAM tasks on the
Tasks Dashboard.

Table 4.27 Permissions for IPAM Tasks

Add Fixed Addresses
All Dashboard Tasks

Add CNAME Record

Add TXT Record

Add MX Record
Add Networks

Add Hosts

Tasks

Configure all tasks in the IPAM task pack RO

RW

Configure the Add Networks task RO

RW

Configure the Add Hosts task RO

RW

Configure the Add Fixed Addresses task RO

RW

Configure the Add CNAME Record task RO

RW

NIOS 7.3 NIOS Administrator Guide (Rev. A) 263

Managing Administrators

Add Fixed Addresses

All Dashboard Tasks

Add CNAME Record

Add TXT Record

Add MX Record
Add Networks

Add Hosts
Tasks

Configure the Add TXT Record task RO

RW

Configure the Add MX Record task RO

RW

Administrative Permissions for OCSP Server Groups and CA

Certificates
Limited-access admins can configure OCSP server groups and CA certificates only if their administrative roles and
permissions are defined. If you want to allow admins to configure two-factor authentication, you can assign the PKI
Admin role to limited-access admins or grant them read/write permissions to the following:
• All OCSP Groups
• All CA Certificates
For information about setting permissions, see Applying Permissions and Managing Overlaps on page 204. The
following table lists the admin tasks and required permissions for configuring an OCSP server group and managing
CA certificates.

Table 4.28 Administration Permissions

All OCSP Server Groups

All CA Certificates
Grid Member(s)

Tasks

Create, modify, and delete the OCSP server group RW

Create, modify, and delete CA certificates RW RW

Administrative Permissions for Load Balancers

Limited-access admins can view and manage GLBs (Global Load Balancers), load balancer synchronization groups,
and their associated objects if their administrative roles and permissions are defined. If you want to allow admins to
manage GLB objects, assign the Load Balancer Admin role to limited-access admins and grant them the following
permissions:
• Read/write, read-only, or deny permission to NIOS managed GLB groups and independent load balancers
• Read/write, read-only, or deny permission to NIOS managed GLB objects
• Read-only or deny permission to GLB objects, such as DNS profiles and iRules, that are synchronized from the
GLB but cannot be managed through NIOS

264 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for Named ACLs

For information about setting permissions, see Applying Permissions and Managing Overlaps on page 204. The
following table lists the admin tasks and required permissions for configuring GLBs, load balancer synchronization
groups, and their associated objects.

Table 4.29 Administration Permissions for Load Balancers and Load Balancer Synchronization Groups

All Load Balancer Objects

All Load Balancer Groups

All Load Balancers
Grid Member(s)
Tasks

View load balancer objects RO RO

Add and modify synchronized load balancer objects RW RW

Add, modify, and delete synchronized load balancer objects RW RW RW RW

Modify and delete synchronized load balancer groups RW RW RW

Administrative Permissions for Named ACLs

Only superusers and limited-access users with Read/Write permission to All Named ACLs and Read/Write permission
to the corresponding objects and operations can manage named ACLs and their ACEs.
For information about access control and named ACLs, see Configuring Access Control on page 374. The following
table lists the operations and required permissions for managing named ACLs.

Table 4.30 Administration Permissions

Related DNS objects

File Distribution
All Named ACLs
Grid Member(s)

DNS Views

Tasks
Create, modify, and delete named ACLs for all supported operations RW RW RW RW RW

View named ACLs and ACEs RW RO RO RO RO

Administrative Permissions for DNS Threat Protection

You can grant read-only or read/write permission, or deny access to the following resources:
• Grid Security Properties—Applies to the Grid and its members.
• Member Security Properties—Applies to the Grid members only.
For information about setting permissions, see Applying Permissions and Managing Overlaps on page 204. The
following table lists the tasks admins can perform and the required permissions for the threat protection service.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 265

Managing Administrators

Table 4.31 Permissions for Threat Protection Service

Member Security Properties

Grid Security Properties
Tasks

View Grid security properties RO

Update Grid Security properties RW

View member security properties for specific Grid members RO RO

Update member security properties for specific Grid members RW RW

Start and stop threat protection service for a Grid member RW RW

Publish rules for a Grid member RW RW

View rule categories and rules for the Grid RO

Enable and disable rules for the Grid RW

Update rule versions for any rules on the Grid RW

Revert to a previous rule version for any rules on the Grid RW

Modify configuration parameters, such as action and severity, for rules on the Grid RW

Create custom rules from rule templates for the Grid RW

Delete custom rules for the Grid RW

View rule categories and rules on a Grid member RO RO

Enable and disable rules on a Grid member RW RW

Update rule versions for any rules on a Grid member RW RW

Revert to a previous rule version for any rules on a Grid member RW RW

Modify configuration parameters, such as action and severity, for rules on a Grid member RW RW

View threat protection related event statistics on a Grid member RO RO

Upgrade rulesets for a Grid RW

Administrative Permissions for All Rulesets

You can grant permissions for individual ruleset objects to admin users. NIOS provides a global permission ALL
Rulesets for admin groups. To perform operations on an NXDOMAIN ruleset, a blacklist rule, or an RPZ ruleset, you
must have permission to the rule or ruleset to which the ruleset object belongs.

266 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for Cloud Objects

Administrative Permissions for Cloud Objects

You can grant read-only or read/write permission, or deny access to the following cloud related objects:
• All tenant—Applies to all tenants.
• Per tenant object—Applies to selected tenants only.
You need appropriate permissions to make changes to all tenants or a specific tenant object through Grid Manager.
Note that following:
• Update the tenant object: You must have permission on all tenant objects or the specific tenant object that is
being updated. When you modify any tenant object associated with a tenant, it requires explicit Read/Write
permission on the specific tenant object, whether permission on the associated tenant exists or not.
• Read-Only: This operation returns all tenant objects if you have the all tenant permission, or returns only
specific tenant objects for which you have access.
• Permission for a tenant object implicitly gives the read permission to any object that is associated with the
tenant.
• Note that creating and deletion operations do not need any permission.

Administrative Permissions for CSV Import

The following CSV import permissions are applicable to local users on the NIOS appliance. They are not valid for AD
or RADIUS users.
• When you delete a user, CSV import tasks associated with the respective user are not deleted. Superusers can
access these tasks. Pending CSV import tasks will not be executed due to authentication failure.
• If you change user permissions, the pending and running CSV import tasks are executed, but may finish with
errors. Note that the appliance re-establishes database transaction after every 500 lines are imported. If you
delete or modify the respective user entry between these transactions, the rest of the import may fail.
• Superusers can manage any stopped, failed, or completed CSV import tasks belonging to a deleted user.

Administrative Permissions for Reporting

NIOS supports global and object permissions for reporting: Reports and Searches. Consider the following when
applying permissions for reports and searches:
• When you view a DNS report, DHCP report, or search options, you can view all the data in the corresponding
report or search results, even if you do not have permissions to view the DNS or DHCP objects.
• A limited-access user needs relevant permissions to view any report or search.
• When you grant a read-only permission for a specific report to a user, the user receives read-only access to
everything the report displays.
• A user can view report data returned by a search operation even when the user is denied access to the search
operation.
• You can only view pre-defined reports, global reports and customized reports or searches. A user, including
superuser, cannot view customized reports or searches of other users.
• You cannot edit pre-defined reports.
• Only a superuser can edit global reports or searches.
• Only an owner of the customized report or search operation can modify the report.
• Superuser may create reports up to system wide limit.
• A limited-access admin can create up to five reports by default. You can configure this limitation through Grid
Manager.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 267

Managing Administrators

268 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 5 Deploying a Grid
To deploy a Grid, it is important to understand what a Grid is, how to create a Grid Master and add members, and how
to manage the Grid.
This chapter explains these tasks in the following sections:
• Introduction to Grids on page 271
— Grid Communications on page 273
— NAT Groups on page 275
— Automatic Software Version Coordination on page 278
— Grid Bandwidth Considerations on page 280
• About HA Pairs on page 282
— Planning for an HA Pair on page 283
— About HA Failover on page 284
— VRRP Advertisements on page 285
• Creating a Grid Master on page 287
— Port Numbers for Grid Communication on page 289
— Grid Setup Wizard on page 289
— Creating an HA Grid Master on page 289
— Creating a Single Grid Master on page 294
• Adding Grid Members on page 297
— Adding a Single Member on page 297
— Adding an HA Member on page 300
— Changing the Communication Protocol for a Dual Mode Appliance on page 302
— Joining Appliances to the Grid on page 302
— Grouping Members by Extensible Attributes on page 303
• Configuring an IPv6-only Grid on page 304
— Transforming to an IPv6-only Grid on page 305
• Auto-Provisioning NIOS Appliances on page 307
— Joining Auto-Provisioned Appliances to the Grid on page 308
• Pre-Provisioning NIOS and vNIOS Appliances on page 309
— Guidelines for Pre-provisioning Offline Grid Members on page 309
— Configuring Pre-Provisioned Members on page 310
— About Provisional Licenses on page 310
— Guidelines for Joining Pre-Provisioned Members to the Grid on page 311

NIOS 7.3 NIOS Administrator Guide (Rev. A) 269

Deploying a Grid

• Configuration Example: Configuring a Grid on page 312

— Cable All Appliances to the Network and Turn On Power on page 314
— Create the Grid Master on page 314
— Define Members on the Grid Master on page 316
— Join Appliances to the Grid on page 317
— Import DHCP Data on page 319
— Import DNS Data on page 321
— Using the Wizard on page 322
— After Using the Wizard on page 324
• Managing a Grid on page 325
— Changing Grid Properties on page 325
— Configuring Security Level Banner on page 326
— Configuring Informational Level Banner on page 327
— Configuring Recursive Deletions of Networks and Zones on page 327
— Setting the MTU for VPN Tunnels on page 328
— Removing a Grid Member on page 328
— Promoting a Master Candidate on page 328
— Enabling Read-only API Access on the Grid Master Candidate on page 329
• About the Master Grid on page 330

270 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Introduction to Grids

Introduction to Grids
A Grid is a group of two or more NIOS appliances that share sections of a common, distributed, built-in database and
which you configure and monitor through a single, secure point of access: the Grid Master. A Grid can include Infoblox
appliances and vNIOS appliances. A vNIOS appliance is a non-Infoblox hardware platform running the vNIOS software
package. For supported vNIOS platforms, see Supported vNIOS Appliance Models and Specifications on page 1775.
Infoblox appliances support both IPv4 and IPv6 networks and you can configure a Grid in one of the following modes:
• IPv4-only: An IPv4-only Grid uses IPv4 as the Grid communication protocol and it includes an IPv4 Grid Master
and the Grid members, which can be either IPv4 or dual mode (IPv4 and IPv6) independent and HA appliances.
Note that when you add a dual mode HA member to an IPv4-only Grid, the communication protocol between the
two nodes of an HA pair must be IPv4.
• IPv6-only: An IPv6-only Grid uses IPv6 as the Grid communication protocol and it includes an IPv6 Grid Master
and the Grid members, which can be either IPv6 or dual mode (IPv4 and IPv6) independent and HA appliances.
Note that when you add a dual mode HA member to an IPv6-only Grid, the communication protocol between the
two nodes of an HA pair must be IPv6.
• IPv4 and IPv6 (Dual mode): A dual mode Grid can use either IPv4 or IPv6 as the Grid communication protocol. A
dual mode Grid includes a dual mode Grid Master and the Grid members, which can be either IPv4, IPv6, or dual
mode independent and HA appliances.

Note: Infoblox appliances support IPv4 and IPv6 networking configurations in most deployments cited in this
chapter. You can set the LAN1 port to an IPv6 address and use that address to access Grid Manager. All HA
(high availability) operations can be applied across IPv6. Topics in this and following chapters generally use
IPv4 examples. Also note that the LAN2, MGMT, and VLAN ports also support IPv6. DNS services are fully
supported in IPv6 for the LAN1, LAN2, MGMT, and VLAN ports. DHCP services are fully supported in IPv6 for
the LAN1 and LAN2 ports. Examples throughout this chapter use IPv4 addressing. Interfaces on NIOS
appliances support both IPv4 and IPv6 transports and intra-Grid communication is based on the type of IP
address used by the Grid member to join the Grid.

The following table summarizes the possible setups of a Grid configuration:

Table 5.1 Possible Setups of Grid configuration

Grid Grid Additional Additional

Grid VRRP Protocol Communication Connection via IPv4 IPv6
Configuration for HA Pair Protocol MGMT Addresses Addresses
IPv4 Grid Master IPv4 IPv4 NA Yes Yes
IPv6 Grid Master IPv6 IPv6 NA Yes Yes
Dual mode Grid IPv4 or IPv6 IPv4 or IPv6 NA Yes Yes
Master
IPv4 Grid member IPv4 IPv4 IPv4 Yes Yes
IPv6 Grid member IPv6 IPv6 IPv6 Yes Yes
Dual mode Grid IPv4 or IPv6 IPv4 or IPv6 IPv4 or IPv6 Yes Yes
member

NIOS 7.3 NIOS Administrator Guide (Rev. A) 271

Deploying a Grid

You can also add supported Reporting platforms as a logging and reporting devices in your Grid. Infoblox provides a
few Infoblox platforms that you can use as the logging and reporting device. For information about the supported
appliances, see Supported Platforms for Reporting on page 1391. Infoblox reporting solution supports both IPv4 and
IPv6 networks and you can configure a reporting member in either IPv4, IPv6, or in dual mode (IPv4 and IPv6) network
environment. An IPv4-only Grid uses IPv4 as the Grid communication protocol, so you can add an IPv4 or dual mode
reporting member to an IPv4-only Grid. An IPv6-only Grid uses IPv6 as the Grid communication protocol, so you can
add an IPv6 or dual mode reporting member to an IPv6-only Grid. However, a dual mode Grid can use either IPv4 or
IPv6 as the Grid communication protocol, so you can add an IPv4, IPv6, or a dual mode reporting member to a dual
mode Grid. The reporting appliance collects data from members in the Grid and stores the data in the database. It
then uses the data to generate predefined and user-defined reports that you can access through Grid Manager. These
reports provide useful information about the IPAM, DNS, DHCP, and system activities and usage in your Grid. For more
information about reporting, see Infoblox Reporting and Analytics on page 1379.
Instead of manually provisioning IP addresses and DNS name spaces for network devices and interfaces, you can add
Cloud Platform Appliances to leverage DNS and DHCP features of the Grid to manage your CMPs (Cloud Management
Platforms). For information about the Infoblox Cloud Network Automation solution and supported Grid
configurations, see Deploying Cloud Network Automation on page 361.
Figure 5.1 shows the basic concept of a Grid, database distribution (or “replication”), and reporting.

Figure 5.1 Grid and Partitioned Database Replication

The administrator makes a secure

connection to the Grid Master to Grid Master Master Candidate
configure and manage all Grid
Database
members.
HTTPS session

The Grid Master replicates the … and it replicates the

section of the database that entire database to the
Administrator applies to each member … Master Candidate.

The reporting member collects data

from Grid members, stores the data
in the reporting database, and
vNIOS on generates reports you can view and
Riverbed manage from the Grid Master.

vNIOS on
VMware HA Member
Grid

The reporting member collects data

from members. Reporting Member

Note: In addition to the HTTPS session securing administrative traffic to the

Grid Master, all Grid communications between the Grid Master and Grid
members pass through encrypted VPN tunnels (not shown).

The Grid Master can be either an HA master or a single master; that is, an HA (high availability) pair or a single
appliance. Similarly, a Grid member can be either a single member or an HA member. You can add single appliances
and HA pairs to a Grid, forming single members and HA members respectively. A single Grid member can be either
an Infoblox appliance or a vNIOS appliance. An HA Grid member can be a pair of Infoblox appliances or vNIOS
appliances. For information, see Supported vNIOS Appliance Models and Specifications on page 1775.

272 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Introduction to Grids

The Grid Master communicates with every Grid member in a hub-and-spoke configuration. Intra-Grid communication
is based on the type of IP address used by the Grid member to join the Grid Master. An IPv4-only Grid Master uses
IPv4 and an IPv6-only Grid Master uses IPv6 for intra-Grid communication. However, a dual mode Grid Master uses
either IPv4 or IPv6 depending on the IP address type used by the Grid member to join the Grid Master. For an HA
member, the Grid Master communicates with the active node, which in turn communicates with the passive node, as
shown in Figure 5.2.

Figure 5.2 Grid Communications to an HA Member

Grid Master 1 The Grid Master communicates with

the active node of the HA member.
HA Member
VPN Tunnel
Node 1
Active
VIP  LAN1 Port
(on HA Port) LAN1 Port
(on HA Port)

2 The active node communicates

with the passive node. VPN Tunnel

LAN1 Port
Node 2
Passive

When adding vNIOS appliances to a Grid, you centralize the management of core network services of the virtual
appliances through the Grid Master. vNIOS appliances support most of the features of the Infoblox NIOS software,
with some limitations as described in Appendix E, "vNIOS Appliances", on page 1775.
For additional information specific to each platform, refer to the Quick Start Guide for Installing vNIOS Software on
Riverbed Services Platforms and the Quick Start Guide for Installing vNIOS Software on VMware Platforms.
By default, Grid communications use the UDP transport with a source and destination port of 1194. This port number
is configurable. For a port change to take effect, one of the following must occur: the HA master fails over, the single
master reboots, or the Grid restarts services.
After adding an appliance or HA pair to a Grid, you no longer access the Infoblox GUI on that appliance. Instead, you
access the GUI running on the Grid Master. Although you can create multiple administrator accounts to manage
different services on various Grid members, all administrative access is through the Grid Master. So even if someone
has administrative privileges to a single Grid member, that administrator must access the GUI running on the Grid
Master to manage that member.
You can access the Infoblox GUI through an HTTPS connection to one of the following IP addresses and ports on the
Grid Master:
• The VIP address, which links to the HA port on the active node of an HA Grid Master
• The IP address of the LAN1 port on a single Grid Master
• The IP address of the MGMT port (if enabled) of the active node of an HA or single Grid Master. See Using the
MGMT Port on page 461.

Grid Communications
The Grid Master synchronizes data among all Grid members through encrypted VPN tunnels. The default source and
destination UDP port number for VPN tunnels is 1194. You can continue using the default port number or change it.
For example, if you have multiple Grids, you might want each Grid to use a different port so that you can set different
firewall rules for each. Whatever port number you choose to use for the VPN tunnels in a Grid, all the tunnels in that
Grid use that single port number.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 273

Deploying a Grid

Before an appliance or HA pair forms a tunnel with the master, they first authenticate each other using the
Challenge-Response Authentication Mechanism (CRAM). The source and destination port number for this traffic is
2114. During the CRAM handshake, the master tells the appliance or HA pair what port number to use when building
the subsequent VPN tunnel.

Figure 5.3 VPN Tunnels within a Grid

If the Grid Master is a single appliance, it Single Member

communicates with the Grid members
from its LAN1 port.
Grid
HA Grid Master

Node 1 (Active) LAN1 10.1.1.16

Node 2 (Passive)

HA Member
VIP 10.1.1.11
(on Active Node) LAN1 10.1.1.18
(on Active Node of
Encrypted HA Member)
VPN Tunnels
Node 1 (Active)
HA 10.1.1.13
Node 2 (Passive)
HA 10.1.1.15 VIP 10.1.1.22
(on Active Node)

HA 10.1.1.19

HA 10.1.1.21 If you enable Grid communications on

LAN1 10.1.1.14 the MGMT ports of an HA member,
(on Passive Node the active node communicates from
of Grid Master) its MGMT port to the Grid Master, and
the passive node communicates from
Note: The default source and destination UDP its MGMT port to the MGMT port on
ports for all VPN tunnels in a Grid is 1194. the active node.

LAN1 10.1.1.20
(on Passive Node
of HA Member)

Another type of traffic, which flows outside the tunnels, is the VRRP (Virtual Router Redundancy Protocol)
advertisements that pass between the active and passive nodes in an HA pair. The VRRP advertisements act like
heartbeats that convey the status of each node in an HA pair. If the active node fails, the passive node becomes
active. The VIP (virtual IP) address for that pair then shifts from the previously active node to the currently active node.

274 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Introduction to Grids

NAT Groups

Note: Infoblox NAT and NAT groups do not support NAT IPv6 operation.

NAT groups are necessary if the Grid Master is behind a NAT appliance and there are members on both sides of that
NAT appliance. Any members on the same side as the master go into the same NAT group as the master and use their
interface addresses for Grid communications with each other. Grid members on the other side of that NAT appliance
do not go in the same NAT group as the master and use the master's NAT address for Grid communications. These
other members outside the NAT appliance can—but do not always need to be—in a different NAT group. To see when
NAT groups become necessary for Grid communications, compare Figure 5.4 below with Figure 5.5 and Figure 5.6 on
page 277.

Figure 5.4 NAT without NAT Groups

The Grid members use the addresses in bold for

Grid communications through their LAN1 ports.

Member 2
Member 1
Interface 192.168.2.20
(Grid Master)
NAT ––––
Interface 192.168.1.10
NAT 10.1.1.10
Network Member 3
(Master Candidate)
Interface 192.168.1.30
Grid NAT 10.3.3.30

In this case, there is no need for NAT groups. The Member 4

master (Member 1) always uses its NAT address
(10.1.1.10) when communicating with the Grid Interface 192.168.3.40
members. Also, if you ever promote Member 3 to NAT 10.4.4.40
master, it only has to use its NAT address (10.3.3.30) to
communicate with the other Grid members. Whichever Member 5
appliance is master (Member1 or Member 3), there is Interface 192.168.3.50
no other member behind the same NAT appliance with NAT 10.4.4.50
which it needs to use its interface address.

Note: A single or HA member using its MGMT port for Grid communications cannot be separated from the Grid Master
behind a NAT appliance. For more information, see Using the MGMT Port on page 461.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 275

Deploying a Grid

Figure 5.5 Grid Master in NAT Group

Members 2 – 5 use the addresses in black bold for Grid communications.

Members 1 and 6 use their interface addresses in underlined blue bold.
NAT Group 1
Member 1
(Grid Master) Member 2
Interface 192.168.1.10 Interface 192.168.2.20
NAT 10.1.1.10 NAT ––––

Member 6 Network
Member 3
Interface 192.168.1.60 (Master Candidate)
NAT 10.1.1.60
Interface 192.168.1.30
NAT 10.3.3.30
Grid
The master (Member 1) uses its interface address Member 4
(192.168.1.10) for Grid communications with Member 6 Interface 192.168.3.40
and its NAT address (10.1.1.10) when communicating with NAT 10.4.4.40
the other Grid members. Member 6 uses its interface
address (192.168.1.60) when communicating with the
Member 5
master. If Member 3 (a Master Candidate) ever became
the Grid Master, then both Members 1 and 6 would use Interface 192.168.3.50
their NAT addresses when communicating with it. NAT 10.4.4.50

The same use of NAT groups that applies to a Grid Master also applies to Master Candidates. If there are no other
members behind the same NAT appliance as a Master Candidate, then the Master Candidate does not need to be in
a NAT group. It always uses its NAT address for Grid communications. If another member is behind the same NAT
appliance as the Master Candidate, then both the candidate and that member need to be in the same NAT group so
that—if the candidate becomes master—they can use their interface addresses to communicate with each other (see
Figure 5.6 ).

276 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Introduction to Grids

Figure 5.6 Grid Master and Master Candidate in NAT Groups

Members 1 – 5 use the addresses in black bold for Grid communications.

Members 1 and 6 use their interface addresses in underlined blue bold.
If Member 4 became master, it would use its interface address in double
underlined green bold to communicate with Member 5, and its NAT
address to communicate with all other members.
NAT Group 1
Member 1
(Grid Master) Member 2
Interface 192.168.1.10 Interface 192.168.2.20
NAT 10.1.1.10 NAT ––––

Member 6 Network
Member 3
Interface 192.168.1.60
(Master Candidate)
NAT 10.1.1.60
Interface 192.168.1.30
NAT 10.3.3.30
Grid NAT Group 2
Member 4
Members 3 and 4 are Master Candidates. Because
Member 3 is alone behind a NAT appliance, it does not (Master Candidate)
need to be in a NAT group. It always uses its NAT Interface 192.168.3.40
address for Grid communications. However, Member 4 NAT 10.4.4.40
is behind the same NAT appliance as Member 5, so they
are put in the same NAT group. If Member 4 ever Member 5
became the Grid Master, it would use its interface Interface 192.168.3.50
address to communicate with Member 5 and its NAT NAT 10.4.4.50
address to communicate with all other members.

Although some members might not need to be in a NAT group, it is good practice to put all members in NAT groups in
anticipation of adding or rearranging Grid members within the network. For example, in Figure 5.4 – Figure 5.6,
Member 4 did not need to be in a NAT group until it became configured as a Master Candidate in Figure 5.6 . At that
point, because Member 5 is also behind the same NAT appliance, it became necessary to create NAT Group 2 and add
Members 4 and 5 to it. Similarly, if you add another member behind the NAT appliance in front of Member 3, then you
must create a new NAT group and add Member 3 and the new member to it. Always using NAT groups can simplify
such changes to the Grid and ensure that NAT appliances never interrupt Grid communications.
To create a NAT group:
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and select Grid Properties -> Edit.
3. In the Grid Properties editor, select the NAT Groups tab.
4. Click the Add icon, and enter a name in the Name field and optionally, a comment in the Comment field.
5. Save the configuration and click Restart if it appears at the top of the screen.
To add members to the NAT group:
1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Select a Grid member and click the Edit icon.
3. In the Grid Member Properties editor, select the Network -> Advanced tab and complete the following:
— Enable NAT Compatibility (IPv4 only): Select this check box. NAT group is not supported by IPv6 appliances.
— NAT Group: From the drop-down list, select the NAT group you previously created.
— NAT Addresses: For a single Grid Master or member, enter the address configured on the NAT appliance that
maps to the interface address of the LAN1 port. A single master or member that serves DNS uses this NAT
address for Grid communications and—if it serves DNS—DNS messages.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 277

Deploying a Grid

For an HA Grid Master or member, enter the address configured on the NAT appliance that maps to its VIP
address. An HA master uses its VIP NAT address when communicating with Grid members. An HA member
that serves DNS uses its VIP NAT address for its DNS messages. It uses its LAN1 port NAT address for Grid
communications.
— Node 1 (if HA)
• NAT IP Address: Enter the address configured on the NAT appliance that maps to the interface
address of the LAN1 port on Node 1. When Node 1 of an HA member is active, it uses its NAT
address for Grid communications.
— Node 2 (if HA)
• NAT IP Address: Enter the address configured on the NAT appliance that maps to the interface
address of the LAN1 port on Node 2. When Node 2 of an HA member is active, it uses its NAT
address for Grid communications.
4. Save the configuration and click Restart if it appears at the top of the screen.

Automatic Software Version Coordination

When you add an appliance or HA pair to a Grid as a new member, it is important that it is running the same version
of software as the other members in the Grid. Infoblox provides two methods for coordinating the software version:
• Manual Upgrade and Downgrade: Before adding an appliance or HA pair to a Grid, you can manually upgrade or
downgrade the software on the appliance or HA pair to the version used by the rest of the Grid.
• Automatic Upgrade and Downgrade: The Grid Master automatically compares the software version of each
appliance attempting to enter a Grid with that in use by the rest of Grid. If the versions do not match, the Grid
Master downloads the correct version to the new appliance or HA pair.

Note: The Grid Master checks the software version every time an appliance or HA pair joins the Grid. The
software version check occurs during the initial join operation and when a member goes offline and then
rejoins the Grid.

278 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Introduction to Grids

Figure 5.7 Automatic Upgrade of An Appliance Joining a Grid

Grid Master
Grid
(NIOS 5.0r1)

The Grid Master synchronizes

configuration and data changes with
Grid members through VPN tunnels.

Single Grid Member HA Grid Member

NIOS 5.0r1
Software
Download

When an appliance with a different After the appliance downloads the NIOS
version of NIOS attempts to join the software from the Grid Master, the appliance
Grid, the appliance downloads from reboots and reestablishes a tunnel with the
the Grid Master the software that the Grid Master. Then—assuming everything
rest of the Grid is using. else is in order—the appliance successfully
joins the Grid.
Appliance Joining the Grid
(NIOS 4.3r6-3 -> NIOS 5.0r1)

When a single appliance attempts to join the Grid for the first time, the following series of events takes place:
1. The appliance establishes an encrypted VPN tunnel with the Grid Master.
2. The master detects that the software version on the appliance is different from that in the rest of the Grid. For
example, the appliance is running NIOS 4.3r6-3 software but the rest of the Grid is running NIOS 5.0r1 software.
3. The appliance downloads the NIOS 5.0r1 software from the Grid Master.
4. After the upgrade is complete, the NIOS application automatically restarts.
5. After the appliance reboots, it again contacts the Grid Master and step 1 is repeated. Because the software
versions now match, the appliance can complete its attempt to join the Grid.
When an HA pair attempts to join the Grid for the first time, the following series of events takes place:
1. The active node of the HA pair establishes an encrypted VPN tunnel with the Grid Master.
2. The master detects that the software version on the node is different from that in the rest of the Grid. For example,
the active node is running NIOS 4.3r6-3 software but the rest of the Grid is running NIOS 5.0r1 software.
3. The appliance downloads the NIOS 5.0r1 software from the Grid Master.
4. After the upgrade is complete, the NIOS application on the active node automatically restarts. This causes an HA
failover.
5. The new active node (which was previously the passive node) attempts to join the Grid, repeating steps 1 – 4.
6. When the NIOS application on the currently active node restarts, there is another failover, and the currently
passive node becomes active again.
7. The active node again contacts the Grid Master and step 1 is repeated. Because the software versions now
match, it can complete its attempt to join the Grid.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 279

Deploying a Grid

Grid Bandwidth Considerations

Infoblox Grid technology relies upon database replication for its core functionality. When designing a Grid, it is
important to consider the amount of traffic generated by this replication and the overall number of Grid members.
Other communication between Grid members (such as log retrieval and monitoring functions) occurs as well. All of
this traffic is securely communicated between the Grid Master and Grid members through encrypted VPN tunnels.
One component of the traffic through the tunnels is database replication traffic. There are three types to consider:
• Complete database replication to a Master Candidate — Occurs when a Master Candidate joins or rejoins a Grid.
The Grid Master sends the complete database to a Master Candidate so that it has all the data it needs if it ever
becomes promoted from member to master.
• Partial database replication — Occurs when an appliance or HA pair joins or rejoins the Grid as a regular
member (which is not configured as a Master Candidate). The Grid Master sends it the section of the database
that mainly applies just to the member.
• Ongoing database updates — Occurs as changes are made to the Grid configuration and data. The Grid Master
sends all ongoing database updates to Master Candidates and individual member-specific updates to regular
members.
If there are no or very few DNS dynamic updates, and no or very few DHCP lease offers and renewals issued,
then this type of replication traffic is minimal.
If there are many DDNS (dynamic DNS) updates (many per second) and/or many DHCP lease offers and
renewals (many per second), then the replication traffic is the largest component of the VPN traffic among Grid
members.

Note: A Grid Master replicates data to single members and to the active node of HA members. The active node then
replicates the data to the passive node in the HA pair.

At a minimum, there must be 256 Kbps (kilobits per second) bandwidth between the Grid Master and each member,
with a maximum round-trip delay of 500 milliseconds. For ongoing database updates, the amount of data sent or
received is 15 Kb for every DDNS update, and 10 Kb for every DHCP lease -offer/renew. The baseline amount for
heartbeat and other maintenance traffic for each member is 2 Kbps. Measure the peak DNS and DHCP traffic you see
in your network to determine the bandwidth needed between the Grid Master and its members for this activity.
For example, you might decide to place your Grid members in the locations shown in Figure 5.6 on page 277.

280 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Introduction to Grids

Figure 5.8 Grid Deployment

Large Branch Network Diagram

West East
Site

East
Data Center Data Center Site
West East

East
West Site Site

Large Branch
West Site Central East Site

In this example, the Grid Master is optimally placed in the Data Center West. There are a total of seven members: the
HA Grid Master, three HA members, and three single members. If all the members are Master Candidates, the Grid
Master replicates all changes to the other six members. Assuming that the master receives 20 dynamic updates per
minute and 40 DHCP lease renews per minute, the calculation for Grid bandwidth is:

20 DDNS updates/minute/60 secs = 0.333 DDNS updates/sec * 15 Kb = 5 Kbps *6 members = 30 Kbps

40 DHCP leases/minute/60 secs = 0.666 DHCP leases/sec * 10 Kb = 6.7 Kbps * 6 members = 40.2 Kbps
2 Kbps of Grid maintenance traffic * 6 members = 12 Kbps
Total 82.2 Kbps

Another component is the upgrade process. See Upgrading NIOS Software on page 527 for more information.
Bandwidth requirements, database size, and update rate determine the maximum size of the Grid you can deploy.
Based on the various factors discussed above, you can determine the amount of bandwidth your Grid needs. If your
calculations exceed the available bandwidth, then you might need to modify your deployment strategy, perhaps by
splitting one large Grid into two or more smaller ones.

Note: This calculation does not take into account existing traffic other than DNS and DHCP services, so factor and
adjust accordingly.

For international networks, because of bandwidth and delay requirements, a geographical grouping of Grid members
might be the best approach. For example, if you have a global presence, it may make the most sense to have a North
American Grid, a South American Grid, a European Grid, and an Asia/Pacific Grid.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 281

Deploying a Grid

About HA Pairs
You can configure two appliances as an HA (high availability) pair to provide hardware redundancy for core network
services and Infoblox External DNS Security. For information about Infoblox External DNS Security, see Infoblox
External DNS Security on page 1561. An HA pair can be a Grid Master, a Grid Master candidate, a Grid member, or an
independent appliance. The two nodes that form an HA pair—identified as Node 1 and Node 2—are in an
active/passive configuration. The active node receives, processes, and responds to all service requests. The passive
node constantly keeps its database synchronized with that of the active node, so it can take over services if a failover
occurs. A failover is the reversal of the active/passive roles of each node; that is, when a failover occurs, the
previously active node becomes passive and the previously passive node becomes active. You can configure an HA
pair in either IPv4, IPv6, or in dual mode. An IPv4 HA pair uses IPv4 as the communication protocol between the two
nodes and an IPv6 HA pair uses IPv6 as the communication protocol between the two nodes. But in a dual mode HA
pair, you can select either IPv4 or IPv6 as the communication protocol between the two nodes. Note that when you
add a dual mode HA member to a Grid, the communication protocol between the two nodes of an HA pair must the
same as the Grid communication protocol.

Note: HA Grid Master and HA Grid Master candidate configurations are not supported when Threat Protection
licenses are installed on the appliance.

When you configure an HA pair using the IB-4030 (Rev-1 or Rev-2) appliance for DNS cache acceleration, the passive
node does not operate with a pre-loaded cache or hot cache during a failover; it builds up the DNS cache over time.
For more information about HA and other limitations for the IB-4030 appliances, refer to the Infoblox DNS Cache
Acceleration Application Guide.
For Infoblox External DNS Security, only the active node in an HA pair handles DNS traffic. The passive node is in a
standby mode ready to take over if a failover occurs.
The appliance uses the following components in the HA functionality:
• bloxSYNC: An Infoblox proprietary mechanism for secure, real-time synchronization of the database that
maintains the data, system configuration, and protocol service configuration between the two nodes. With
bloxSYNC, the nodes continuously synchronize changes of their configurations and states. When a failover
occurs, the passive node can quickly take over services. For information, see About HA Failover on page 284.
• VRRP (Virtual Router Redundancy Protocol): An industry-standard, MAC-level HA failover mechanism. VRRP
utilizes the concept of an active and passive node that share a single VIP (virtual IP) address. When the active
node that owns the VIP becomes unavailable, the passive node takes over the VIP and provides network core
services. For information about VRRP, refer to RFC3768, Virtual Router Redundancy Protocol (VRRP) and VRRP
Advertisements on page 285.
Using bloxSYNC and VRRP combined, if the active node fails or is taken offline for maintenance purposes, the passive
node assumes the VIP and continues to respond to requests and services with minimal interruption. You can deploy
an HA pair as a Grid Master, a Grid member, or an independent HA. To deploy an independent HA pair, see Deploying
an Independent HA Pair on page 346. To deploy an HA Grid Master, see Creating a Grid Master on page 287.

282 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About HA Pairs

Planning for an HA Pair

To achieve high availability, the HA and LAN1 (or VLAN) ports on both the active and passive nodes are connected to
switches on the same network or VLAN. Both nodes in an HA pair share a single VIP address and a virtual MAC address
so they can appear as a single entity on the network. You can also assign IPv6 addresses for each of the active and
passive nodes, in addition to the IPv6 VIP address.

Tip: Infoblox uses VRRP advertisements for the active and passive HA design. Therefore, all HA pairs must be located
in the same location connected to the highly available switching infrastructure. Any other deployment is not
supported without a written agreement with Infoblox. Contact Infoblox Technical Support for more information
about other deployment support.

Note: You can enable ARP on the passive node of an HA pair and monitor its status externally. To enable ARP on the
passive node of an HA pair, see Enabling ARP on the Passive Node of an HA Pair on page 285.

As illustrated in Figure 5.9 on page 283, the VIP and virtual MAC addresses link to the HA port on each node. Select
five IP addresses on the same network before you configure an HA pair, as follows:
• VIP: For core network services and for management purposes when the MGMT port is disabled. Both nodes
share the same VIP.
• Node 1 HA (active): Source IP for the VIP and VRRP advertisements
• Node 1 LAN1 (active): For management through SSHv2 and listens for VRRP advertisements from the HA port
• Node 2 HA (passive): Listens for VRRP advertisements
• Node 2 LAN1 (passive): Source IP for SSL VPN to the VIP of the active node and receives bloxSYNC from the VIP

Figure 5.9 HA Pair

Node 1
Switch 1 Active

HA: 10.1.1.11/24
LAN1: 10.1.1.12/24

Layer 2 Trunk HA VIP: 10.1.1.10

HA: 10.1.1.13/24
LAN1: 10.1.1.14/24
Switch 2 Node 2
Passive

NIOS 7.3 NIOS Administrator Guide (Rev. A) 283

Deploying a Grid

About HA Failover
The appliance supports HA through bloxHA™, which provides a robust failover mechanism. As described in Planning
for an HA Pair on page 283, both nodes in an HA pair share a single VIP address and a virtual MAC address. The node
that is currently active is the one whose HA port owns the VIP address and virtual MAC address. When a failover
occurs, these addresses shift from the HA port of the previous active node to the HA port of the new active node, as
illustrated in Figure 5.10.

Figure 5.10 VIP Address and Virtual MAC Address and HA Failover
.

Infoblox HA Pair
bloxSYNC
Node 1 Node 2
Active Passive
Encrypted VPN Tunnel

HA Port HA Port

VIP
The clients always make service requests and The HA ports on each node of an HA pair
to—and receive replies from—the VIP Virtual MAC share the VIP address and virtual MAC
and virtual MAC address. Address address. Because Node 1 is currently
active, it owns these addresses.

Network Clients

After an HA Failover …

Node 1 Node 2
Passive Active

HA Port HA Port

VIP
The clients still make service requests and After an HA failover occurs, Node 2
to—and receive replies from—the Virtual MAC becomes the active node. Because Node 2
same VIP and virtual MAC address. Address is now active, it now owns the VIP address
and virtual MAC address.

Network Clients

284 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About HA Pairs

Enabling ARP on the Passive Node of an HA Pair

You can enable ARP (Address Resolution Protocol) on the passive node of an HA pair and monitor its status externally.
For example, when the active node of an HA pair fails over to the passive node, you can ping the passive node from
an external location and monitor its status. By default, ARP is disabled on the passive node of an HA pair. ARP settings
on an HA member are preserved during a system restart or reboot, HA switch over, and upgrade. In addition, you do
not need to restart the appliance when you modify ARP settings. When the active node becomes passive during an
HA failover, ARP on an HA member inherits the settings configured in the database.
You can view detailed status for both nodes of an HA pair through the Detailed Status panel. To view the Detailed
Status panel, from the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box -> Detailed
Status icon in the horizontal navigation bar. In the Detailed Status panel, you can view ARP connectivity status for the
passive node of an HA pair (Green = The passive HA node is connected to the local router; Yellow = The passive HA
node fails to connect to the local router; Gray = ARP is disabled on the passive node of an HA pair). The passive HA
node uses arping to test the ARP connectivity with the local router. If the local router is not configured, you may see
false warnings even if the ARP connectivity is fine. In case of an ARP connectivity failure, the appliance sends an
SNMP trap and an email notification, if configured.
Note that the ARP setting is not preserved on a passive HA node when you reset the appliance using the CLI command
reset all or reset the database using the CLI command reset database.
To enable ARP on an HA passive node:
1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Select an HA member and click the Edit icon.
3. In the Grid Member Properties editor, select the Network tab -> Advanced tab and complete the following:
— Enable ARP on HA Passive Node?: Select one of the following:
— Disable (default): Select this to disable ARP on an HA passive node. This is selected by default.
— Enable (not recommended): Select this to enable ARP on an HA passive node.

WARNING: Enabling ARP on the passive node of an HA interface might affect VRRP on the local network
and could cause the firewall to send false alerts.

4. Save the configuration and click Restart if it appears at the top of the screen.

VRRP Advertisements
VRRP advertisements are periodic announcements of the availability of the HA node linked to the VIP. The two nodes
in an HA pair include a VRID (virtual router ID) in all VRRP advertisements and use it to recognize VRRP advertisements
intended for themselves. Only another appliance on the same subnet configured to use the same VRID responds to
the announcements. The active node in an HA pair sends advertisements as multicast datagrams every second. It
sends them from its HA port using the source IP address of the HA port (not from the VIP address) and the source MAC
address 00:00:5e:00:01:vrrp_id . The last two hexadecimal numbers in the source MAC address indicate the VRID
number for this HA pair. For example, if the VRID number is 143, then the source MAC address is 00:00:5e:00:01:8f
(8f in hexadecimal notation = 143 in decimal notation).
The destination MAC and IP addresses for all VRRP advertisements are 01:00:5e:00:00:12 and 224.0.0.18. Because
a VRRP advertisement is a multicast datagram that can only be sent within the immediate logical broadcast domain,
the nodes in an HA pair must be in the same subnet together.
As illustrated in Figure 5.11, when you configure an HA pair, only the appliance configured to listen for VRRP
advertisements with the same VRID number processes the datagrams, while all other appliances ignore them. The
passive node in an Infoblox HA pair listens for these on its HA port and the active node listens on its LAN1 or LAN1
(VLAN) port. If the passive node does not receive three consecutive advertisements or if it receives an advertisement
with the priority set to 0 (which occurs when you manually perform a forced failover or request the active node to
restart, reboot, or shut down), it changes to the active state and assumes ownership of the VIP address and virtual
MAC address.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 285

Deploying a Grid

If both nodes go offline, the one that comes online first becomes the active node. If they come online simultaneously,
or if they enter a dual-active state—that is, a condition arises in which both appliances assume an active role and
send VRRP advertisements, possibly because of network issues—then the appliance with the numerically higher
VRRP priority becomes the active node. The priority is based on system status and events.
If both nodes have the same priority, then the appliance whose HA port has a numerically higher IP address becomes
the active node. For example, if the IP address of the HA port on Node 1 is 10.1.1.80 and the IP address of the HA port
on Node 2 is 10.1.1.20, then Node 1 becomes the active node.
For more information about VRRP, see RFC 3768, Virtual Router Redundancy Protocol (VRRP).

Figure 5.11 VRRP Advertisements with a Unique VRID

After you finish configuring Node 1 of the HA pair to use

VRID 143—a number that is unique for this subnet—it
starts listening for VRRP advertisements with that VRID. Any device on that subnet that is not
When it does not receive any for three seconds, it becomes configured to listen for VRRP advertisements
the active node in the HA pair and begins multicasting with VRID 143 drops the packet.
VRRP advertisements with a VRID 143 from its HA port.

VRRP
Advertisements
After you finish configuring Node 2
to join the HA pair, it initiates a
connection with Node 1. The two
appliances establish a VPN tunnel
between themselves, using the HA
Node 1
connection name and shared
(Active)
secret to authenticate each other.
Switch Node 2 downloads the database
from Node 1 and learns its VRID.
Node 2 then begins listening for
MATCH! VRRP advertisements on its HA
port. When it receives an
advertisement from Node 1, Node
Node 2 2 recognizes it and becomes the
(Passive) passive node.
Subnet

Note: For a dual mode (IPv4 and IPv6) HA Master or HA member, you can set either IPv4 or IPv6 for VRRP
advertisements.

286 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating a Grid Master

Creating a Grid Master

To create a Grid, you first create a Grid Master and then add members. Although the Grid Master can be a single
appliance (a “single master”), a more resilient design is to use an HA pair (an “HA master”) to provide hardware
redundancy. For information about HA pairs, see About HA Pairs on page 282. The basic procedure for forming two
appliances into an HA master is shown in Figure 5.12. You can create a Grid Master in either IPv4, IPv6, or dual mode
(IPv4 and IPv6). An IPv4 Grid Master uses IPv4 as the Grid communication protocol, so it supports IPv4 and dual
mode Grid members. An IPv6 Grid Master uses IPv6 as the Grid communication protocol, so it supports IPv6 and dual
mode Grid members. A dual mode Grid Master supports IPv4, IPv6, and dual mode Grid members. You can set either
IPv4 or IPv6 as the communication protocol. All Infoblox hardware platforms, except for appliances with a 50 GB disk,
support configuration as a Grid Master or Grid Master candidate. For information about which vNIOS appliance
supports configuration as a Grid Master, see Supported vNIOS Appliance Models and Specifications on page 1775.

Figure 5.12 Initially Configuring a Pair of Appliances as a Grid Master

1 Connect your management Management

system to a switch and set its System To Network
IP address to 192.168.1.3.
Node 1 Node 2

Switch
2 Connect Node 1 to the switch, log in to its 4 Connect Node 2 to the switch, log in to its
default IP address (192.168.1.2), check default IP address (192.168.1.2), check
that a Grid license is installed, and that a Grid license is installed, and
configure the following: configure the following:
• VIP address, netmask, gateway • VIP address (for Node 1)
• Hostname • LAN1 address, netmask, gateway
• HA and LAN1 addresses of Node 1 • Hostname
• HA and LAN1 addresses of Node 2 • Grid name
• VRID (virtual router ID) • Shared secret
• NTP settings
• Grid name
Note: Because you do not set the VRID for
• Shared secret Node 2, it cannot listen for VRRP
advertisements yet. It learns its VRID
after it joins the Grid and downloads the
database from Node 1. Then, when
Node 2 receives an advertisement
3 After you configure Node 1, it listens for three containing its VRID from Node 1, it
seconds for VRRP advertisements containing assumes the passive role in the HA pair.
its VRID number. When it does not receive
any, it assumes the active role in the HA pair 5 After you configure Node 2, it contacts
and starts sending advertisements. the VIP address on Node 1 and initiates
a mutual authentication of the nodes
using the shared secret. The nodes then
Note: For more information about VRRP advertisements, construct an encrypted VPN tunnel to
see VRRP Advertisements on page 285. secure Grid communications.

After the two nodes form an HA pair, Node 2 initiates a key exchange and creates an encrypted VPN tunnel with
Node 1. The two nodes communicate between the VIP interface linked to the HA port on Node 1 and the LAN1 port
on Node 2. The initialization of VPN communications between the two nodes is shown in Figure 5.13 on page 288.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 287

Deploying a Grid

Figure 5.13 Establishing a VPN Tunnel for Grid Communications

Node 1 Node 2

VIP Switch LAN1 Source and Destination

Port Numbers:
Key
Exchange 2114 (nonconfigurable)
The two nodes authenticate each other and
perform a VPN key exchange.

VPN
Tunnel 1194 – default VPN port
number (configurable)
The passive node establishes an encrypted
VPN tunnel with the active node.

Tunnel Established

After the nodes establish a VPN tunnel between themselves, Node 1 sends Node 2 its entire database (its
configuration settings and service data). Because the configuration contains the VRID (virtual router ID) for the HA
pair, Node 2 starts listening for VRRP advertisements containing that VRID number. Because Node 1 is already
sending such advertisements, Node 2 receives one and assumes the passive role in the HA pair.
After the initial transmission of its database, Node 1 continues to send Node 2 real-time database updates through
the VPN tunnel.
Node 1 maintains the synchronization of the database throughout the Grid—which, at this point, has no other
members—sends VRRP advertisements indicating its physical and network health, and—if configured to do so—
provides network services. Node 2 maintains a state of readiness to assume mastership in the event of a failover. You
can see the flow of HA- and Grid-related traffic from ports on the active node to ports on the passive node in
Figure 5.14. This illustration also shows the ports that you can use for management traffic and network service.

Figure 5.14 Traffic and Ports that an HA Grid Master Uses

To Network
HA Master
Active Passive
VIP is a logical Note: If you enable the
interface linking MGMT port, you can only
to the HA port on make an HTTPS connection
the active node to the IP address of the active
of the HA pair. node. If you try to connect to
Node 1 Switch Node 2 the IP address of the passive
VIP node, the appliance redirects
VPN Tunnel your browser to the IP
address of the active node.
HA HA SSHv2, however, behaves
differently from HTTPS. If
VRRP you enable the MGMT port
Advertisements and define its network
LAN1 LAN1 settings for both nodes in the
HA pair, you can make an
SSHv2 / CLI SSHv2 / CLI SSHv2 connection to the IP
addresses of the LAN1 and
Management MGMT ports on both the
HTTPS / GUI System active and passive nodes.

288 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating a Grid Master

From the management system, you can manage the active node of the HA master by making an HTTPS connection to
the VIP interface and using the GUI, and by making an SSHv2 connection to the LAN1 port (and MGMT port, if enabled)
and using the CLI. If you enable the MGMT port on an HA pair, you can make an HTTPS connection through the MGMT
port on the active node, and you can make an SSHv2 connection through the LAN1 or MGMT port on the active and
passive nodes.

Note: For information about enabling and using the MGMT port, the Infoblox GUI, and SSH, see Using the MGMT Port
on page 461, Logging in to the GUI on page 58, and Enabling Remote Console Access on page 439.

Port Numbers for Grid Communication

If connectivity between Grid members must pass through a firewall, the firewall policies must allow the initial key
exchange and subsequent VPN traffic to pass. The key exchange uses UDP with a source and destination port of 2114.
VPN traffic uses UDP with a default source and destination port of 1194. The VPN port number is configurable.
To configure the VPN port number:
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and click Grid Properties -> Edit.
3. In the General tab of the Grid Properties editor, type a new port number in the VPN Port field.
4. Save the configuration.
5. When Grid Manager displays a warning indicating that a product restart is required, click Yes to continue.
The product automatically restarts.
A member and master first perform a handshake to authenticate each other and exchange encryption keys. Then they
build an encrypted VPN tunnel between themselves. The member typically initiates both of these connections. The
master only initiates a key exchange if you manually promote a member to the role of master (see Promoting a Master
Candidate on page 328). Figure 5.13 on page 288 shows the typical connection exchange and default port usage not
only between the two nodes forming an HA pair but also between a member and master when the member joins a
Grid.
The member and master key exchange occurs when an appliance joins a Grid, during master promotion, and when a
member reconnects to a Grid after becoming disconnected. At all other times, Grid-related communications occur
through encrypted VPN tunnels.

Grid Setup Wizard

The Grid Setup Wizard simplifies configuring a Grid. You can use it to configure an HA or single Grid Master and to join
appliances to a Grid. The Grid Setup Wizard appears when you first log in to the appliance. After that, you can access
it at anytime as follows:
1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Expand the Toolbar and click Grid Properties -> Setup (Grid Setup Wizard).

Creating an HA Grid Master

To create a Grid, you first create a Grid Master and then add members. Although you can define a single appliance as
a Grid Master, using an HA pair provides hardware redundancy for this vital component of a Grid. You can create an
HA Master in either IPv4, IPv6, or in dual mode. An IPv4 HA Master uses IPv4 as the communication protocol between
the two nodes and for Grid communication. An IPv6 HA pair uses IPv6 as the communication protocol between the
two nodes and for Grid communication. But in a dual mode HA pair, you can select either IPv4 or IPv6 as the
communication protocol between the two nodes and for Grid communication. The following procedure explains how
to put two NIOS appliances on the network and use the Grid Setup Wizard to configure them as Nodes 1 and 2 to form
an HA Grid Master. For information about which vNIOS appliance supports configuration as an HA Grid Master, see
Supported vNIOS Appliance Models and Specifications on page 1775.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 289

Deploying a Grid

Configuring the Connecting Switch

To ensure that VRRP (Virtual Router Redundancy Protocol) works properly, configure the following settings at the port
level for all the connecting switch ports (HA, LAN1, and LAN2):
• Spanning Tree Protocol: Disable. For vendor specific information, search for “HA” in the Infoblox Knowledge
Base system at https://support.infoblox.com.
• Trunking: Disable
• EtherChannel: Disable
• IGMP Snooping: Disable
• DHCP Snooping: Disable or Enable Trust Interface

Note: You must disable DHCP Snooping to successfully run DHCP services on the Grid. For more information about
DHCP services, see About Infoblox DHCP Services on page 1050.

• Port Channeling: Disable

• Speed and Duplex settings: Match these settings on both the Infoblox appliance and switch
• Disable other dynamic and proprietary protocols that might interrupt the forwarding of packets

Note: By default, a NIOS appliance automatically negotiates the optimal connection speed and transmission type
(full or half duplex) on the physical links between its LAN1 or LAN1 (VLAN), HA, and MGMT ports and the
Ethernet ports on the connecting switch. If the two appliances fail to auto-negotiate the optimal settings, see
Modifying Ethernet Port Settings on page 456 for steps you can take to resolve the problem.

Placing Both Appliances on the Network

1. Connect the power cable from each NIOS appliance to a power source and turn on the power. If possible, connect
the appliances to separate power circuits. If one power circuit fails, the other might still be operative.
2. Connect Ethernet cables from the LAN1 port and the HA port on each appliance to a switch on the network.

Note: The Ethernet ports on the TE-810, TE-820, TE-1410, TE-1420, TE-2210, TE-2220, and IB-4010 appliances
are autosensing, so you can use either a straight-through or cross-over Ethernet cable for these
connections.

3. Use the LCD on one appliance or make a console connection to it, and configure the network settings of its LAN1
port so that it is on the local subnet and you can reach it on the network. LCD supports only IPv4 addressing and
not IPv6 addressing. You can configure IPv6 address for the appliance through CLI or GUI. IPv4 addressing is
supported on the LCD; ensure that you have the correct network address values before configuration of the
appliance.

Note: For details about using the LCD and console, refer to the installation guide that shipped with your product.

4. Similarly, configure the LAN1 port on the other appliance so that it is in the same subnet as the first appliance.
5. Connect your management system to the network so that it can reach the IP addresses of the LAN1 ports on both
appliances.

290 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating a Grid Master

HA Master – Node 1
1. On your management system, open a browser window, and connect to https://ip_addr, where ip_addr is the
address of the LAN1 port on Node 1. IPv4 and IPv6 values are valid, based on the LAN1 port configuration.
2. Log in using the default user name and password admin and infoblox. For detailed information about logging in
to the GUI, see Logging in to the GUI on page 58.
3. Review the End-User License Agreement. If you want to participate in the Infoblox Customer Experience
Improvement Program, complete the following:
— Participate in the Infoblox Customer Experience Improvement Program: Select the check box to send
product usage data to Infoblox on a periodic basis. Infoblox uses this data to improve product functionality.
For more information about the program, see Participating in the Customer Experience Improvement
Program on page 1349.
— Support ID (optional): Enter the Infoblox Support ID that was assigned to your account. It must be a number
with four to six digits. The value you enter here is also displayed in the Customer Improvement tab in the
Grid Properties editor. Infoblox includes this ID in the data report.
— Infoblox Privacy Policy: Click here to view the Infoblox privacy policy. The appliance displays the policy in a
new browser tab.
Click I Accept. The Grid Setup wizard appears.
4. On the first screen, select Configure a Grid Master and click Next.
5. On the next screen, specify the Grid properties and click Next:
— Grid Name: Enter a text string that the two appliances use to authenticate each other when establishing a
VPN tunnel between them. The default Grid name is Infoblox.
— Shared Secret: Enter a text string that both appliances use as a shared secret to authenticate each other
when establishing a VPN tunnel between them. The default shared secret is test.
— Confirm Shared Secret: Enter the shared secret again.
— Hostname: Enter a valid domain name for the appliance.
— Type of Network Connectivity: Select the type of network connectivity from the drop-down list:
— IPv4 and IPv6: Select this to configure a dual mode HA Master.
— IPv4: Select this to configure an IPv4 HA Master.
— IPv6: Select this to configure an IPv6 HA Master.
— Is the Grid Master an HA pair?: Select Yes.
— Send HA and Grid Communication over: This field is displayed only when you are configuring a dual
mode HA pair. Select either IPv4 or IPv6 as the communication protocol for VRRP advertisements.

Note: Infoblox recommends that you backup the configuration after you convert a Grid to a different mode.
Restoring the old backup by performing a forced restore, may prevent the Grid members from rejoining the
Grid Master after the restore.

6. On the next screen, specify the network properties and click Next:
— Virtual Router ID: Enter the VRID (virtual router ID). This must be a unique VRID number—from 1 to 255—for
this subnet.
Ports and Addresses: This table lists the network interfaces based on the type of network connectivity of
the HA Master.
For IPv4 HA Master, specify the network information for VIP (IPv4), Node1 HA (IPv4), Node2 HA (IPv4),
Node1 LAN1 (IPv4), and Node2 LAN1 (IPv4) interfaces.
For IPv6 HA Master, specify the network information for VIP (IPv6), Node1 LAN1 (IPv6), and Node2 LAN1
(IPv6) interfaces.
For a dual mode HA Master, if you select IPv4 in the Send HA and Grid Communication over field, specify the
network information for the following interfaces: VIP (IPv4), Node1 HA (IPv4), Node1 LAN1 (IPv4), Node2 HA
(IPv4), Node2 LAN1 (IPv4), VIP (IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6) interfaces.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 291

Deploying a Grid

For a dual mode HA Master, if you select IPv6 in the Send HA and Grid Communication over field, specify the
network information for the following interfaces: VIP (IPv4), Node1 LAN1 (IPv4), Node2 LAN1 (IPv4), VIP
(IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6) interfaces.
Enter correct information for the following by clicking the field:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Type the IPv4 or IPv6 address depending on the type of interface.
— Subnet Mask (IPv4) or Prefix Length (IPv6): Specify an appropriate subnet mask for IPv4 address or
prefix length for IPv6 address. The prefix length ranges from 2 to 127.
— Gateway: Type the IPv4 or IPv6 address of the default gateway depending on the type of interface. For
IPv6 interface, you can also type Automatic to enable the appliance to acquire the IPv6 address of the
default gateway and the link MTU from router advertisements.

Note: You can now define a link-local address as the default IPv6 gateway and isolate the LAN segment so the
local router can provide global addressing and access to the network and Internet. This is supported for
both LAN1 and LAN2 interfaces as well as LAN1 and LAN2 in the failover mode.

— VLAN Tag: For a VLAN, enter the VLAN tag or ID. You can enter a number from 1 to 4094. Ensure that you
configure the corresponding switch accordingly.
— Port Settings: From the drop-down list, choose the connection speed that you want the port to use. You
can also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or Half
for data transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to
negotiate the optimum port connection type (full or half duplex) and speed with the connecting switch
automatically. This is the default setting. You cannot configure port settings for vNIOS appliances.
7. Optionally, enter a new password and click Next. The password must be a single string (no spaces) that is at least
four characters long.
8. Select the time zone of the Grid Master and indicate whether the Grid Master synchronizes its time with an NTP
(Network Time Protocol) server.
— If you choose to enable NTP, click the Add icon and enter the IP address of an NTP server. Entries may be an
IPv4 or IPv6 address. You can enter IP addresses for multiple NTP servers.
— If you choose to disable NTP, set the date and time for the appliance.
— Click Next.
9. If you want to participate in the Infoblox Customer Experience Improvement Program, complete the following and
then click Next:
— Participate in the Infoblox Customer Experience Improvement Program: Select the check box to send
product usage data to Infoblox on a periodic basis. Infoblox uses this data to improve product functionality.
For more information about the program, see Participating in the Customer Experience Improvement
Program on page 1349.
— Support ID (optional): Enter the Infoblox Support ID that was assigned to your account. It must be a number
with four to six digits. The value you enter here is also displayed in the Customer Improvement tab in the
Grid Properties editor. Infoblox includes this ID in the data report.
— Email: Enter an email address to which Infoblox sends a copy of the usage report. The email address you
enter here is also displayed in the Customer Improvement tab in the Grid Properties editor. This is optional.
— Infoblox Privacy Policy: Click here to view the Infoblox privacy policy. The appliance displays the policy in a
new browser tab.
10. The last screen displays the settings you specified in the previous panels of the wizard. Verify that the
information is correct and click Finish. The application restarts after you click Finish.

292 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating a Grid Master

Note: The Grid Setup wizard provides options such as not changing the default password and manually entering
the time and date. However, changing the password and using an NTP server improve security and
accuracy (respectively), and so these choices are presented here.
Record and retain this information in a safe place. If you forget the shared secret, you need to contact
Infoblox Technical Support for help. When you add an appliance to the Grid, you must configure it with the
same Grid name, shared secret, and VPN port number that you configure on the Grid Master.

11. Close the management window.

The configuration for Node 1 is complete.

HA Master – Node 2
1. On your management system, open a new browser window, and connect to https://ip_addr, where ip_addr is the
address of the LAN1 port on Node 2. IPv4 or IPv6 values are valid.
When you enter an IPv6 address, enclose the address in square brackets (as in https://[ip_addr] or
https://[2001:db8::256:ABCD:EF12:34:1].
2. Log in using the default user name and password admin and infoblox.
3. Review the End-User License Agreement. If you want to participate in the Infoblox Customer Experience
Improvement Program, complete the following:
— Participate in the Infoblox Customer Experience Improvement Program: Select the check box to send
product usage data to Infoblox on a periodic basis. Infoblox uses this data to improve product functionality.
For more information about the program, see Participating in the Customer Experience Improvement
Program on page 1349.
— Support ID (optional): Enter the Infoblox Support ID that was assigned to your account. It must be a number
with four to six digits. The value you enter here is also displayed in the Customer Improvement tab in the
Grid Properties editor. Infoblox includes this ID in the data report.
— Infoblox Privacy Policy: Click here to view the Infoblox privacy policy. The appliance displays the policy in a
new browser tab.
Click I Accept. The Grid Setup wizard appears.
4. On the first screen, select Join Existing Grid and click Next.
5. On the next screen, specify the Grid properties and click Next
— Grid Name: Enter a text string that the two appliances use to authenticate each other when establishing a
VPN tunnel between them. This must match the Grid name you entered for node 1.
— Grid Master’s IP Address: Enter the same VIP you entered for node 1.
— Shared Secret: Enter a text string that both appliances use as a shared secret to authenticate each other
when establishing a VPN tunnel between them. This must match your entry in node 1.
6. On the next screen verify the IP address settings of the member and click Next.
The last screen displays the settings you specified in the previous panels of the wizard.
7. Verify that the information is correct and click Finish.
The setup of the HA master is complete. From now on, when you make an HTTPS connection to the HA pair, use
the VIP address.
The communication protocol for all the services in a dual mode (IPv4 and IPv6) HA Master is the same protocol as the
one used for VRRP advertisements. For example, if you select IPv4 in the Send HA and Grid Communication over field
in step 2 of the Grid Setup wizard, then IPv4 is set as the communication protocol for all the services. However, you
can override the communication protocol for all the services in a dual mode HA Master. For information, see Changing
the Communication Protocol for a Dual Mode Appliance on page 302.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 293

Deploying a Grid

Creating a Single Grid Master

Although using an HA master is ideal because of the hardware redundancy it provides, you can also use a single
appliance as the Grid Master. You can create a single Grid Master in either IPv4, IPv6, or dual mode (IPv4 and IPv6).
Infoblox recommends frequent backups if the Grid Master is a single appliance, and there is no Master Candidate.
For information about which vNIOS appliance supports configuration as a single Grid Master, see Supported vNIOS
Appliance Models and Specifications on page 1775.
Setting up an appliance as a single Grid Master is very easy. If the appliance has the DNSone package with the Grid
upgrade, it is already a Grid Master. You simply need to define the network settings for its LAN1 port. The various
procedures for defining the network settings for the LAN1 port of a single independent appliance apply here as well;
that is, you can use any of the following procedures to define the network settings for the LAN1 port of the appliance
that you want to make a single Grid Master:
• LCD – See Method 1 – Using the LCD on page 335. (LCD configuration does not support IPv6 address entry.)
• Console port – Method 2 – Using the CLI on page 336.
You can also use the NIOS Grid Setup Wizard to create a single Grid Master. In addition to providing a simple method
accompanied by helpful information, the setup wizard allows you to change the admin password and configure time
settings for the appliance.

Using the Setup Wizard

To create a single Grid Master using the Grid Setup wizard:
1. Connect the power cable from the NIOS appliance to a power source and turn on the power.
2. Connect an Ethernet cable from the LAN1 port on the appliance to a switch on the network.

Note: The Ethernet ports on the TE-810, TE-820, TE-1410, TE-1420, TE-2210, TE-2220, and IB-4010 appliances
are autosensing, so you can use either a straight-through or cross-over Ethernet cable for these
connections.

3. If you have not changed the default IP address (192.168.1.2/24) of the LAN1 port through the LCD or CLI—and
the subnet to which you connect the appliance does not happen to be 192.168.1.0/24—put your management
system in the 192.168.1.0/24 subnet and connect an Ethernet cable between your management system and the
NIOS appliance.
4. Open a web browser and make an HTTPS connection to the IP address of the LAN1 port. To reach the default IP
address, enter: https://192.168.1.2 .
Several certificate warnings appear during the login process. This is normal because the preloaded certificate is
self-signed (and, therefore, is not in the trusted certificate stores in your browser) and has the hostname
www.infoblox.com, which does not match the destination IP address you entered in step 3. To stop the warning
messages from occurring each time you log in to the GUI, you can generate a new self-signed certificate or
import a third-party certificate with a common name that matches the FQDN (fully qualified domain name) of the
appliance. For information about certificates, see Managing Certificates on page 63.
5. Log in using the default user name admin and password infoblox.
6. Review the End-User License Agreement. If you want to participate in the Infoblox Customer Experience
Improvement Program, complete the following:
— Participate in the Infoblox Customer Experience Improvement Program: Select the check box to send
product usage data to Infoblox on a periodic basis. Infoblox uses this data to improve product functionality.
For more information about the program, see Participating in the Customer Experience Improvement
Program on page 1349.
— Support ID (optional): Enter the Infoblox Support ID that was assigned to your account. It must be a number
with four to six digits. The value you enter here is also displayed in the Customer Improvement tab in the
Grid Properties editor. Infoblox includes this ID in the data report.

294 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating a Grid Master

— Infoblox Privacy Policy: Click here to view the Infoblox privacy policy. The appliance displays the policy in a
new browser tab.
Click I Accept. The Grid Setup wizard appears.
7. On the first screen, select Configure a Grid Master and click Next.
8. On the next screen, specify the Grid properties and click Next:
— Grid Name: Enter a text string that the Grid Master and appliances joining the Grid use to authenticate each
other when establishing a VPN tunnel between them. The default Grid name is Infoblox.
— Shared Secret: Enter a text string that the Grid Master and appliances joining the Grid use as a shared
secret to authenticate each other when establishing a VPN tunnel between them. The default shared secret
is test.
— Confirm Shared Secret: Enter the shared secret again.
— Hostname: Enter a valid domain name for the appliance.
— Type of Network Connectivity: Select the type of network connectivity for the Grid Master from the
drop-down list:
— IPv4 and IPv6: Select this to configure a dual mode Grid Master.
— IPv4: Select this to configure an IPv4-only Grid Master.
— IPv6: Select this to configure an IPv6-only Grid Master.

Note: Infoblox recommends that you backup the configuration after you convert a Grid to a different mode.
Restoring the old backup by performing a forced restore, may prevent the Grid members from rejoining the
Grid Master after the restore.

— Is the Grid Master an HA pair?: Select No.

9. On the next screen, configure the network settings and click Next:
— Ports and Addresses: This table lists the network interfaces based on the type of network connectivity of
the Grid Master. For IPv4 Grid Master, specify the network information for LAN1 (IPv4) port and for IPv6 Grid
Master, specify the network information for LAN1 (IPv6) port. For a dual mode Grid Master, specify the
network information for both LAN1 (IPv4) and LAN1 (IPv6).
Enter correct information for the following by clicking the field:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Type the IPv4 or IPv6 address depending on the type of interface. An IPv6 address is a 128-bit
number in colon hexadecimal notation. It consists of eight 16-bit groups of hexadecimal digits
separated by colons (example: 2001:db8:0000:0123:4567:89ab:0000:cdef or
2001:db8::123:4567:89ab:0:cdef).
— Subnet Mask (IPv4) or Prefix Length (IPv6): Specify an appropriate subnet mask for IPv4 address or
prefix length for IPv6 address. The prefix length ranges from 2to 127.
— Gateway: Type the IPv4 or IPv6 address of the default gateway depending on the type of interface. For
IPv6 interface, you can also type Automatic to enable the appliance to acquire the IPv6 address of the
default gateway and the link MTU from router advertisements.

Note: You can now define a link-local address as the default IPv6 gateway and isolate the LAN segment so the
local router can provide global addressing and access to the network and Internet. This is supported for
both LAN1 and LAN2 interfaces as well as LAN1 and LAN2 in the failover mode.

— VLAN Tag: For a VLAN, enter the VLAN tag or ID. You can enter a number from 1 to 4094. Ensure that you
configure the corresponding switch accordingly.
— Port Settings: From the drop-down list, choose the connection speed that you want the port to use. You
can also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or Half
for data transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to
negotiate the optimum port connection type (full or half duplex) and speed with the connecting switch
automatically. This is the default setting. You cannot configure port settings for vNIOS appliances.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 295

Deploying a Grid

10. Optionally, enter a new password and click Next. The password must be a single hexadecimal string (no spaces)
that is at least four characters long.
11. Select the time zone of the Grid Master and indicate whether the Grid Master synchronizes its time with an NTP
(Network Time Protocol) server, and then click Next.
— If you choose to enable NTP, click the Add icon and enter the IP address of an NTP server. Entries may be an
IPv4 or IPv6 address. You can enter IP addresses for multiple NTP servers.
— If you choose to disable NTP, set the date and time for the appliance.
12. If you want to participate in the Infoblox Customer Experience Improvement Program, complete the following and
then click Next:
— Participate in the Infoblox Customer Experience Improvement Program: Select the check box to send
product usage data to Infoblox on a periodic basis. Infoblox uses this data to improve product functionality.
For more information about the program, see Participating in the Customer Experience Improvement
Program on page 1349.
— Support ID (optional): Enter the Infoblox Support ID that was assigned to your account. It must be a number
with four to six digits. The value you enter here is also displayed in the Customer Improvement tab in the
Grid Properties editor. Infoblox includes this ID in the data report.
— Email: Enter an email address to which Infoblox sends a copy of the usage report. The email address you
enter here is also displayed in the Customer Improvement tab in the Grid Properties editor. This is optional.
— Infoblox Privacy Policy: Click here to view the Infoblox privacy policy. The appliance displays the policy in a
new browser tab.
13. The last screen displays the settings you specified in the previous panels of the wizard. Verify that the
information is correct and click Finish. The application restarts after you click Finish.

Note: The Grid Setup wizard provides options such as not changing the default password and manually entering
the time and date. However, changing the password and using an NTP server improve security and
accuracy (respectively), and so these choices are presented here.
Record and retain this information in a safe place. If you forget the shared secret, you need to contact
Infoblox Technical Support for help. When you add an appliance to the Grid, you must configure it with the
same Grid name, shared secret, and VPN port number that you configure on the Grid Master.

The last screen of the setup wizard states that the changed settings require the appliance to restart. When you
click Finish, the appliance restarts.

The setup of the single master is complete. From now on, when you make an HTTPS connection to the appliance, use
its new IP address.
In a dual mode Grid Master, the communication protocol for all the services is set to IPv4, by default. You can change
the default communication protocol for the services. For information, see Changing the Communication Protocol for
a Dual Mode Appliance on page 302.

296 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Adding Grid Members

Adding Grid Members

Note: You may provision a Port Reservation for the new Grid Member. When doing so, you select the device to which
you expect the new Grid Member to connect; In the context of a Grid member, this device type is usually an
Ethernet Switch or Switch-Router. The Add Grid Member Wizard provides a step in which you define the port
reservation settings, as described in the following section Adding a Single Member. The process also can be
applied when defining an HA pair, as described in the sections Creating an HA Grid Master and Adding an HA
Member.

You can add single appliances and HA pairs to a Grid, forming single members and HA members respectively. A single
Grid member can be either an Infoblox appliance or a vNIOS appliance. You can configure Grid members in either
IPv4, IPv6, or dual mode (IPv4 and IPv6). For information about which vNIOS appliance supports configuration as an
HA Grid member, see Supported vNIOS Appliance Models and Specifications on page 1775.
You can also define an HA member on the Grid Master and then add two individual NIOS appliances to the Grid as
Node 1 and Node 2 to complete the HA member you defined on the master.
New members inherit all settings that you create at the Grid level unless you override them at the member level. You
can also define port reservations for the network infrastructure devices to which the Grid members will connect.
The process for adding either a single appliance or HA pair to a Grid involves the following steps:
1. Adding and configuring Grid members on the Grid Master. In addition to defining the network and appliance
settings for a member, you can also configure service settings before you join the member or HA pair to the Grid.
2. Reserving a port on a switch or switch-router for connectivity to the Grid member.
3. Joining the appliance or HA pair to the Grid. This includes defining the VIP or IP address of the Grid Master, the
Grid name, and the shared secret on the single appliance or HA pair. If an appliance or HA pair cannot join the
Grid because of MTU (maximum transmission unit) limitations on its network link, you can reduce the MTU that
the master uses when communicating with it. See Setting the MTU for VPN Tunnels on page 328. If the Grid
Master is behind a NAT device and there are members on both sides of that NAT device, you must create a NAT
group, as described in NAT Groups on page 275.
In a large scale deployment of Grids across multiple sites, consider remotely provisioning your Grid members
before joining them to the Grid. For more information about this feature, see Auto-Provisioning NIOS Appliances
on page 307.
In situations where you want to define certain configurations on an offline Grid member and associate DNS and
DHCP data to the member before deploying it, you can use the pre-provisioning feature to accomplish this. For
more information, see Pre-Provisioning NIOS and vNIOS Appliances on page 309.

Adding a Single Member

The basic steps necessary to add a single member are as follows:
1. Define the network settings of the LAN1 port of the single appliance on the Grid Master.
2. Initiate the join Grid operation during which you specify the VIP or IP address of the Grid Master, the Grid name,
and the shared secret on the single appliance. For information, see Joining Appliances to the Grid on page 302.
On the Grid Master, you can configure any service settings such as DNS zones and records, DHCP networks and
address ranges, and other services for a member before or after you join the appliance to the Grid. The basic steps
for adding a single member are presented in the following section.
For information on how to configure a vNIOS appliance as a Grid member, refer to the Quick Start Guide for Installing
vNIOS Software on Riverbed Services Platforms and the Quick Start Guide for Installing vNIOS Software on VMware
Platforms.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 297

Deploying a Grid

Configuring a Single Member on the Grid Master

1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Expand the Toolbar and click Add -> Add Grid Member.
3. In the Add Grid Member wizard, enter the following and click Next:
— Member Type: Specify the appliance type of the Grid member. If the member is an Infoblox appliance,
select Infoblox, which is the default. For a vNIOS appliance, select Riverbed, or Virtual NIOS for vNIOS
virtual appliances, including cloud virtual appliances.
— Host Name: Type the FQDN (fully qualified domain name) of the appliance that you are adding to the Grid.
— Time Zone: If the Grid member is in a different time zone from the Grid, click Override and select a time
zone.
— Comment: Type a comment that provides some useful information about the appliance, such as its
location.
— Master Candidate: Select this option to designate this appliance as a Master Candidate. For supported
vNIOS appliances, see Supported vNIOS Appliance Models and Specifications on page 1775.
4. Enter the following information about the member that you are adding to the Grid and click Next:
— Type of Network Connectivity: Select the type of network connectivity for the Grid member from the
drop-down list:
— IPv4 and IPv6: Select this to configure a dual mode Grid member.
— IPv4: Select this to configure an IPv4 Grid member.
— IPv6: Select this to configure an IPv6 Grid member.

Note: Infoblox recommends that you backup the configuration after you convert a Grid to a different mode.
Restoring the old backup by performing a forced restore, may prevent the Grid members from rejoining the
Grid Master after the restore.

— Standalone Member: Select this option.

— Required Ports and Addresses: This table lists the network interfaces based on the type of network
connectivity of the Grid member. For IPv4 Grid member, specify the network information for LAN1 (IPv4)
port and for IPv6 Grid member, specify the network information for LAN1 (IPv6) port. For a dual mode Grid
member, specify the network information for both LAN1 (IPv4), and LAN1 (IPv6).
Enter correct information for the following by clicking the field:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Type the IPv4 or IPv6 address depending on the type of interface. An IPv6 address is a 128-bit
number in colon hexadecimal notation. It consists of eight 16-bit groups of hexadecimal digits
separated by colons (example: 2001:db8:0000:0123:4567:89ab:0000:cdef or
2001:db8::123:4567:89ab:0:cdef).
— Subnet Mask (IPv4) or Prefix Length (IPv6): Specify an appropriate subnet mask for IPv4 address or
prefix length for IPv6 address. The prefix length ranges from 2 to 127.
— Gateway: Type the IPv4 or IPv6 address of the default gateway depending on the type of interface. For
IPv6 interface, you can also type Automatic to enable the appliance to acquire the IPv6 address of the
default gateway and the link MTU from router advertisements.
— VLAN Tag: For a VLAN, enter the VLAN tag or ID. You can enter a number from 1 to 4094. Ensure that you
configure the corresponding switch accordingly.
— Port Settings: From the drop-down list, choose the connection speed that you want the port to use. You
can also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or Half
for data transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to
negotiate the optimum port connection type (full or half duplex) and speed with the connecting switch
automatically. This is the default setting. You cannot configure port settings for vNIOS appliances.

298 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Adding Grid Members

— DSCP Value: Displays the Grid DSCP value, if configured. To modify, click Override and enter the DSCP
value. You can enter a value from 0 to 63. For information about DSCP, see Implementing Quality of
Service Using DSCP on page 447.
5. In the Port Reservation page, do the following:
• Begin by checking the Reserve Port check box. Note that reserving a switch port does not guarantee its
availability once the device must connect. The port is automatically assigned for connectivity to the LAN1
port on the appliance.
Optionally, you can skip connecting port configuration by clicking Next.
Click the Clear button to remove the selected device from the configuration.
• Click the Select Device button to choose the device for which the port reservation will be associated. You
should know the identity of the device to which the Infoblox appliance will connect before taking this step.
For Grid member connectivity, the chosen device should be either a switch or a switch-router.
• After choosing the device, choose the Interface with which the reservation will be bound. The drop-down
list shows only interfaces that are most recently found to be available by Grid Manager during the last
Discovery cycle. This list will not include any ports that are Administratively Up and Operationally Up or that
are otherwise already assigned to other networks or Objects.
• The Wizard page also shows a list of any VLANs that are currently configured in the chosen device (The
following VLANs are configured). This Wizard page does not allow the definition of new VLANs for port
configuration–only the assignment of an existing VLAN in the device to your new port reservation. (Recall
that you may specify the VLAN Tag across which Grid member traffic will travel, when you specified the Grid
member information in Step 2 of the Wizard.)
• Check the Configure Port check box to define specific Port Control settings for the port reservation.
• Choose the Data VLAN and/or the Voice VLAN settings you may need for the port assignment. Depending on
the selected device, the Voice VLAN field may or may not appear.
• Set the Admin Status to Up if you need to activate the port after assignment in the current task.
— All Port Control operations require CLI credentials to be entered into Grid Manager. Because some IPAM
and DHCP Objects will use Port Control features as part of object creation, CLI credentials are
automatically leveraged as part of discovery. Ensure you have the correct sets of CLI credentials for
devices in your network.
• Enter a Description for the port assignment. Infoblox recommends doing so to help other technicians to
recognize the port assignment event.
• When finished, click Next to continue in the wizard.
6. Optionally, define extensible attributes. For information, see About Extensible Attributes on page 417.
7. The final step for adding a Grid member is to define when the associated Port Configuration task executes. You
may execute it immediately or schedule it for another time and date.
• To create the new port configuration immediately, select Now. The port control task is automatically
synchronized to take place at the same time as the activation of the new Grid member.
• You can choose to have Grid Manager execute the port control task at a later time. To do so, select Later.
Choose a Selected time by entering or selecting a Start Date (click the calendar icon to choose a calendar
date) and a Start Time, and choose a Time Zone.
8. Choose one of the following from the Save & ... drop-down button menu:
— Click Save & Close to add the single member to the Grid and close the wizard (this is the default).
— Click Save & Edit to add the single member to the Grid and launch the editor. You can configure additional
properties, such as the MTU size, or add the member to a NAT group.
— Click Save & New to add the single member to the Grid and launch the wizard again to add another
member.
The communication protocol for all the services in a dual mode (IPv4 and IPv6) Grid member is set to IPv4, by default.
You can change the default communication protocol for all the services. For information, see Changing the
Communication Protocol for a Dual Mode Appliance on page 302.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 299

Deploying a Grid

Adding an HA Member
The basic steps necessary to add an HA member are as follows:
1. Define the network settings of the HA pair on the Grid Master.
2. Initiate the join Grid operation, during which you specify the VIP or IP address of the Grid Master, the Grid name,
and the shared secret on the HA pair. For information, see Joining Appliances to the Grid on page 302.
In addition, on the Grid Master you can configure the service settings such as DNS zones and records, DHCP networks
and address ranges, and so on for a member before or after you join the HA pair to the Grid. The basic steps for adding
an HA member are presented below.

Note: The procedure for adding an HA pair to a Grid when it uses the MGMT port of the active node for Grid
communications differs slightly from that described below. See Grid Communications on page 463.

Configuring an HA Member on the Grid Master

1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Expand the Toolbar and click Add -> Add Grid Member.
3. In the Add Grid Member wizard, enter the following and click Next:
— Member Type: Specify the appliance type of the Grid member. If the member is an Infoblox appliance,
select Infoblox, which is the default. For a vNIOS appliance on VMware, select Virtual NIOS.
— Host Name: Type the FQDN (fully qualified domain name) for the HA member.
— Time Zone: If you want the Grid member to have a different time zone, click Override and select a time zone.
— Comment: Type a comment that provides some useful information about the appliance, such as its
location.
— Master Candidate: select this check box to designate this appliance as a Master Candidate. For supported
vNIOS appliances, see Supported vNIOS Appliance Models and Specifications on page 1775.
4. Enter the following information about the member that you are adding to the Grid and click Next:
— Type of Network Connectivity: Select the type of network connectivity for the HA member from the
drop-down list:
— IPv4 and IPv6: Select this to configure a dual mode HA member.
— IPv4: Select this to configure an IPv4 HA member.
— IPv6: Select this to configure an IPv6 HA member.
— High Availability Pair: Select this option.
— Virtual Router ID: Enter a unique VRID number—from 1 to 255—for the local subnet.
— Send HA and Grid Communication Over: This field is displayed only when you are configuring a dual
mode HA member. Select either IPv4 or IPv6 as the communication protocol for VRRP advertisements
and for joining the Grid Master.

Note: Infoblox recommends that you backup the configuration after you convert a Grid to a different mode.
Restoring the old backup by performing a forced restore, may prevent the Grid members from rejoining the
Grid Master after the restore.

— Required Ports and Addresses: This table lists the network interfaces based on the type of network
connectivity. For IPv4 HA member, specify the network information for VIP (IPv4), Node1 HA (IPv4), Node2
HA (IPv4), Node1 LAN1 (IPv4), and Node2 LAN1 (IPv4) interfaces. For IPv6 HA member, specify the network
information for VIP (IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6) interfaces.
For a dual mode HA member, if you select IPv4 in the Send HA and Grid Communication over field, specify
the network information for the following interfaces: VIP (IPv4), Node1 HA (IPv4), Node1 LAN1 (IPv4),
Node2 HA (IPv4), Node2 LAN1 (IPv4), VIP (IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6) interfaces.

300 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Adding Grid Members

For a dual mode HA member, if you select IPv6 in the Send HA and Grid Communication over field, specify
the network information for the following interfaces: VIP (IPv4), Node1 LAN1 (IPv4), Node2 LAN1 (IPv4), VIP
(IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6) ports.
Enter correct information for the following by clicking the field:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Type the IPv4 or IPv6 address depending on the type of interface. An IPv6 address is a 128-bit
number in colon hexadecimal notation. It consists of eight 16-bit groups of hexadecimal digits
separated by colons (example: 2001:db8:0000:0123:4567:89ab:0000:cdef or
2001:db8::123:4567:89ab:0:cdef).
— Subnet Mask (IPv4) or Prefix Length (IPv6): Specify an appropriate subnet mask for IPv4 interface or
prefix length for IPv6 interface. The prefix length ranges from 2 to 127.
— Gateway: Type the IPv4 or IPv6 address of the default gateway depending on the type of interface. For
IPv6 interface, you can also type Automatic to enable the appliance to acquire the IPv6 address of the
default gateway and the link MTU from router advertisements.
— VLAN Tag: For a VLAN, enter the VLAN tag or ID. You can enter a number from 1 to 4094. Ensure that you
configure the corresponding switch accordingly.
— Port Settings: From the drop-down list, choose the connection speed that you want the port to use. You
can also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or Half
for data transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to
negotiate the optimum port connection type (full or half duplex) and speed with the connecting switch
automatically. This is the default setting. You cannot configure port settings for vNIOS appliances.
— DSCP Value: Displays the Grid DSCP value, if configured. To modify, click Override and enter the DSCP
value. You can enter a value from 0 to 63. For information about DSCP, see Implementing Quality of
Service Using DSCP on page 447.

Note: When the system operates in HA mode, should the IPv6–addressed VIP value be deleted, the IPv6
address of the HA port will also be deleted.

5. Optionally, define extensible attributes. For information, see Using Extensible Attributes on page 427.
6. Do one of the following:
— Click Save & Edit to add the HA member to the Grid and launch the editor. You can configure additional
properties, such as the MTU size, or add the member to a NAT group.
— Click Save & New to add the HA member to the Grid and launch the wizard again to add another member.
— Click Save & Close to add the HA member to the Grid and close the wizard.
The communication protocol for all the services in a dual mode (IPv4 and IPv6) HA member is the same protocol as
the one that is used for VRRP advertisements. For example, if you select IPv4 in the Send HA and Grid Communication
over field in step 2 of the Add Grid Member wizard, then IPv4 is set as the communication protocol for all the services.
However, you can override the communication protocol for all the services in a dual mode HA member. For
information, see Changing the Communication Protocol for a Dual Mode Appliance on page 302.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 301

 Deploying a Grid

Changing the Member Type

When you change the Member Type from Infoblox to Virtual NIOS, Infoblox displays an error indicating that the
network port of a vNIOS member must be set to Automatic. If you encounter this error, follow the steps mentioned
below to change the Member Type to Virtual NIOS:
1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Expand the Toolbar and click Add -> Add Grid Member.
3. In the Add Grid Member wizard, leave the Member Type as Infoblox, fill other details and click Next.
4. In the Network tab select High Availability Pair.
5. Change the port settings to Automatic for Node1 HA.
6. Select Standalone Member.
7. Click Previous and change the Member Type to vNIOS.

Changing the Communication Protocol for a Dual Mode Appliance

You can change the default communication protocol for a dual mode appliance. You can force the appliance to use a
specific protocol to join the Grid Master and for the reporting services. But for services with two types of resolution
(A and AAAA records), you can set the preferred communication protocol.
To change the communication protocol for a dual mode appliance:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> member check box -> Edit icon.
2. In the Grid Member Properties editor, select the Network tab -> Basic tab, and then complete the following:
— Communication Protocol Settings and Preferences: This setting is not applicable for an HA pair. Select
either IPv4 or IPv6 from the drop-down list. This setting will force the appliance to use the specified protocol
for Grid and reporting services and this is the preferred protocol for services with two types of resolution (A
and AAAA records).
— Customized Settings: Select this and do the following:
— Always use this Communications Protocol for: For a Grid Master, you can select either IPv4 or IPv6 from
the Reporting drop-down list. This setting will force the Grid Master to use the specified communication
protocol for reporting service. For a Grid member, you can select either IPv4 or IPv6 from the Grid and
Reporting drop-down list. This setting will force the Grid member to use the specified communication
protocol for Grid and reporting service.
— Always Prefer this Communications Protocol for: This field lists the services which has two types of
resolution (A and AAAA records). Select either IPv4 or IPv6 from the drop-down list for the service which
you want the appliance to use this as the preferred communication protocol. The appliance uses the
preferred protocol first for the service.

Joining Appliances to the Grid

Grid members can join the Grid using IPv4 protocol in an IPv4-only Grid and using IPv6 protocol in an IPv6-only Grid.
In a dual mode Grid, the Grid members may join the Grid using IPv4 or IPv6. Similarly, a Grid Master candidate can
join the Grid using IPv4 in an IPv4-only Grid and using IPv6 in an IPv6-only Grid. But for a Grid Master candidate to
join a dual mode Grid, it should be configured in dual mode. If you have configured the MGMT port for the Grid
member, then the Grid member can join the Grid using the MGMT port. You can use the Grid Setup Wizard or access
the Join Grid dialog box to join appliances to a Grid. The Grid Setup Wizard launches when you first log in to an
appliance. You can also launch it from the Toolbar as described in Grid Setup Wizard on page 289.
To join a single appliance and HA pair to a Grid using the Grid Manager GUI:
1. Log in to the appliance or HA pair that you want to add to the Grid. The appliance or HA pair must be online and
able to reach the Grid Master.
2. From the Grid tab, select the Grid Manager tab -> Members tab.
3. Expand the Toolbar and click Join Grid.

302 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Adding Grid Members

4. In the Join Grid dialog box, enter the following:

— Virtual IP of Grid Master: Type the VIP address of the HA Grid Master or the LAN1 address of the single Grid
Master for the Grid to which you want to add the appliance. Entries may be an IPv4 or IPv6 address.
— Grid Name: Type the name of the Grid.
— Grid Shared Secret: Type the shared secret of the Grid.
— Use MGMT port to join Grid: If you have already enabled the MGMT port (see Grid Communications on page
273), this option becomes available. Select it to connect to the Grid through the MGMT port.
5. Click OK to begin the join operation.
To confirm that the appliance has successfully joined the Grid, log in to the Grid Master and navigate to the Grid
tab, select the Grid Manager -> Members tab. This panel lists the Grid members. Check the icon in the Status
column of the newly added member. (green = the appliance has joined the Grid and is functioning properly;
yellow = the appliance is in the process of joining the Grid; red = the appliance has not joined the Grid). You can
also use the CLI command set network to join an appliance to a Grid.
To join a single appliance and HA pair to a Grid using the Grid Setup Wizard:
1. Log in to the appliance or HA pair that you want to add to the Grid. The appliance or HA pair must be online and
able to reach the Grid Master.
2. From the Grid tab, select the Grid Manager tab -> Members tab.
3. Expand the Toolbar and click Grid Properties -> Setup (Grid Setup Wizard).
4. On the next screen, specify the Grid properties and click Next
— Grid Name: Enter a text string that the two appliances use to authenticate each other when establishing a
VPN tunnel between them. This must match the Grid name you entered for node 1.
— Grid Master’s IP Address: Enter the same VIP you entered for node 1.
— Shared Secret: Enter a text string that both appliances use as a shared secret to authenticate each other
when establishing a VPN tunnel between them. This must match your entry in node 1.
5. On the next screen verify the IP address settings of the member and click Next
6. The last screen displays the settings you specified in the previous panels of the wizard. Verify that the
information is correct and click Finish.
To confirm that the appliance has successfully joined the Grid, log in to the Grid Master and navigate to the Grid
tab, select the Grid Manager -> Members tab. This panel lists the Grid members. Check the icon in the Status
column of the newly added member. (Green = The appliance has joined the Grid and is functioning properly;
Yellow = The appliance is in the process of joining the Grid; Red = The appliance has not joined the Grid). You
can also use the CLI command set network to join an appliance to a Grid.

Grouping Members by Extensible Attributes

When you have a few members in your Grid, you can organize and group them by extensible attributes that contain
the same values. Using the Group Results function, you can organize your members in a meaningful way and quickly
identify them based on common data. When you group members by multiple extensible attributes, the appliance
groups the members hierarchically based on the order of the filters. For example, when you filter members first by
extensible attribute "Site equals London" and then by extensible attribute "Organization equals Engineering," the
appliance groups corresponding members first by Site and then by Organization based on the values you enter. In
the Grid tab -> Grid Manager tab ->Members tab, Grid Manager displays the grouped members in a hierarchical view
that displays the member group name (London). You can click the London link and drill down to the next level of
grouping. In this case, Grid Manager displays the organization group (Engineering) in the Members tab. When you
click the Engineering link to drill down to the next level, all associated members that belong to this member group
(London -> Engineering) are displayed.
To go back to a previous hierarchical view, click the link of the corresponding level in the breadcrumb.



NIOS 7.3 NIOS Administrator Guide (Rev. A) 303

Deploying a Grid

To group members by extensible attributes:

1. From the Grid tab, select the Grid Manager tab -> Members tab.
or
From the Grid tab, select the Grid Manager tab -> Services tab.

Note: You can use the “Group Results” function for the following services: DNS, DHCP, TFTP, FTP, HTTP, NTP,
bloxTools, Captive Portal, and Reporting services.

or
From the Data Management tab, select the DHCP, File Distribution, or DNS tab -> Members/Servers tab.
2. Complete the following to group members with the same extensible attribute value:
— Group Results: Select this check box to enable the appliance to group members by extensible attributes.
— Group By: From the drop-down list, select the first extensible attribute that you want the appliance to use
for filtering members.
Grid Manager displays data per group of members configured with the same extensible attribute value.
To add additional Group By filter, click the + icon, and then select a value from the drop-down list. You can apply
up to 10 Group By filters. You can also delete a filter by clicking the - icon.
When you enable reporting service on the Grid and configure multi-site cluster, you can group reporting
members by reporting site extensible attributes. For information about reporting clusters, see Configuring
Indexer Cluster on page 1396.
Grid Manager displays the following information for the specified extensible attribute:
— <Selected extensible attribute>: Displays the extensible attribute value.
— Status: This is the overall status for all members in the group. Depending on the status of each member, the
overall status can be one of the following: Working, Warning, Failed, Offline, Inactive, or Unknown. For
information about the status, see Grid Status on page 145.

Note: In an HA pair, when one of the appliance is in the Working status and the other appliance has a status other
than Working, Inactive, and Unknown, then the overall status of HA members is Warning. When you use filters
and the group by extensible attribute feature, filters take precedence over the group by function.

When you drill-down to the member level, Grid Manager displays the members in the group.

Configuring an IPv6-only Grid

An IPv6-only Grid uses IPv6 as the communication protocol and it includes an IPv6 Grid Master and the Grid
members, which can be either IPv6 or dual mode (IPv4 and IPv6). In order to configure an IPv6-only Grid, you have to
first create an IPv6 Grid Master and then join the Grid members using their IPv6 addresses.
The process of configuring an IPv6-only Grid involves the following steps:
1. Make a console connection to the Grid Master and configure an IPv6 address for the Grid Master using the CLI
command set network. For information, see Method 2 – Using the CLI on page 336.
2. Open a web browser and make an HTTPS connection to the IPv6 address of LAN1 port of the Grid Master.
3. Log in using the default user name and password admin and infoblox. For detailed information about logging in
to the GUI, see Logging in to the GUI on page 58.
4. The Grid Setup Wizard appears when you first log in to the appliance. You can use it to create an IPv6 HA Master
or IPv6 single Grid Master. For information about creating an HA Master, see Creating an HA Grid Master on page
289 and for information about creating a single Grid Master, see Creating a Single Grid Master on page 294.

304 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring an IPv6-only Grid

The type of network connectivity for the Grid Master should be set to IPv6. To verify, navigate to the Grid tab ->
Grid Manager tab -> Members tab -> member check box -> Edit icon. In the Grid Member Properties editor, select
the Network tab -> Basic tab, check that the Type of Network Connectivity is set to IPv6. The Grid members can
join the Grid Master using IPv6 only.

Note: You can add additional IPv4 and IPv6 addresses for LAN2 and MGMT ports for the Grid services, in the
Additional Ports and Addresses table. But for an IPv6-only Grid, you can configure IPv6 address for the
VLAN port.

5. Add IPv6 single members and HA members to the Grid. For information, see Adding Grid Members on page 297.
6. You can use the Grid Setup Wizard or access the Join Grid dialog box to join appliances to a Grid. See Joining
Appliances to the Grid on page 302.
You can also configure IPv6 address for the MGMT interface of the appliance and join the Grid through the MGMT
interface.

Transforming to an IPv6-only Grid

After an upgrade from a previous NIOS release to NIOS 7.0 or later, each node in the Grid is set to either IPv4 or dual
mode (IPv4 and IPv6). Transforming an IPv4-only Grid to an IPv6-only Grid may take a longer duration. Hence, before
removing the IPv4 addresses from each Grid member, you have to configure additional IPv6 Grid communication
protocol for each Grid member so that all the services function properly using IPv6.
Note the following before converting an IPv4-only or a dual mode Grid to an IPv6-only Grid:
• If a Grid member is designated as a Master Candidate, the Grid manager does not allow you to change the type
of network connectivity of the Grid Master or the Grid Master Candidate. Therefore, you must disable the Grid
member from being a Grid Master Candidate before changing the type of network connectivity of the Grid Master
or the Grid Master Candidate. You can deselect the Master Candidate option in the General tab of the Grid
Member Properties editor to disable a member from being a Master Candidate. Note that at this point, the Grid
will not have a Grid Master Candidate and this may result in an unrecoverable condition, if the Grid Master goes
down.
• You must stop all services on the Grid Master and Grid members that uses IPv4.
• If external servers like authentication servers, forwarders, root name servers, backup servers, etc. is configured
with IPv4 addresses, then it will not work after converting the Grid to an IPv6-only Grid. Hence, make sure that
you change the IPv4 address of the external server to IPv6 address before converting the Grid to an IPv6-only
Grid.

Note: Infoblox recommends that you backup the configuration after you convert a Grid to IPv6-only mode. Restoring
the old backup by performing a forced restore, may prevent the Grid members from rejoining the Grid Master
after the restore.

The process of transforming an IPv4-only or dual mode Grid to an IPv6-only Grid involves the following steps:
1. Convert the Grid Master into dual mode (IPv4 and IPv6) if it is in IPv4 mode, as follows:
— Login to the Grid Master, from the Grid tab -> Grid Manager tab -> Members tab -> select the Grid Master and
click the Edit icon.
— In the Grid Member Properties editor, select the Network tab -> Basic tab.
— In the Type of Network Connectivity field, select IPv4 and IPv6 from the drop-down list and enter the
network information for LAN1 (IPv6) address in the Ports and Addresses table.
For HA Master, select IPv4 in the Send HA and Grid Communication Over field, and enter the network
information for VIP (IPv6), Node1 LAN1 (IPv6), Node2 LAN1 (IPv6) in the Ports and Addresses table.
— Save the configuration and click Restart if it appears at the top of the screen.
2. Similarly, convert all the Grid members into dual mode (IPv4 and IPv6) if it is in IPv4 mode. All the members will
rejoin the Grid using IPv4.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 305

Deploying a Grid

3. Force each Grid member to rejoin the Grid using IPv6, as follows:
— From the Grid tab, select the Grid Manager tab -> Members tab -> member check box -> Edit icon.
— In the Grid Member Properties editor, select the Network tab -> Basic tab.
— In the Always Force or Prefer this Communications Protocol field, select IPv6 from the drop-down list and
also select IPv6 in the Send HA and Grid Communication over field if the member is an HA pair.
This setting will force the Grid member to rejoin the Grid using IPv6 and it uses IPv6 for all the services.
— Save the configuration and click Restart if it appears at the top of the screen.
4. Configure each Grid member to provide DNS service using IPv6, as follows:
— From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
— In the Member DNS Properties editor, select the General tab -> Basic tab.
— Enable the IPv6 check box and disable the IPv4 check box for the desired interface (LAN1, LAN2, or MGMT)
under DNS Interfaces.
Ensure that the primary and secondary servers are configured with an IPv6 address for each zone, before
disabling the IPv4 check box for LAN1, LAN2, or MGMT interface.
— Save the configuration and click Restart if it appears at the top of the screen.
5. Configure each Grid member to provide DHCP service using IPv6, as follows:
— From the Data Management tab, select the DHCP tab -> Members tab -> member check box -> Edit icon.
— In the Member DHCP Properties editor, select the General tab -> Basic tab.
— Disable the IPv4 check box for LAN1 and LAN2 interface under DHCP Interfaces.
— Enable the IPv6 check box for the desired interface (LAN1 or LAN2) under DHCP Interfaces.
If IPv6 network is not configured, you can create an IPv6 network. For information, see Managing IPv6
Networks on page 1161.
— Save the configuration and click Restart if it appears at the top of the screen.
6. Enable each Grid member and the Grid Master to use IPv6 for all the services, as follows:
— From the Grid tab, select the Grid Manager tab -> Members tab -> member check box -> Edit icon.
— In the Grid Member Properties editor, select the Network tab -> Basic tab, and select Customized Settings
and specify the following:
— Always Force this Communication Protocol for: Select IPv6 from the drop-down list for the Grid and
reporting service.
— Always Prefer this Communication Protocol for: Select IPv6 from the drop-down list as the preferred
communication protocol for the listed services which has two types of resolution (A and AAAA records).
The appliance uses the preferred protocol first for the service.
— Save the configuration and click Restart if it appears at the top of the screen.
7. When all the services are functioning using IPv6, you can remove the IPv4 addresses from all the Grid members
by converting the Grid member from dual mode (IPv4 and IPv6) to IPv6 mode, as follows.
— From the Grid tab, select the Grid Manager tab -> Members tab -> member check box -> Edit icon.
— In the Grid Member Properties editor, select the Network tab -> Basic tab.
— In the Type of Network Connectivity field, select IPv6 from the drop-down list.
— Save the configuration and click Restart if it appears at the top of the screen.
8. Similarly, you can convert the Grid Master from dual mode (IPv4 and IPv6) to IPv6 mode after converting all the
Grid members to IPv6 mode.

Note: Remove the IPv4 addresses from the Grid Master only after you remove the IPv4 addresses from all the Grid
members.

306 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Auto-Provisioning NIOS Appliances

Auto-Provisioning NIOS Appliances

In addition to using the Grid Setup Wizard or access the Join Grid dialog box to join appliances to a Grid, you can set
up an appliance using the auto-provisioning feature, which allows a DHCP server to automatically assign an IP
address to the appliance. You can then join the auto-provisioned appliance to the Grid.
Auto-provisioning is enabled by default for new installations of physical appliances, but it is not supported for vNIOS
appliances. When you connect the appliance to the network, a lease request is automatically sent to the DHCP server.
The DHCP server fingerprints the client as “Infoblox Appliance,” as the DHCP client provides the unique option
sequence (1,28,2,2,3,3,15,6,12) and vendor ID (INFOBLOX). The DHCP server assigns a DHCP lease and a dynamic
IP address to the appliance. If the DHCP lease request fails, the default IP address (192.168.1.2) is assigned to the
appliance. The DHCP client tries to send the lease request for a duration of one minute when the appliance is either
in the factory default state or in the auto-configured default IP address state after a reboot. If you do not use
auto-provisioning to set up the appliance, then you can wait one minute before connecting the appliance to the
network. Otherwise, the DHCP server will assign a dynamic IP address to the appliance. Note that if you have already
set the IP address for the appliance through the Infoblox CLI, GUI, or API, then auto-provisioning is disabled for the
appliance and the lease address is not requested. When auto-provisioning is enabled for an appliance, the DNS,
DHCP, FTP, TFTP, HTTP, NTP, bloxTools, Captive Portal, Reporting services, as well as backup and restore are disabled
for the member until a static IP address is set for the appliance. You can join a single appliance or HA pair to the Grid.
After the appliance joins the Grid, the static IP address is set for the appliance.

Note: Auto-provisioning supports only IPv4 addressing and not IPv6 addressing.

When you upgrade or downgrade the appliance to a release that includes this feature, auto-provisioning is disabled
for the appliance.

Setting Up Physical Appliances Using Auto-Provisioning

Complete the following to set up an appliance using auto-provisioning and to join the auto-provisioned appliance to
the Grid Master:
1. Connect the appliance to a network using an Ethernet cable, connect it to a power source, and then turn on the
power. For information about cabling the appliance to a network and powering the appliance, refer to the user
guide or installation guide that ships with the product.
A lease request is automatically sent to the DHCP server that assigns a DHCP lease and a dynamic IP address to
the appliance. The DHCP client tries to send the lease request for a duration of one minute and if the request
fails, the default IP address (192.168.1.2) is assigned to the appliance.
2. Join the appliance to the Grid Master. You can join the auto-provisioned appliance to the Grid Master using the
Connect dialog box. For more information, see Joining Auto-Provisioned Appliances to the Grid on page 308. You
can also join an appliance to the Grid using the Join Grid dialog box. For more information, see Joining Appliances
to the Grid on page 302.
A static IP address is set and auto-provisioning is automatically disabled for the appliance after it joins the Grid.

Note: When auto-provisioning is disabled for an appliance and the network address is not preserved,
auto-provisioning will be re-enabled and a DHCP lease request is sent to the DHCP server if you reset the
appliance using the CLI command reset all or reset the database using the CLI command reset database.
However, if the static IP address for an appliance is set and network settings are preserved, auto-provisioning
will be re-enabled for the appliance but the lease address will not be requested if you reset the database using
the CLI command reset database.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 307

Deploying a Grid

Joining Auto-Provisioned Appliances to the Grid

You can join a predefined appliance with a DHCP lease to the Grid Master using the Connect dialog box. You can join
a single appliance or an HA pair to the Grid Master. For an HA pair, the member which is offline will join the Grid Master
and it will become the active node. When both the members of an HA pair are offline, Node 1 of an HA pair is joined
to the Grid Master.
Only superusers can join a Grid member to the Grid Master. If the Grid member fails to join the Grid, then the remote
console is enabled for the appliance and you can join the appliance to a Grid through the remote console. You can
log in to the remote console using the user name, admin and the Grid shared secret as the password.
To join a single appliance or an HA pair to a Grid Master, complete the following:
1. Log in to the Grid Master. Note that the single appliance or the HA pair must be online and the Grid Master must
be able to reach the appliance.
2. From the Grid tab, select the Grid Manager tab -> Members tab.
3. Add the appliance as a Grid member. For information about adding Grid members to the Grid, see Adding Grid
Members on page 297.
4. Select the Grid member that you want to join to the Grid Master, expand the Toolbar and click Connect.
5. The following fields are displayed in the Connect dialog box:
— Host Name: The name of the member.
— Configured IPv4 Address: The IPv4 address of the member.
— Site: The site to which the IP address belongs. This is one of the predefined extensible attributes.
— Temporary IPv4 Address: Enter the IPv4 address of the DHCP lease or click Select to select the DHCP lease.
Grid Manager displays the Lease Selector dialog box from which you can select the DHCP lease. Note that
the Lease Selector displays the active DHCP leases which are fingerprinted as “Infoblox Appliance”.
6. Click Next to retrieve the appliance information.
The Grid Master uses SSL to connect to the appliance and it gets the appliance information. Grid Manager
displays the following information for the appliance:
— Remote Appliance Type: The appliance type.
— Remote Appliance Serial Number: The serial number of the appliance.
— Licenses: Grid Manager displays the Grid license and the licenses that are pre-provisioned on the member.
It displays the following information:
— Type: The license type.
— String: The license string. If the license string is not displayed, you can enter or paste it here.
7. Click Connect to join the appliance to the Grid Master.
To confirm that the appliance has successfully joined the Grid, check the status in the Status column of the newly
added member. (Green = The appliance has joined the Grid Master and is functioning properly; Yellow = The
appliance is in the process of joining the Grid Master; Red = The appliance has not joined the Grid Master).

308 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Pre-Provisioning NIOS and vNIOS Appliances

Pre-Provisioning NIOS and vNIOS Appliances

Before joining a member to the Grid, you can first enable provisional licenses and make necessary configurations on
the offline member, which allows DNS and DHCP data to be associated with the member prior to its deployment. Note
that pre-provisioned members are treated as offline members. There are a few guidelines to consider before you
pre-provision a member. For more information about the guidelines, see Guidelines for Pre-provisioning Offline Grid
Members on page 309.
When you add a new member to the Grid, the Pre-Provisioning tab is displayed in the Grid Member Properties editor.
You can pre-provision the member by defining its hardware model and enable certain provisional licenses through
the Pre-Provisioning tab. This tab is not displayed after the member successfully joins the Grid. NIOS supports the
following provisional licenses: Cloud Platform, DHCP, DNS, DNS Traffic Control, Enterprise (formerly Grid), FireEye,
Microsoft Management, RPZ (Response Policy Zone), and vNIOS. You must enable provisional licenses before you can
make supported configurations on the pre-provisioned member. For more information about these licenses, see
About Provisional Licenses on page 310.

Note: You must have the Enterprise and vNIOS licenses pre-provisioned in order for a vNIOS appliance to join the
Grid. For a cloud virtual appliance, include the Cloud Platform license.

To pre-provision an offline Grid member and join it to the Grid at a later time, complete the following:
1. Add a new single member or HA member to the Grid, as described in Adding a Single Member on page 297 or
Adding an HA Member on page 300.
2. Pre-provision the offline member, as described in Configuring Pre-Provisioned Members on page 310.
3. Configure services to use the pre-provisioned member.
4. Obtain permanent licenses you have specified for pre-provisioning and use the set license CLI command to
install the licenses on the member. For more information about CLI commands, refer to the Infoblox CLI Guide.
5. Join the pre-provisioned member to the Grid, as described in Joining Appliances to the Grid on page 302. For
guidelines about joining pre-provisioned members, see Guidelines for Joining Pre-Provisioned Members to the
Grid on page 311.

Guidelines for Pre-provisioning Offline Grid Members

Before you pre-provision a Grid member, consider the following:
• A pre-provisioned Grid member is an offline member. When you upgrade a Grid that has a pre-provisioned
member, the upgrade behaves the same way as it does when you upgrade the Grid that has an offline member.
Note that you cannot pre-provision a member or update its settings during a scheduled upgrade. For more
information about upgrades, see About Upgrades on page 521.
• You cannot change the pre-provisioned member configuration after you save it. To change the configuration, you
must first delete the member and pre-provision it again. If you want to delete certain provisional licenses or
change the hardware model for the pre-provisioned member, you must also first delete the existing member and
define a new one. For information about deleting a member, see Removing a Grid Member on page 328.
• When you assign a network, zone, or IPv4 DHCP failover association to a pre-provisioned member, the Restart
Service button is not displayed. If you restart any service on a pre-provisioned member, no action is actually
taken even though you may receive a message indicating that the operation may take a few minutes. When you
join the member to the Grid, NIOS will run respective member services on the joined member. For more
information about service restarts, see Restarting Services on page 496.
• NIOS allows you to backup information about the pre-provisioned member. When you perform a forced restore
however, NIOS does not restore the pre-provisioned licenses if you have already installed permanent NIOS
licenses on the corresponding member. For more information about backup and restore, see Backing Up and
Restoring Configuration Files on page 540.
• You can use Manage Member Services to manage the pre-provisioned member services. For more information,
see Monitoring Member Services on page 1334.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 309

Deploying a Grid

Configuring Pre-Provisioned Members

The pre-provisioning feature is disabled by default. You must select a supported hardware model for the member to
enable this feature.
To pre-provision an offline member, login to the Grid Master and complete the following:
1. From the Grid tab, select the Grid Manager tab -> Members tab, and then click the Add icon.
2. In the Add Grid Member wizard, add a new member as described in Adding a Single Member on page 297.
3. After you add the member to the Grid, select the member in the Members tab and click the Edit icon.
4. In the Grid Member Properties editor, select the Pre-Provisioning tab, and complete the following:
— Member Type: Displays the member type that you have selected in the General tab. The pre-provisioning
feature is supported only for Infoblox and Virtual NIOS member types. Note that you must select a hardware
model for the member in order to enable the pre-provisioning feature.
— Hardware Model: Select the hardware model from the drop-down list. Grid Manager displays only the
supported hardware models for the specified member type. Once you select the hardware model, the
pre-provisioning feature is enabled for the member. NIOS allows you to pre-provision HA members that
have the same or different hardware models for Node 1 and Node 2. A few hardware specific features, such
as DSCP, VLAN, LAN2, and LOM (Light Out Management), are enabled based on the pre-provisioned
hardware model you specify here.
— Provisional Licenses: Select the licenses that you want to enable for the pre-provisioned member. You can
select the licenses only after you have specified the hardware model for the member. Once you select and
enable a license, you can no longer modify the hardware model for the member. Note that the permanent
licenses that you later add to the member must include the ones that are specified for pre-provisioning.
5. Save the configuration.

Note: After you save the configuration, you can no longer modify the hardware model for the member. You also
cannot disable any provisional licenses, though you can add new ones. To disable provisional licenses,
you must first remove the pre-provisioned member and then configure a new one.

About Provisional Licenses

If a member has never joined a Grid, you can pre-provision this member provided that you define the hardware model
for the member and assign provisional licenses to it. Provisional licenses are not permanent NIOS licenses. Though
they do not have expiration dates or validity periods, you must replace these licenses with corresponding permanent
licenses before you join the member to the Grid.

Note: Before you join the member to the Grid, use the CLI command set license to add corresponding permanent
licenses that you have specified for pre-provisioning. For information about CLI commands, refer to the
Infoblox CLI Guide. You can also allocate pre-purchased licenses from the pool. For information, see Managing
the Order of Match Lists on page 489.

NIOS supports the following provisional licenses: Cloud Platform, DHCP, DNS, DNS Traffic Control, Enterprise
(formerly Grid), FireEye, Microsoft Management, RPZ (Response Policy Zone), and vNIOS.
After you configure the offline member, you can select the pre-provisioned member from the corresponding wizards
and editors based on the required license(s). The following table lists the wizards and editors from which you can
select a pre-provisioned member when required pre-provisioned licenses are enabled:

Wizards and editors from which you can select a pre-provisioned Required license(s)
member
DNS Zones and Name Server Groups dns
DHCP IPv4 and IPv6 networks dhcp

310 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Pre-Provisioning NIOS and vNIOS Appliances

Wizards and editors from which you can select a pre-provisioned

Required license(s)
member
IPv4 DHCP Failover Association dhcp
Microsoft servers ms_management
Note that the initial synchronization with Microsoft servers is
read-only. When you join the appliance to the Grid, the appliance
removes all Microsoft management objects that you have configured
on the Microsoft servers after the synchronization. The configuration
on the Microsoft servers will replace the configuration on the NIOS
appliance.
Grid Members vnios
Grid license enterprise
Response Policy Zones RPZ
Response Policy Zones FireEye
DNS Traffic Control DTC
Cloud tabs and related wizards and editors cloud_api

Note: If you configure a DHCP Failover using an online member and a pre-provisioned member, assign it to a
range, and start DHCP service, no addresses will be served because the initial synchronization does not
happen due to the pre-provisioned offline member. NIOS logs the following message in the syslog:
2013-12-24T08:37:23+00:00 daemon (none) dhcpd[8790]: info DHCPDISCOVER from
cb:86:a8:45:6c:5c via 10.120.21.236: not responding (recovering)

Guidelines for Joining Pre-Provisioned Members to the Grid

Before you join a pre-provisioned member to the Grid, ensure that you verify the appliance model and provisional
licenses for the member. For information about how to join a member to the Grid, see Joining Appliances to the Grid
on page 302.
Note the following about joining a pre-provisioned member to the Grid:
• If you install fewer permanent licenses than the specified provisional licenses, you cannot join the member to
the Grid.
• If the pre-provisioned member does not have any provisional licenses enabled, you can join the member to the
Grid provided that you install a permanent Grid license on the member.
• You must install at least the set of permanent licenses that were specified for pre-provisioning along with any
other needed licenses, except for the following:
— You can join the member to the Grid if the pre-provisioned member is a vNIOS virtual appliance and has
only the DNS license enabled, and you install both the vNIOS and DNS licenses on the member.
— Similarly, you can join the member to the Grid if the pre-provisioned member is a vNIOS virtual appliance
and has both DNS and DHCP licenses enabled, and you install the vNIOS, DNS, and DHCP licenses on the
member.
• After you successfully join the pre-provisioned member to the Grid, provisional licenses are removed and
permanent licenses take effect.
• After the member joins the Grid successfully, the Pre-Provisioning tab is not displayed in the Grid Member
Properties editor.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 311

Deploying a Grid

Configuration Example: Configuring a Grid

You can configure an IPv4-only, IPv6-only, or a dual mode (IPv4 and IPv6) Grid, but the configuration example uses
IPv4 addresses. In this example, you configure seven NIOS appliances in a Grid serving internal DHCP and DNS for an
enterprise with the domain name corp100.com. There are four sites: HQ and three branch offices. A hub-and-spoke
VPN tunnel system connects the sites, with HQ at the hub. The distribution and roles of the NIOS appliances at the
four sites are as follows:
• HQ site (four appliances in two HA pairs):
— HA Grid Master – hidden primary DNS server
— HA member – secondary DNS server and DHCP server for HQ
• Site 1 (two appliances in an HA pair): HA member – secondary DNS server and DHCP server for Site 1
• Site 2(one appliance): single member – secondary DNS server and DHCP server for Site 2

Note: When adding an Infoblox appliance to an existing Grid, you must first check whether the Grid is running the
minimum required software release of the appliance. For information, refer to the document, Minimum
Required Release Software for Hardware Platforms, that was shipped with your product.

To create a Grid, you first create a Grid Master and then add members. The process involves these three steps:
1. Configuring two appliances at HQ as the Grid Master. See Create the Grid Master on page 314.
2. Logging in to the Grid Master and defining the members that you want to add to the Grid; that is, you configure
Grid member settings on the Grid Master in anticipation of later joining those appliances to the Grid. See Define
Members on the Grid Master on page 316.
3. Logging in to the individual appliances and configuring them so that they can reach the Grid Master over the
network and join the Grid. See Join Appliances to the Grid on page 317.

312 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring a Grid

After creating the Grid and adding members, you use the Data Import Wizard to import DHCP and DNS data from
legacy servers. See Import DHCP Data on page 319 and Import DNS Data on page 321.
Finally, you transition DHCP and DNS service from the legacy servers to the Infoblox Grid members. See Enable DHCP
and Switch Service to the Grid on page 324.

Figure 5.15 Network Diagram

HQ Site
Zone: corp100.com

... Zone: lab.corp100.com

... NTP Server

Network: 10.0.1.0/24 10.120.3.10
Address Range:10.0.1.50 - 10.0.1.200
All Infoblox
Network: 10.0.15.0/24 appliances are in
Address Range:10.0.15.50 - 10.0.15.200 the Pacific time
zone
Grid Master HA Grid Member
ns1.corp100.com ns2.corp100.com
VIP: 10.0.1.10 VIP: 10.0.2.10
VRID: 143 VRID: 210
Hidden Primary Secondary DNS Server
DNS Server DHCP Server
Legacy Secondary
Legacy Hidden Primary DNS Server
DNS Server ns2.corp100.com; 10.0.2.5
ns1.corp100.com; and
10.0.1.5 DHCP server 10.0.2.20

VPN Tunnel

Internet

Firewalls

... ...
HA Grid Member Single Grid Member
ns3.site1.corp100.com ns4.site2.corp100.com
VIP: 10.1.1.10 LAN1: 10.2.1.10
VRID: 111 Secondary DNS Server Zone: site2.corp100.com
Zone: site1.corp100.com Secondary DNS Server DHCP Server
Network: 10.1.1.0/24 DHCP Server Network: 10.2.1.0/24
Address Range:10.1.1.50 - 10.1.1.200 Address Range:10.2.1.50 - 10.2.1.200

Legacy Secondary DNS Server Legacy Secondary DNS Server

ns3.site1.corp100.com; 10.1.1.5 and ns4.site2.corp100.com; 10.2.1.5 and
DHCP server 10.1.1.20 DHCP server 10.2.1.20

Branch Office: Site 1 Branch Office: Site 2

NIOS 7.3 NIOS Administrator Guide (Rev. A) 313

Deploying a Grid

Cable All Appliances to the Network and Turn On Power

Cable the NIOS appliances to network switches. After cabling each appliance to a switch and connecting it to a power
source, turn on the power. For information about installing and cabling the appliance, refer to the user guide or
installation guide that ships with the product.
1. At HQ and Site 1, connect Ethernet cables from the LAN1 and HA ports on the appliances in each HA pair to a
switch, connect the appliances to power sources, and turn on the power for each appliance.

Note: When connecting the nodes of an HA pair to a power source, connect each node to a different power
source if possible. If one power source fails, the other might still be operative.

2. At Site 2, connect an Ethernet cable from the LAN1 port on the single appliance to a switch, connect the appliance
to a power source, and turn on the power for that appliance.

Create the Grid Master

Note: IPv6 addressing is fully supported on Infoblox Grid Masters, HA pairs and standalone HA pairs and appliances.
Examples in the sections of this chapter use IPv4.

Configure two appliances at HQ to be the two nodes that make up the HA pair forming the Grid Master.

Grid Master – Node 1

1. By using the LCD or by making a console connection to the appliance that you want to make Node 1 of the HA pair
for the Grid Master, change the default network settings of its LAN1 port to the following:
— IP Address: 10.0.1.6
— Netmask: 255.255.255.0
— Gateway: 10.0.1.1
2. Connect your management system to the HQ network, open a browser window, and connect to https://10.0.1.6.
3. Log in using the default user name and password admin and infoblox.
4. Review the End-User License Agreement and click I Accept.
The Grid Setup Wizard appears.
5. On the first screen, select Configure a Grid Master and click Next.
6. Specify the Grid properties:
— Grid Name: Enter corp100.
— Shared Secret: Enter Mg1kW17d.
— Confirm Shared Secret: Enter Mg1kW17d.
— Hostname: Enter ns1.corp100.com.
— Type of Network Connectivity: Select IPv4 from the drop-down list.
— Is the Grid Master an HA pair?: Select Yes.

314 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring a Grid

7. Specify the network properties and click Next:

— Virtual Router ID: Enter 143.
— Required Ports and Addresses: Enter the following to set up the HA pair:

Interface Address Subnet Mask (IPv4) or Gateway Port Settings

Prefix Length (IPv6)
VIP (IPv4) 10.0.1.10 255.255.255.0 10.0.1.1 Automatic
Node1 HA (IPv4) 10.0.1.7 255.255.255.0 10.0.1.1 Automatic
Node2 HA (IPv4) 10.0.1.9 255.255.255.0 10.0.1.1 Automatic
Node1 LAN1 (IPv4) 10.0.1.6 255.255.255.0 10.0.1.1 Automatic
Node2 LAN1 (IPv4) 10.0.1.8 255.255.255.0 10.0.1.1 Automatic

8. Enter a new password: 1n85w2IF. Retype it and click Next.

9. Complete the following:
— Time zone: Select (UTC – 8:00 Pacific Time (US and Canada), Tijuana
— Enable NTP, click the Add icon and enter the IP address of the NTP server: 10.120.3.10
10. Click Finish.
When you click Finish, the Infoblox GUI application restarts.

Grid Master – Node 2

1. By using the LCD or by making a console connection to the appliance that you want to make Node 2 of the HA pair
for the Grid Master, change the default network settings of its LAN1 port to the following:
— IP Address: 10.0.1.8
— Netmask: 255.255.255.0
— Gateway: 10.0.1.1
2. In the login window, type 10.0.1.8 in the Hostname field.
3. Log in using the default user name and password admin and infoblox.
4. From the Grid tab, select the Grid Manager tab -> Members tab -> member check box.
5. Expand the Toolbar and click Join Grid and specify the following:
— Virtual IP of Grid Master: 10.0.1.10.
— Grid Name: Enter corp100.
— Grid Shared Secret: Enter Mg1kW17d.
6. Confirm the configuration, and then on the last screen of the wizard, click Finish.
The HTTPS session terminates, but the login window remains open.
7. In the login window, type 10.0.1.10 (the VIP address for the Grid Master) in the Hostname field.
8. Log in using the default user name admin and the password 1n85w2IF.
9. To check the status of the two nodes of the HA Grid Master, navigate to the Grid tab, select the Grid Manager ->
Members tab. This panel lists the Grid members. Check the icon in the Status column of the Grid Master. (green
= the appliance has joined the Grid and is functioning properly; yellow = the appliance is in the process of joining
the Grid; red = the appliance has not joined the Grid). You can also use the CLI command set network to join
an appliance to a Grid. Check that the status indicators are all green in the Detailed Status panel.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 315

Deploying a Grid

During the joining process, an appliance passes through the following four phases:
1. Offline – the state when a Grid member—in this case, the second node of the HA pair composing the Grid
Master—is not in contact with the active node of the master
2. Connecting – the state when an appliance matching a member configuration contacts the master to join the Grid
and negotiates secure communications and Grid membership
3. Synchronizing – the master transmits its entire database to the member
4. Running — the state when a member is in contact with the master and is functioning properly

Note: Depending on the network connection speed and the amount of data that the master needs to synchronize
with the member, the process can take from several seconds to several minutes to complete.

Define Members on the Grid Master

Before logging in to and configuring the individual appliances that you want to add to the Grid, define them first on
the Grid Master. You can configure a Grid member in IPv4, IPv6, or a dual mode (IPv4 and IPv6), but the configuration
example uses IPv4 addresses.

HQ Site – HA Member
1. From the Grid tab, select the Grid Manager -> Members tab.
2. Expand the Toolbar and click Add -> Add Grid Member.
3. In the Add Grid Member wizard, complete the following and click Next:
— Member Type: Select Infoblox.
— Host Name: Enter ns2.corp100.com.
— Comment: Enter HQ Site - ns2.corp100.com.
4. Enter the following information about the member that you are adding to the Grid and click Save & Close:
— Type of Network Connectivity: Select IPv4 from the drop-down list.
— High Availability Pair: Select this option.
— Virtual Router ID: 210
— Required Ports and Addresses:

Interface Address Subnet Mask (IPv4) or Gateway Port Settings

Prefix Length (IPv6)
VIP (IPv4) 10.0.2.10 255.255.255.0 10.0.2.1 Automatic
Node1 HA (IPv4) 10.0.2.7 255.255.255.0 10.0.2.1 Automatic
Node2 HA (IPv4) 10.0.2.9 255.255.255.0 10.0.2.1 Automatic
Node1 LAN1 (IPv4) 10.0.2.6 255.255.255.0 10.0.2.1 Automatic
Node2 LAN1 (IPv4) 10.0.2.8 255.255.255.0 10.0.2.1 Automatic

316 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring a Grid

Site 1 – HA Member
1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Expand the Toolbar and click Add -> Add Grid Member.
3. In the Add Grid Member wizard, enter the following and click Next:
— Member Type: Select Infoblox.
— Host Name: Enter ns3.site1.corp100.com
— Comment: Enter Site 1 - ns3.site1.corp100.com
4. Specify the following information about the member that you are adding to the Grid and click Save & Close:
— Type of Network Connectivity: Select IPv4 from the drop-down list.
— High Availability Pair: Select this option.
— Virtual Router ID: Enter 111.
— Required Ports and Addresses:

Interface Address Subnet Mask (IPv4) or Gateway Port Settings

Prefix Length (IPv6)
VIP (IPv4) 10.1.1.10 255.255.255.0 10.1.1.1 Automatic
Node1 HA (IPv4) 10.1.1.7 255.255.255.0 10.1.1.1 Automatic
Node2 HA (IPv4) 10.1.1.9 255.255.255.0 10.1.1.1 Automatic
Node1 LAN1 (IPv4) 10.1.1.6 255.255.255.0 10.1.1.1 Automatic
Node2 LAN1 (IPv4) 10.1.1.8 255.255.255.0 10.1.1.1 Automatic

Site 2 – Single Member

1. From the Grid tab, select the Grid Manager -> Members tab.
2. Expand the Toolbar and click Add -> Add Grid Member.
3. In the Add Grid Member wizard, enter the following and click Next:
— Member Type: Select Infoblox.
— Host Name: ns4.site2.corp100.com
— Comment: Site 2- ns4.site2.corp100.com
4. Specify the following information about the member that you are adding to the Grid and click Next:
— Type of Network Connectivity: Select IPv4 from the drop-down list.
— Standalone Member: Select this option.
— Required Ports and Addresses: Click the empty fields and enter the following information:
— Address: Enter 10.2.1.10.
— Subnet Mask (IPv4) or Prefix Length (IPv6): Enter 255.255.255.0.
— Gateway: Enter 10.2.1.1.
— Port Settings: Select AUTOMATIC.
5. Save the configuration and click Restart if it appears at the top of the screen.
6. Log out from the Grid Master.

Join Appliances to the Grid

To complete the process of adding appliances to the Grid, log in to and configure each individual appliance so that it
can contact the Grid Master.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 317

Deploying a Grid

HQ Site – HA Grid Member (Node 1)

Make a console connection to the appliance that you want to make Node 1 in the HA pair, and enter the following:
Infoblox > set network
NOTICE: All HA configuration is performed from the GUI. This interface is used only
to configure a standalone node or to join a Grid.
Enter IP address: 10.0.2.6
Enter netmask : 255.255.255.0
Enter gateway address : 10.0.2.1
Configure IPv6 network settings? (y or n):n
Become Grid member? (y or n): y
Enter Grid Master VIP: 10.0.1.10
Enter Grid Name: corp100
Enter Grid Shared Secret: Mg1kW17d
New Network Settings:
IP address: 10.0.2.6
Netmask: 255.255.255.0
Gateway address: 10.0.2.1
Join Grid as member with attributes:
Grid Master VIP: 10.0.1.10
Grid Name: corp100
Grid Shared Secret: Mg1kW17d
WARNING: Joining a Grid will replace all the data on this node!
Is this correct? (y or n): y
Are you sure? (y or n): y
The Infoblox application restarts. After restarting, the appliance contacts the Grid Master and joins the Grid as Node
1.

HQ Site – HA Member (Node 2)

Make a console connection to the appliance that you want to make Node 2 in the HA pair, and enter exactly the same
data you entered for Node 1 except that the IP address is 10.0.2.8.
After the application restarts, the appliance contacts the Grid Master and joins the Grid as Node 2, completing the
HA member configuration for the HQ site.

Site 1 – HA Grid Member (Node 1)

Make a console connection to the appliance that you want to make Node 1 in the HA pair at Site 1, and use the set
network command to configure its basic network and Grid settings. Use the following data:
— IP Address: 10.1.1.6
— Netmask: 255.255.255.0
— Gateway: 10.1.1.1
— Grid Master VIP: 10.0.1.10
— Grid Name: corp100
— Grid shared secret: Mg1kW17d
The Infoblox application restarts. After restarting, the appliance contacts the Grid Master and joins the Grid as 
Node 1.

318 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring a Grid

Site 1 – HA Grid Member (Node 2)

Make a console connection to the appliance that you want to make Node 2 in the HA pair at Site 1, and enter exactly
the same data you entered for Node 1 except that the IP address is 10.1.1.8.
After the application restarts, the appliance contacts the Grid Master and joins the Grid as Node 2, completing the
HA member configuration for Site 1.

Site 2– Single Grid Member

Make a console connection to the appliance that you want to make Node 1 in the HA pair at Site 1, and use the set
network command to configure its basic network and Grid settings. Use the following data:
— IP Address: 10.2.1.10
— Netmask: 255.255.255.0
— Gateway: 10.2.1.1
— Grid Master VIP: 10.0.1.10
— Grid name: corp100
— Grid shared secret: Mg1kW17d
The Infoblox application restarts. After restarting, the appliance contacts the Grid Master and joins the Grid.
To check the status of all the Grid members, log in to the Grid Master at 10.0.1.10, and from the Grid tab, select the
Grid Manager tab -> Members tab, select 10.0.1.10 and click the Detailed Status icon. Check that the status indicators
are all green in the Detailed Status panel. As an appliance joins a Grid, it passes through the following phases:
Offline, Connecting, (Downloading Release from Master), Synchronizing, and Running.)

Note: Depending on the network connection speed and the amount of data that the master needs to synchronize
with the member, the process of joining a Grid can take from several seconds to several minutes to complete.

The Grid setup is complete.

Import DHCP Data

The Data Import Wizard is a software tool that you can download from the Infoblox Support site to your management
system. With it, you can import data from legacy DHCP and DNS servers to NIOS appliances. In this example, you use
it to import both DHCP and DNS data to the Grid Master at 10.0.1.10, which then uses the database replication
mechanism to send the imported data to other Grid members. In the wizard, you also specify which Grid members
serve the imported data. The wizard supports various types of DHCP formats, such as the following:
• ISC DHCP
• Lucent VitalQIP
• Microsoft
• Nortel NetID
• CSV (comma-separated values); you can also import IPAM data in CSV format
In this example, all the DHCP data is in standard ISC DHCP format.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 319

Deploying a Grid

Importing DHCP Data for HQ and Site 2

1. Save the DHCP configuration file from your legacy DHCP server at 10.0.2.20 to a local directory.
2. Visit https://support.infoblox.com , log in with your support account, and download the Data Import Wizard. The
Data Import Wizard application downloads to a container within a Java sandbox on your management system and
immediately launches, displaying the Welcome page.
3. After reading the information in the left panel, click Next.
4. Select Import to Infoblox Appliance, enter the following, and then click Next:
— Hostname or IP address: 10.0.1.10
— Username: admin
— Password: 1n85w2IF
5. Select the following, and then click Next:
— What kind of data would you like to import? DHCP/IPAM
— Which legacy system are you importing from? ISC DHCP
— Which appliance will be serving this data? 10.0.2.10
6. Type the path and file name of the DHCP configuration file saved from the legacy server, and then click Next.
or
Click Browse, navigate to the file, select it, click Open, and then click Next.
7. In the Global DHCP Configuration table, double-click the Value cell for the domain-name-servers row, and change
the IP addresses to 10.0.2.10.
8. When satisfied with the data, click Import.
You can view the status of the importation process and a summary report in the Data Import Wizard Log.
9. To enable DDNS updates, log in to the Grid Master, from the Data Management tab, select the DHCP tab, expand
the Toolbar and click Grid DHCP Properties.
10. In the DDNS -> Basic tab of the Grid DHCP Properties editor, select Enable DDNS Updates.
11. Save the configuration and click Restart if it appears at the top of the screen.
12. To check the imported DHCP configuration file, from the Data Management tab, select the DHCP tab, -> Members
tab -> 10.0.2.10 -check box. Expand the Toolbar and click View DHCP Configuration.
13. In the DHCP configuration file, check that all the imported subnets are present, and navigate to the beginning of
the file and check that you see the ddns-updates on statement. ( If you see ddns-updates off , enable
DDNS updates for the Grid as explained in steps 9-12.)

Importing DHCP Data for Site 1

1. Repeat the steps in Importing DHCP Data for HQ and Site 2, saving the DHCP configuration file from your legacy
DHCP server at 10.1.1.20, and importing it to the Grid Master at 10.0.1.10 for the member with IP address
10.1.1.10 to serve.
2. Check the imported DHCP configuration file by logging in to the Grid Master and from the Data Management tab,
select the DHCP tab -> Members tab -> 10.1.1.10 -check box. Expand the Toolbar and click View DHCP
Configuration.

Importing DHCP Data for Site 3

1. Repeat the steps in Importing DHCP Data for HQ and Site 2, saving the DHCP configuration file from your legacy
DHCP server at 10.1.1.20, and importing it to the Grid Master at 10.0.1.10 for the member with IP address
10.3.1.10 to serve.
2. After the importation process completes, check the imported DHCP configuration file by logging in to the Grid
Master and from the Data Management tab, select the DHCP tab -> Members tab -> 10.3.1.10 -check box. Expand
the Toolbar and click View DHCP Configuration.

320 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring a Grid

Import DNS Data

Using the Infoblox Data Import Wizard, import DNS data from the legacy hidden primary server at 10.0.1.5 to the new
hidden primary server at 10.0.1.10 (the Grid Master). There are three phases to this task:
• Before Using the Wizard:
— Save the named.conf file from the legacy server to a file in a local directory on your management system.
— Enable the legacy server to perform zone transfers to the NIOS appliance.
— Configure three name server groups for the Grid, and allow the Grid Master/hidden primary DNS server at
10.0.1.10 to receive DDNS updates from the Grid members at 10.0.2.10, 10.1.1.10, and 10.3.1.10. These
members act as secondary DNS servers and DHCP servers.
• Using the Wizard on page 322: Define the source, destination, and type of DNS data in the DNS configuration
file (named.conf) that you want to import.
• After Using the Wizard on page 324: Check the imported DNS configuration file.
In this example, all the DNS data is in BIND 9 format. The Data Import Wizard supports various types of DNS formats,
such as the following:
• BIND 4, 8, and 9
• Microsoft
• Lucent VitalQIP
• Nortel NetID

Before Using the Wizard

You must set up the legacy server and Grid Master before using the Data Import Wizard.

Legacy Server
1. Log in to the legacy name server at 10.0.1.5 and save the named.conf file, which contains all the DNS settings
that you want to import into the Infoblox name server, to a local directory on your management system.
2. On the legacy server, enable zone transfers to the NIOS appliance.

Infoblox Grid Master – DDNS Updates

1. Log in to the Grid Master at 10.0.1.10, and from the Data Management tab, select the DNS tab -> Members tab ->
10.0.1.10 check box and select the Edit icon.
2. In the Member DNS Configuration editor, select the Updates tab -> Basic tab and enter the following:
— Select Override.
— Allow updates from: Click the Add icon and select IPv4 Address. Enter 10.0.2.10 in the Name field of the
new row.
3. Click the Add icon again and add 10.1.1.10 and 10.2.1.10 as IP addresses from which you allow DDNS updates.
4. Save the configuration and click Restart if it appears at the top of the screen.

Note: When all DNS servers are members in the same Grid, the members use database replication to synchronize all
their data—including DNS zone data. You can change the default behavior so that Grid members use zone
transfers instead. In this example, Grid members use database replication.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 321

Deploying a Grid

Infoblox Grid Master – Name Server Groups

1. From the Data Management tab, select the DNS tab -> Name Server Groups tab.
2. Click the Add icon to open the Add Name Server Group wizard.
3. Enter the following:
— Name Server Group Name: HQ-Group
4. Click the Add icon and add the following:
— Grid Primary: ns1.corp100.com; Stealth: Select this check box.
— Grid Secondary: ns2.corp100.com; Grid replication (recommended): Select this check box.
5. Click Save & New.
6. Repeat steps 2 to 4 to create another group. Name it Site1-Group, and use ns1.corp100.com as the hidden
primary server, ns3.site1.corp100.com as a secondary server, and Grid replication for zone updates.
7. Repeat steps 2 to 4 to create another group. Name it Site2-Group, and use ns1.corp100.com as the hidden
primary server, ns4.site2.corp100.com as a secondary server, and Grid replication for zone updates.

Using the Wizard

While progressing through the Data Import Wizard, you must define the source, destination, and type of DNS data
that you want to import. You then make some simple modifications to the data and import it.

Defining the Source, Destination, and Type of DNS Data

1. Launch the Data Import Wizard.
2. After reading the information in the left panel of the welcome page, click Next.
3. Select Import to Infoblox Appliance, enter the following, and then click Next:
— Hostname or IP address: 10.0.1.10
— Username: admin
— Password: 1n85w2IF
The Data Import Wizard Log opens in a separate window behind the wizard. Leave it open while you continue.
4. Select the following, and then click Next:
— What kind of data would you like to import? DNS
— Which legacy system are you importing from? BIND 9
— Which appliance will be serving this data? 10.0.1.10
5. Select the following, and then click Next:
— What BIND 9 DNS configuration file would you like to use? Click Browse, navigate to the named.conf file you
saved from the legacy server, select it, and then click Open.
— What type of BIND 9 DNS data do you want to import? DNS zone information and DNS record data
— Where is the BIND 9 DNS record data? Zone transfer(s) from a DNS server; 10.0.1.5
The wizard displays two tables of data. The upper table contains global DNS server configuration parameters.
The lower table contains zone configurations.
The Data Import Wizard Log presents a summary listing the number of views, zones, and DNS records in the
configuration file.

Note: Only superusers can import A, AAAA, shared A, and shared AAAA records with a blank name. Limited-access
users must have read/write permission to Adding a blank A/AAAA record in order to import A, AAAA, shared
A, and shared AAAA records with a blank name, otherwise the import operation might fail. You can assign
global permission for specific admin groups and roles to allow to import A, AAAA, shared A, and shared AAAA
records with a blank name. For more information, see Administrative Permissions for Adding Blank A or AAAA
Records on page 245.

322 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring a Grid

Modifying DNS Data

While importing data from the legacy DNS server, you cancel the importation of global configuration settings, and
apply the name server groups you created in Before Using the Wizard on page 321 to the zones you want to import.
1. In the Global DNS Configuration table, select all rows by clicking the top row and then SHIFT+clicking the bottom
row.
2. Right-click the selected rows to display the Set Import Options dialog box, select Do not import, and then click
Apply.
3. In the DNS Zones table, clear the Import check box for the default view.
4. Select corp100.com, lab.corp100.com and all the corresponding reverse-mapping zones.

Tip: You can use SHIFT+click to select multiple contiguous rows and CTRL+click to select multiple
noncontiguous rows.

5. Right-click the selected rows, and then select Set Import Options.
6. In the Set Import Options dialog box, enter the following, and then click Apply:
— Set Zone Type: No change
— Set Import Option: No change
— Set View: default
— Set Member: HQ-Group master
7. Select site1.corp100.com and all the reverse-mapping zones with 1 in the second octet in the zone name
(1.1.10.in-addr.arpa, 2.1.10.in-addr.arpa, 3.1.10.in-addr.arpa, and so on).
8. Right-click the selected rows, and select Set Import Options.
9. In the Set Import Options dialog box, make the same selections as in Step 6 , but choose Site1-Group master
from the Set Member drop-down list.
10. Similarly, select site2.corp100.com and all the reverse-mapping zones with 2in the second octet in the zone
name.
11. Right-click the selected rows, and select Set Import Options.
12. In the Set Import Options dialog box, make the same selections as in Step 6 , but choose Site2-Group master
from the Set Member drop-down list.

Importing DNS Data

1. Click Import.
The wizard imports the global DNS parameters and zone-specific configuration settings from the named.conf
file and performs a zone transfer of the data from the legacy server.
2. Use the Data Import Wizard Log to monitor progress and review results afterward.
The log lists all the zones that the wizard imports and concludes with a total of all the successfully and
unsuccessfully imported zones.

Note: If the wizard is unable to import a zone, an error message with an explanation appears in the log.

3. To close the Data Import Wizard, click Exit. This closes the Data Import Wizard Log as well.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 323

Deploying a Grid

After Using the Wizard

After you import data, you must restart services on the Grid Master and delete the A records for the legacy servers
from the corp100.com zone. You can also confirm that the imported data is correct and complete by checking the DNS
configuration and the forward- and reverse-mapping zones.
1. Log in to the Grid Master (10.0.1.10), select the Grid tab, expand the Toolbar, and then click the Restart Services
icon.

Note: When importing data through the wizard rather than entering it through the GUI, the Restart Services icon
does not change to indicate you must restart service for the appliance to apply the new data. Still,
restarting service on the Grid Master is necessary for the imported configuration and data to take effect.

2. To remove A records for the legacy servers, from the Data Management tab, select DNS tab -> Zones tab ->
corp100.com.
3. Expand the Records section, select the following A records in the corp100.com zone, and then click the Delete
icon:
— ns1 (for 10.0.1.5)
— ns2 (for 10.0.2.5)
— ns3.site1.corp100 (for 10.1.1.5)
— ns4.site3.corp100 (for 10.2.1.5)
4. Remove the respective A records for legacy servers from the site1.corp100 and site3.corp100 subzones.
5. To check the imported DNS configuration file, from the Data Management tab, select DNS tab -> Members tab ->
10.0.1.10 check box. Expand the Toolbar and click View -> View DNS Configuration.

Note: If you do not see the imported DNS configuration file, make sure you enabled DNS and restarted services.

6. Scroll through the DNS configuration log to check that each imported zone has an allow-update statement like
the following one for the 10.1.10.in-addr.arpa reverse-mapping zone:
zone "10.1.10.in-addr.arpa" in {
…
allow-update { key DHCP_UPDATER; 10.0.2.10; 10.1.1.10; 10.2.1.10; };
…
};

Enable DHCP and Switch Service to the Grid

Finally, you must enable DHCP service on the three Grid members at 10.0.2.10, 10.1.1.10, and 10.2.1.10, and switch
DNS and DHCP service from the legacy DNS and DHCP servers to them.
1. Log in to the Grid Master (10.0.1.10)and from the Data Management tab, select the DHCP tab -> Members tab ->
-> 10.0.2.10 check box. Expand the Toolbar and click Start.
2. Repeat step 1 to enable DHCP on 10.1.1.10 and 10.3.1.10.

Note: Start the DNS service, as described in Starting and Stopping the DNS Service on page 763.

The Grid members are ready to serve DHCP and DNS, and send DDNS updates.
3. Take the legacy DHCP and DNS servers offline.

324 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing a Grid

Managing a Grid
After you configure a Grid Master and add members, you might need to perform the following tasks:
• Changing Grid Properties on page 325
• Configuring Security Level Banner on page 326
• Configuring Notice and Consent Banner on page 326
• Configuring Informational Level Banner on page 327
• Setting the MTU for VPN Tunnels on page 328
• Removing a Grid Member on page 328
• Promoting a Master Candidate on page 328

Changing Grid Properties

You can change a Grid name, its shared secret, and the port number of the VPN tunnels that the Grid uses for
communications. Note that changing the VPN port number, time zone, date or time requires a product restart.
To modify the properties of a Grid:
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and select Grid Properties -> Edit.
3. In the Grid Properties editor, select the General tab -> click the Basic tab, and then modify any of the following:
— Grid Name: Type the name of a Grid. The default name is Infoblox.
— Shared Secret: Type a shared secret that all Grid members use to authenticate themselves when joining the
Grid. The default shared secret is test.
— Shared Secret Retype: Type the shared secret again to confirm its accuracy.
— Time Zone: Choose the applicable time zone from the drop-down list.
— Date: Click the calendar icon to select a date or enter the date in YYYY/MM/DD format.
— Time: Click the clock icon to select a time or enter the time in HH:MM:SS format. For afternoon and evening
hours, use the integers 13-24.
— VPN Port: Type the port number that the Grid members use when communicating with the Grid Master
through encrypted VPN tunnels. The default port number is 1194. For more information, see Port Numbers
for Grid Communication on page 289.
— Enable Recycle Bin: Select the check box to enable the Recycle Bin. The Recycle Bin stores deleted items
when the user deletes Grid, DNS, or DHCP configuration items. Enabling the Recycle Bin allows you to undo
deletions and to restore the items on the appliance at a later time. If you do not enable this feature, deleted
items from the GUI are permanently removed from the database.
— Audit Logging: Select one of the following:
— Detailed: This is the default type. It is automatically selected. It provides detailed information on all
administrative changes such as the date and time stamp of the change, administrator name, changed
object name, and the new values of all properties.
— Brief: Provides information on administrative changes such as the date and time stamp of the change,
administrator name, and the changed object name. It does not show the new value of the object.
— In the Grid Properties editor, select the General tab -> click the Advanced tab (or click Toggle Advanced
Mode) and modify any of the following:
— Enable GUI Redirect from Member: Select this check box to allow the appliance to redirect the Infoblox
GUI from a Grid member to the Grid Master.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 325

Deploying a Grid

Note: If read-only API access is enabled for a Grid Master Candidate, then selecting the Enable GUI Redirect from
Member check box for the Grid Master Candidate does not redirect the Infoblox GUI from the Grid Master
Candidate to the Grid Master. For more information about enabling read-only API access on a Grid Master
Candidate, see Enabling Read-only API Access on the Grid Master Candidate on page 329.

— Enable GUI/API Access via both MGMT and LAN1/VIP: Select this check box to allow access to the
Infoblox GUI and API using both the MGMT and LAN1 ports for standalone appliances and MGMT and
VIP ports for an HA pair. This feature is valid only if you have enabled the MGMT port. For information
about enabling the MGMT port, see Appliance Management on page 462.

Note: The appliance uses the MGMT port only to redirect the Infoblox GUI from a Grid member to the Grid Master
even after you enable the Enable GUI/API Access via both MGMT and LAN1/VIP feature.

4. Save the configuration.

If you changed the VPN port number, time zone, date or time, Grid Manager displays a warning indicating that a
product restart is required. Click Yes to continue, and then log back in to Grid Manager after the application restarts.

Configuring Security Level Banner

You can publish a security banner that indicates the security level of the Infoblox Grid. It appears on the header and
footer of all pages of Grid Manager. The security level can be Top Secret, Secret, Confidential, Restricted, and
Unclassified. Each message type is associated with a predefined security level color. You can modify this color at any
point of time. Grid Manager automatically uses an appropriate contrasting text font color that goes with the banner
color. Only superusers can configure and enable this feature.
To configure the advanced security level banner for a Grid:
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and select Grid Properties -> Edit.
3. In the Grid Properties editor, select the Security tab -> Advanced tab.
4. Complete the following:
— Enable Security Banner: Select this to enable the display of the security banner.
— Security Level: From the drop-down list, select the security level for the banner.
— Security Level Color: The default color is displayed in the drop-down. If necessary using the drop-down list,
select the required color for the security level banner. When you change the security level, Grid Manager
resets default color for that level.
— Classification Message: Enter the message you want to display in the security banner. You can enter up to
190 characters.
5. Save the configuration.
Security banner appears on the header and footer of the Grid Manager screen including the Login screen.

Configuring Notice and Consent Banner

You can configure and publish a notice and consent banner as the first login screen that includes specific terms and
conditions you want end users to accept before they log in to the Infoblox Grid. When an end user tries to access Grid
Manager, this banner is displayed as the first screen. The user must accept the terms and conditions displayed on
the consent screen before accessing the login screen of Grid Manager. Only superusers can configure and enable this
feature.
To configure the notice and consent banner:
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and select Grid Properties -> Edit.
3. In the Grid Properties editor, select the Security tab -> Advanced tab, and then complete the following:

326 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing a Grid

— Enable Notice and Consent Banner: Select the check box to enable the display of the notice and consent
banner. In the text field, enter the message that you want to be included in the banner. The message cannot
exceed 10,000 characters.
4. Save the configuration.
This banner appears as the first screen when users access Grid Manager. Users must read the terms and
conditions and then click Accept on the consent screen before they can access the login screen of Grid Manager.

Configuring Informational Level Banner

You can publish the informational banner for multiple uses, such as to indicate whether the Infoblox Grid is in
production or a lab system. The banner can also be used for issuing messages of the day. The informational level
banner appears on the header of the Grid Manager screen. You can publish the banner information you want and set
the banner color. Grid Manager automatically uses an appropriate contrasting text font color that goes with the
banner color. Only superusers can configure and enable this feature.
To configure the advanced informational banner for a Grid:
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and select Grid Properties -> Edit.
3. In the Grid Properties editor, select the General tab -> Advanced tab
4. Complete the following:
— Enable informational GUI Banner: Select the check box to enable the display of the informational banner
message.
— Banner Color: The default color is displayed in the drop-down. If necessary using the drop-down list, select the
required color for the informational level banner.
— Message: Enter the message you want to display in the informational banner. You can enter up to 190
characters.
5. Save the configuration.
Informational banner appears on the header of the Grid Manager screen.

Configuring Recursive Deletions of Networks and Zones

Through Grid Manager, you can configure the group of users that are allowed to delete or schedule the deletion of a
network container and its child objects as well as a zone and its child objects. For information about how to delete a
network container or zone, see Deleting Network Containers on page 585 and Removing Zones on page 852.
When you select All Users or Superusers, these users can choose to delete a parent object and reparent its child
objects, or they can choose to delete a parent object and all its child objects. These options appear only if a network
container or a zone has child objects. For information about scheduling recursive deletion of network containers and
zones, see Scheduling Recursive Deletions of Network Containers and Zones on page 90.
When you select Nobody, all the users can delete the parent object only. All the child objects, if any, are re-parented.
For information about scheduling deletions, see Scheduling Deletions on page 90. Note that you can restrict specific
users to perform recursive deletions of network containers and zones only through Grid Manager. These settings do
not prevent other users from performing recursive deletions through the API.

Note: You must have Read/Write permission to all the child objects in order to delete a parent object. Recursive
deletion is applicable to all zone types except stub and forward-mapping zones.

The appliance puts all deleted objects in the Recycle Bin, if enabled. You can restore the objects if necessary. When
you restore a parent object from the Recycle Bin, all its contents, if any, are re-parented to the restored parent object.
For information about the Recycle Bin, see Using the Recycle Bin on page 73.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 327

Deploying a Grid

To configure the group of users to perform recursive deletions:

1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and select Grid Properties -> Edit.
3. In the Grid Properties editor, select the General tab -> Advanced tab.
4. Under Present the option of recursive deletion of networks or zones to, select one of the following:
— All Users: Select this to allow all users, including superusers and limited-access users, to choose whether
they want to delete the parent object and its contents or the parent object only when they delete a network
container/network or a zone. This is selected by default.
— Superuser: Select this to allow only superusers to choose whether they want to delete the parent object and
its contents or the parent object only when they delete a network container/network or a zone.
— Nobody: When you select this, users can only delete the parent object (network container or zone). All child
objects, if any, are re-parented.
5. Save the configuration.

Setting the MTU for VPN Tunnels

You can configure the VPN MTU (maximum transmission unit) for any appliance with a network link that does not
support the default MTU size (1500 bytes) and that cannot join a Grid because of this limitation. If an appliance on
such a link attempts to establish a VPN tunnel with a Grid Master to join a Grid, the appliance receives a PATH-MTU
error, indicating that the path MTU discovery process has failed. For information about the MTU discovery process,
see RFC 1191, Path MTU Discovery .
To avoid this problem, you can set a VPN MTU value on the Grid Master for any appliance that cannot link to it using
a 1500-byte MTU. When the appliance contacts the master during the key exchange handshake that occurs during
the Grid-joining operation, the master sends the appliance the MTU setting to use.
To set the VPN MTU for a Grid member:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box -> Edit icon.
2. Select the Network -> Advanced tab of the Grid Member Properties editor.
3. In the VPN MTU field, enter a value between 600 and 1500.
4. Save the configuration and click Restart if it appears at the top of the screen.

Removing a Grid Member

You might want or need to remove a member from a Grid, perhaps to disable it or to make it an independent appliance
or an independent HA pair. Before you remove a member, make sure that it is not assigned to serve any zones or
networks.
To remove a Grid member, from the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box,
and click the Delete icon.

Promoting a Master Candidate

To promote a Master candidate to a Grid Master, you must have previously designated a Grid member as a Master
Candidate. Select the Master Candidate option in the General tab of the Grid Member Properties editor to designate
the member as a Master Candidate. You can designate any member as a Master Candidate. The Grid Master
Candidate gets a complete copy of the Grid database. Therefore, Infoblox recommends that you configure the same
appliance models for the Grid Master and Grid Master Candidates. By default, Grid Master promotion uses UDP port
1194. Make sure that UDP 2114 and UDP 1194 ports are open between the Grid members and newly designated Grid
Master. During a Grid Master promotion, the newly-promoted Grid Master continuously contacts all Grid members,
including the original Grid Master on UDP port 2114 until it reaches them. It notifies all Grid members that it is the

328 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing a Grid

new Grid Master. The Grid Members restart and then attempt to establish normal Grid communications (via BloxSync)
with the newly promoted Grid Master. Before promoting a Master Candidate, check your firewall rules to ensure that
the Master Candidate can communicate with all the Grid members. For information, see Grid Communications on
page 273.
To promote a Master Candidate, you can make a direct serial connection to the console port on the active node of an
HA Candidate or to the console port on a single Candidate. You can also make a remote serial connection (using SSH
v2) to the candidate. Enter the following Infoblox CLI command to promote a Master Candidate: 
set promote_master.
You can do one of the following to promote a Master Candidate:
• Immediately notify all Grid members about the promotion.
• Set a sequential notification to provide wait time for Grid members to join the new Grid Master. Staggering the
restarts of Grid members can minimize DNS outages. The sequential order for Grid members to join the new Grid
Master begins with the old Grid Master and then the Grid members in FQDN order. The default delay time is 120
seconds. You can configure the delay time from a minimum of 30 seconds up to 600 seconds.

Note: During a Grid Master promotion, ensure that you do not designate a Grid member as a Grid Master Candidate
or promote a Master Candidate.

To promote a Master Candidate, do the following:

1. Establish a serial connection (through a serial console or remote access using SSH) to the Master Candidate. For
information about making a serial connection, see Method 2 – Using the CLI on page 336.
2. At the CLI prompt, use the command set promote_master to promote the Master Candidate and send
notifications to all Grid members immediately, or promote the Master Candidate to the Grid Master immediately
and specify the delay time for the Grid members to join the new Grid Master. For more information about the
command, refer to the Infoblox CLI Guide.
3. To verify the new master is operating properly, log in to the Infoblox Grid Manager on the new master using the
VIP address for an HA master or the IP address of the LAN1 port for a single master.
4. Check the icons in the Status column. Also, select the master, and then click the Detailed Status icon in the table
toolbar. You can also check the status icons of the Grid members to verify that all Grid members have connected
to the new master. If you have configured delay time for Grid member notification, it will take some time for some
members to connect to the new master. You can also check your firewall rules and log in to the CLI to investigate
those members.

Note: Note that when you promote the Master Candidate to a Grid Master, the IP address will change accordingly. If
you have configured a FireEye appliance, then any changes in the Grid Master IP address, FireEye zone name,
associated network view or the DNS view will affect the Server URL that is generated for a FireEye appliance.
The FireEye appliance will not be able to send alerts to the updated URL when there is a change in the IP
address. You must update the URL in the FireEye appliance to send alerts to the NIOS appliance. For more
information, see Configuring FireEye RPZs on page 1696.

Enabling Read-only API Access on the Grid Master Candidate

You can enable read-only API access on the Grid Master Candidate to provide additional scalability of read/write API
requests on the Grid Master, which in turn improves the performance of the Grid Master. The read-only API access is
disabled by default for new installations. When you enable read-only API access on an HA Grid Master Candidate, you
can access the API service only on the active node. If the API service is disabled for an admin group, the users in the
admin group cannot access read-only API service on the Grid Master Candidate, even though read-only API access is
enabled for the Grid Master Candidate. Also, the users in the admin group should have at least read-only permission
to access the API service.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 329

Deploying a Grid

Note: When you upgrade the Grid Master Candidate to NIOS 7.1 and later, read-only API access is disabled. But when
you upgrade the Grid Master Candidate from NIOS 7.1 to a later release with read-only API access enabled,
then this setting is retained after the upgrade is completed.

The appliance logs all API logins in the audit log and syslog. You can view the audit log and syslog of the Grid Master
Candidate under the Administration -> Logs tab.
To enable read-only API access on the Grid Master Candidate:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_Master_Candidate check box, and then
click the Edit icon.
2. In the Grid Member Properties editor, select the General tab -> Basic tab, and then do the following:
— Read Only API access: This field is displayed only when the Grid member is designated as a Master
Candidate. Select this check box to enable read-only API access on the Grid Master Candidate. Enabling this
check box will only allow read-only API access and not write API access. Note that if you enable this check
box, you cannot access the GUI using the IP address of the Grid Master Candidate.
3. Save the configuration.

About the Master Grid

A Master Grid provides centralized management of multiple Grids. When a Grid is managed by a Master Grid, the
Master Grid icon appears on the left side of the top panel of Multi-Grid Manager. Assuming you have permission, you
can click this icon to access Multi-Grid Manager. In addition, the Toolbar provides several functions for joining the
Master Grid, editing its properties and leaving the Master Grid. For more information about the Master Grid and these
functions, refer to the Multi-Grid Manager Administrator Guide.

330 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 6 Deploying Independent
Appliances
This chapter explains how to deploy single independent appliances and independent HA pairs. Independent
appliances run NIOS without the Grid upgrade and are deployed independently from a Grid. This chapter includes the
following sections:
• Independent Deployment Overview on page 333
— System Manager GUI on page 334
• Deploying a Single Independent Appliance on page 334
— Method 1 – Using the LCD on page 335
— Method 2 – Using the CLI on page 336
— Method 3 – Using the Infoblox NIOS Startup Wizard on page 337
— Changing the Communication Protocol for a Dual Mode Independent Appliance on page 339
• Configuration Example: Deploying a NIOS Appliance as a Primary DNS Server on page 340
— Cabling the Appliance to the Network and Turning On Power on page 341
— Specifying Initial Network Settings on page 341
— Specifying Appliance Settings on page 341
— Enabling Zone Transfers on the Legacy Name Server on page 342
— Importing Zone Data on an Independent Appliance on page 343
— Designating the New Primary on the Secondary Name Server (at the ISP Site) on page 345
— Configuring NAT and Policies on the Firewall on page 346
• Deploying an Independent HA Pair on page 346
— Using the Infoblox NIOS Startup Wizard to Configure an HA Pair on page 346
• Configuration Example: Configuring an HA Pair for Internal DNS and DHCP Services on page 350
— Cabling Appliances to the Network and Turning On Power on page 351
— Specifying Initial Network Settings on page 352
— Specifying Appliance Settings on page 352
— Enabling Zone Transfers on page 354
— Importing Zone Data on page 354
— Defining Networks, Reverse-Mapping Zones, DHCP Ranges, and Infoblox Hosts on page 354
— Defining Multiple Forwarders on page 356
— Enabling Recursion on External DNS Servers on page 357
— Modifying the Firewall and Router Configurations on page 358

NIOS 7.3 NIOS Administrator Guide (Rev. A) 331

Deploying Independent Appliances

— Enabling DHCP and Switching Service to the NIOS Appliance on page 358
— Managing and Monitoring on page 359
• Verifying the Deployment on page 360
— Single Independent Appliance on page 360
— Independent HA Pair on page 360
• Infoblox Tools for Migrating Bulk Data on page 360

332 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Independent Deployment Overview

Independent Deployment Overview

Note: Infoblox appliances support IPv4 and IPv6 networking configurations in most deployments cited in this
chapter. You can set the LAN1 port to an IPv6 address and use that address to access the NIOS UI and the NIOS
Setup Wizard. All HA operations can be applied across IPv6. You can also set a dual mode appliance by
configuring both IPv4 and IPv6 address for the LAN1 port. Topics in this and following chapters generally use
IPv4 examples. Also note that LAN2 and the MGMT port also support IPv6. DNS services are fully supported in
IPv6 for the LAN1, LAN2, MGMT and VLAN ports. DHCP services are fully supported in IPv6 for the LAN1 and
LAN2 ports. Example networks throughout this chapter use IPv4 addressing.

You can deploy the NIOS appliance as a Grid member in an Infoblox Grid or independently as a standalone
deployment. NIOS appliances support both IPv4 and IPv6 networks and you can deploy them in either IPv4, IPv6, or
dual mode (IPv4 and IPv6). Grids offer many advantages for large organizations while independent deployments can
be sufficient for smaller sites. For example, if your ISP hosts one name server to respond to external DNS queries, you
can deploy a single independent NIOS appliance as the other name server, as shown in Figure 6.1.

Figure 6.1 Single Independent Appliance as a DNS Server

The primary and secondary name

The ISP hosts a servers provide DNS protocol
Internet redundancy. If one of them cannot
secondary DNS server for
ISP the corp100.com domain. respond to a query for the corp100.com
Site
The NIOS appliance is the primary DNS
server for the corp100.com domain. It
answers queries from the Internet for DMZ
public-facing servers in the DMZ network.
Firewall

Switch domain name =

corp100.com
Internal
Network
LAN or
LAN1 Port Servers for Public Access

Using primary and secondary name servers provides DNS protocol redundancy, and configuring two DHCP servers as
DHCP failover peers provides DHCP protocol redundancy. However, you can only have hardware redundancy if you
deploy appliances in an HA (high availability) pair. Should the active node in an HA pair fail, the passive node
becomes active and begins serving data, as shown in Figure 6.2. For more information about HA pairs, see About HA
Pairs on page 282.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 333

Deploying Independent Appliances

Figure 6.2 Independent HA Pair

This is the same situation as that in Figure 6.1,

Internet
but the primary DNS server is an independent
ISP HA pair to provide hardware redundancy.
Site

Secondary Primary DNS Server

DNS Server LAN (LAN1) (Independent HA Pair) DMZ
and HA
Firewall
Active Node
If the active node fails,
the passive node
Switch
becomes active and
Internal continues serving DNS.
Network Passive

LAN (LAN1) Servers for Public Access

and HA

System Manager GUI

When you deploy an independent appliance, you use System Manager to manage the appliance. Though other
chapters in this guide contain information that assumes a Grid deployment and describes the Grid Manager GUI,
most of the configuration procedures are applicable to an independent appliance, with the following differences:
• In the Dashboard, there is no Grid Status widget, and the Members Status widget in Grid Manager is the System
Status widget in System Manager.
• Functions related to a Grid, such as joining a Grid and managing Grid licenses, do not exist in System Manager.
• The Grid related tabs and functions in Grid Manager are the system related tabs and functions in System
Manager.
• Functions related to the Members tab in Grid Manager appear in the Nodes tab or the Toolbar of another subtab
in System Manager.
For example, the following navigation path for a Grid:
• From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click HTTPS Cert ->
Download Certificate from the Toolbar.
is the following for an independent appliance:
• From the System tab, select the System Manager tab -> Nodes tab, and then click HTTPS Cert -> Download
Certificate from the Toolbar.

Deploying a Single Independent Appliance

To deploy a single independent NIOS appliance, you cable its LAN1 port to the network and change its default IP
settings so that it can connect to its surrounding IP address space. The default LAN settings are as follows:
• IP address: 192.168.1.2
• Netmask: 255.255.255.0
• Gateway: 192.168.1.1
When deploying a single independent appliance, you can use one of the following methods to set up the initial
configuration:
• Method 1 – Using the LCD
— Requirements: Physical access to a powered up NIOS appliance.
— Advantage: You do not need any other equipment.

334 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Deploying a Single Independent Appliance

• Method 2 – Using the CLI

— Requirements: A serial connection from your management system to the console port on the NIOS
appliance. You can also enable remote console access so that you can use the CLI over a network
connection. For information, see Enabling Remote Console Access on page 439.
— Advantage: You do not need to change the IP address of the management system to connect to the NIOS
appliance.
• Method 3 – Using the Infoblox NIOS Startup Wizard
— Requirements: An HTTPS connection from your management system to the LAN1 port on the NIOS
appliance.
— Advantage: The wizard provides step-by-step guidance for changing not only the IP settings for the LAN1
port, but also changing the appliance host name and admin password, setting the system clock, and—if
using NTP (Network Time Protocol)—enabling the NIOS appliance to be an NTP client.
Note that you can configure network settings using the Startup wizard any time after you have configured the
appliance. To start the wizard, from System Manager, select the System tab, and then click System Properties ->
Startup Wizard from the Toolbar.
After you configure the network settings on a single independent appliance, you can migrate data from legacy DNS
and DHCP servers to the NIOS appliance. Several tools and methods are available for migrating data and
configuration settings. For a list of the available options, see Infoblox Tools for Migrating Bulk Data on page 360.

Method 1 – Using the LCD

Some of the NIOS appliances have an LCD and navigation buttons on the front panel that allow you to view system
status and license information as well as configure network settings for the LAN1 port.

Figure 6.3 Infoblox LCD and Navigation Buttons

The LCD panel is on the

front of some of the NIOS
appliances.

Infoblox

LCD Navigation Buttons

You can deploy a single independent NIOS appliance by setting its LAN1 port IP address, netmask, and gateway
through the LCD. This is the simplest method because you do not need anything other than a physical access to the
appliance to complete the initial configuration.

Note: LCD does not support IPv6 addressing.

1. Connect the power cable from the NIOS appliance to a power source and turn on the power.
At startup, the Infoblox logo appears in the LCD on the front panel of the appliance. Then the LCD scrolls
repeatedly through a series of display screens.
2. To change the network settings for the LAN1 port, press one of the navigation buttons.
The LCD immediately goes into the input mode, in which you can enter the IP address, netmask, and gateway for
the LAN1 port.
3. Use the navigation buttons to enter an IP address, netmask, and gateway address for the LAN1 port.
4. Cable the LAN1 port of the NIOS appliance to a network as described in the installation guide that shipped with
your product.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 335

Deploying Independent Appliances

Method 2 – Using the CLI

You can use the Infoblox CLI to make an initial network configuration through the set network command. To access
the CLI, make a direct serial connection from your management system.
1. Connect a console cable from the console port on your workstation to the male DB-9 console port on the NIOS
appliance.
The DB-9 pin assignments follow the EIA232 standard. You can use one RJ-45 rollover cable and two female
RJ-45-to-female DB-9 adapters, or a female DB-9-to-female DB-9 null modem cable.

Figure 6.4 Console Connection

Male DB-9 Male DB-9

Console Port Console Port

Management NIOS
System appliance

RJ-45 Rollover Cable with

Two RJ-45-to-Female DB-9 Adapters To Power
or Source
Female DB-9-to-Female DB-9 Null Modem Cable

2. Use a serial terminal emulation program, such as Hilgraeve Hyperterminal® (provided with Windows® operating
systems), to launch a session. The connection settings are:
— Bits per second: 9600
— Data bits: 8
— Parity: None
— Stop bits: 1
— Flow control: Xon/Xoff
3. Log in to the appliance using the default username and password (admin and infoblox) .
4. At the Infoblox command prompt, enter set network to change the network settings, such as the IP address,
netmask, and gateway for the LAN1 port. You can configure either IPv4 or IPv6 address for the LAN1 port.

Note: In the following example, the variable ip_addr1 is the IP address of the LAN1 port and ip_addr2 is the IP
address of the gateway for the subnet on which you set the ip_addr1 address. Infoblox appliances support
IPv4 and IPv6 networking configurations in all deployments cited in this chapter. You can set the LAN1 port to
an IPv6 address and use that address to access the NIOS UI.

You can configure an IPv4 address for the LAN1 port as follows:
Infoblox > set network
NOTICE: All HA configuration is performed from the GUI. This interface is used only
to configure a standalone node or to join a Grid.
Enter IP address: ip_addr1
Enter netmask: netmask
Enter gateway address: ip_addr2
Configure IPv6 network settings? (y or n): y
Enter IPv6 address [Default: none]: 2001:db8:a22:a00::29
Enter IPv6 Prefix Length[Default: none]: 64
Enter IPv6 gateway [Default: none] 2001:db8:a22:a00::1
Become Grid member? (y or n): n
To avoid configuring IPv6 network settings, you can press N at the command line.

336 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Deploying a Single Independent Appliance

You can configure an IPv6 address for the LAN1 port as follows:
Infoblox > set network
NOTICE: All HA configuration is performed from the GUI. This interface is used only
to configure a standalone node or to join a grid.
Enter IP address : 2620:010A:6000:2400:0000:0000:0000:6508
Enter IPv6 Prefix Length: 64
Enter IPv6 gateway [Default: none]: 2620:010A:6000:2400:0000:0000:0000:0001
Configure IPv4 network settings? (y or n):n
Become grid member? (y or n): n
To configure IPv4 network settings, you can press Y at the command line and configure IPv4 address,
netmask, and the gateway address.
After you confirm your network settings, the Infoblox application automatically restarts.
You can press N to avoid configuring IPv6 on the command line. After you confirm your network settings, the
Infoblox application automatically restarts.
5. Cable the LAN1 port to a network. For information about installing and cabling the appliance, refer to the user
guide or installation guide that was shipped with the product.

Method 3 – Using the Infoblox NIOS Startup Wizard

When you first make an HTTPS connection to a NIOS appliance, the Infoblox NIOS Startup Wizard guides you through
the deployment options and basic network settings. You can also change the password of the superuser (admin) and
set up the system clock.
Note that you can configure network settings using the Startup wizard any time after you have configured the
appliance. To start the wizard, from Grid Manager, select the System tab, and then click System Properties -> Startup
Wizard from the Toolbar.
To make an HTTPS session to the appliance, you must be able to reach its IP address from the management system.

Note: If you have already set the IP address of the LAN1 port through the LCD or CLI so that you can reach it over the
network—and you have already cabled the appliance to the network—you can skip the first step.

1. If you have not changed the default IP address (192.168.1.2/24) of the LAN1 port through the LCD or CLI—and
the subnet to which you connect the appliance is not 192.168.1.0/24—put your management system in the
192.168.1.0/24 subnet and connect an Ethernet cable between the management system and the appliance.
2. Open an Internet browser window and enter https:// <IP address of the appliance> to make an HTTPS
connection. For information about supported browsers, see Supported Browsers on page 56.
Several certificate warnings may appear during the login process because the preloaded certificate is
self-signed and has the hostname www.infoblox.com, which may not match the destination IP address you
entered in step 1. To stop the warning messages from occurring each time you log in to Grid Manager, you can
generate a new self-signed certificate or import a third-party certificate with a common name that matches the
FQDN (fully qualified domain name) of the appliance. For information, see Managing Certificates on page 63.
3. Enter the default username and password (admin and infoblox) on the Grid Manager login page, and then click
Login or press Enter. For information, see Logging in to the GUI on page 58.
4. Read the Infoblox End-User License Agreement. If you want to participate in the Infoblox Customer Experience
Improvement Program, complete the following:
— Participate in the Infoblox Customer Experience Improvement Program: Select the check box to send
product usage data to Infoblox on a periodic basis. Infoblox uses this data to improve product functionality.
For more information about the program, see Participating in the Customer Experience Improvement
Program on page 1349.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 337

Deploying Independent Appliances

— Support ID (optional): Enter the Infoblox Support ID that was assigned to your account. It must be a number
with four to six digits. The value you enter here is also displayed in the Customer Improvement tab in the
Grid Properties editor. Infoblox includes this ID in the data report.
— Infoblox Privacy Policy: Click here to view the Infoblox privacy policy. The appliance displays the policy in a
new browser tab.
Click I Accept. The NIOS Setup wizard appears.
5. In the first screen of the NIOS Setup wizard, complete the following:
— Type of Network Connectivity: Select the type of network connectivity for the appliance from the drop-down
list:
— IPv4 and IPv6: Select this to configure a dual mode appliance.
— IPv4: Select this to configure an IPv4 appliance.
— IPv6: Select this to configure an IPv6 appliance.
— Are you configuring an HA pair or a standalone appliance?: Select Configuring a standalone appliance. To
configure an independent HA pair, see Deploying an Independent HA Pair on page 346.
6. Click Next and complete the following to configure network settings:
— Host Name: Enter a valid domain name for the appliance.
— Ports and Addresses: This table lists the network interfaces based on the type of network connectivity of
the appliance. For an IPv4 appliance, specify the network information for LAN1 (IPv4) interface and for an
IPv6 appliance, specify the network information for LAN1 (IPv6) interface. For a dual mode appliance,
specify the network information for both LAN1 (IPv4) and LAN1 (IPv6) interfaces.
Enter correct information for the following by clicking the field:
— Interface: Displays the name of the interface. You cannot modify this.
— IP Address: Type the IPv4 or IPv6 address depending on the type of interface. An IPv6 address is a
128-bit number in colon hexadecimal notation. It consists of eight 16-bit groups of hexadecimal digits
separated by colons (example: 2001:db8:0000:0123:4567:89ab:0000:cdef or
2001:db8::123:4567:89ab:0:cdef).
— Subnet Mask (IPv4) or Prefix Length (IPv6): Specify an appropriate subnet mask for IPv4 address or
prefix length for IPv6 address. The prefix length ranges from 2 to 127.
— Gateway: Type the IPv4 or IPv6 address of the default gateway depending on the type of interface. For
IPv6 interface, you can also type Automatic to enable the appliance to acquire the IPv6 address of the
default gateway and the link MTU from router advertisements.
— Port Settings: Select the port settings from the drop-down list. The list contains all the settings
supported by the hardware model. The default is Automatic. The appliance automatically detects the
port settings.
7. Click Next and complete the following to set admin password:
— Yes: To change the default password.
— No: To keep the default password. Infoblox recommends that you change the default password.
When you select Yes, complete the following:
— Password: Enter a password for the superuser admin account. The password must be a single alphanumeric
string without spaces and at least four characters long. The password is case-sensitive.
— Retype Password: Enter the same password.
8. Click Next and complete the following to configure time settings:
— Time Zone: Select the applicable time zone from the drop-down list. The default is (UTC) Coordinated
Universal Time.
— Would you like to enable NTP?:
— Select Yes to synchronize the time with external NTP servers, and then click the Add icon. Grid Manager
adds a row to the NTP Server table. Click the row and enter either the IP address (IPv4 or IPv6) or the
resolvable host name of an NTP server. You can view a list of public NTP servers at ntp.isc.org.
— Select No to specify the time settings for the appliance.

338 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Deploying a Single Independent Appliance

— Date: Enter the date in YYYY-MM-DD format. You can also click the calendar icon to select a date from
the calendar widget.
— Time: Enter the time in HH:MM:SS AM/PM format. You can also click the clock icon to select a time from
the drop-down list.
9. If you want to participate in the Infoblox Customer Experience Improvement Program, complete the following and
then click Next:
— Participate in the Infoblox Customer Experience Improvement Program: Select the check box to send
product usage data to Infoblox on a periodic basis. Infoblox uses this data to improve product functionality.
For more information about the program, see Participating in the Customer Experience Improvement
Program on page 1349.
— Support ID (optional): Enter the Infoblox Support ID that was assigned to your account. It must be a number
with four to six digits. The value you enter here is also displayed in the Customer Improvement tab in the
Grid Properties editor. Infoblox includes this ID in the data report.
— Email: Enter an email address to which Infoblox sends a copy of the usage report. The email address you
enter here is also displayed in the Customer Improvement tab in the Grid Properties editor. This is optional.
— Infoblox Privacy Policy: Click here to view the Infoblox privacy policy. The appliance displays the policy in a
new browser tab.
10. Click Next to view the summary of the configuration. Review the information and verify that it is correct. You can
change the information you entered by clicking Previous to go back to a previous step.
11. Click Finish.
The appliance restarts and disconnects Grid Manager.
In a dual mode independent appliance, the communication protocol for all the services is set to IPv4, by default. You
can change the default communication protocol for the services. For information, see Changing the Communication
Protocol for a Dual Mode Independent Appliance.

Changing the Communication Protocol for a Dual Mode Independent Appliance

You can change the default communication protocol for a dual mode appliance. You can force the appliance to use a
specific protocol for the reporting services and for services with two types of resolution (A and AAAA records), you can
set the preferred communication protocol.
To change the communication protocol for a dual mode independent appliance:
1. From the System tab, select the System Manager tab -> click System Properties from the Toolbar, and select Edit
from the drop-down list.
2. In the System Properties editor, select the Network tab -> Basic tab, and then complete the following:
— Communication Protocol Settings and Preferences: Select either IPv4 or IPv6 from the drop-down list. This
setting will force the appliance to use the specified protocol for the reporting services and this is the
preferred protocol for services with two types of resolution (A and AAAA records).
— Customized Settings: Select this and do the following:
— Always use this Communications Protocol for: Select either IPv4 or IPv6 from the drop-down list. This
setting will force the appliance to use the specified communication protocol for reporting services.
— Always prefer this Communications Protocol for: Select either IPv4 or IPv6 from the drop-down list to
specify the preferred communication protocol for the listed services which has two types of resolution
(A and AAAA records). The appliance uses the preferred protocol first for the service.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 339

Deploying Independent Appliances

Configuration Example: Deploying a NIOS Appliance as a Primary

DNS Server
In this example, you configure the NIOS appliance as a primary DNS server for corp100.com. Its FQDN (fully-qualified
domain name) is ns1.corp100.com. The interface IP address of the LAN1 port is 10.1.5.2/24. Because this is a private
IP address, you must also configure the firewall to perform NAT (network address translation), mapping the public IP
address 1.1.1.2 to 10.1.5.2. Using its public IP address, ns1 can communicate with appliances on the public network.
The FQDN and IP address of the external secondary DNS server are ns2.corp100.com and 2.2.2.2. The ISP hosts this
server. You can deploy NIOS appliance in IPv4, IPv6, or dual mode(IPv4 and IPv6), but the configuration example uses
IPv4 addresses.
The primary and secondary servers answer queries for the following public-facing servers in the DMZ:
• www.corp100.com
• mail.corp100.com
• ftp.corp100.com
When you create the corp100.com zone on the NIOS appliance, you import zone data from the legacy DNS server at
10.1.5.3.

Figure 6.5 Example 1 Network Diagram

NTP Server NAT on Firewall

Internet 10.120.3.10 1.1.1.2 –> 10.1.5.2
The device is in the Pacific
time zone (UMT-8:00) 1.1.1.5 –> 10.1.5.5
ISP
1.1.1.6 –> 10.1.5.6
External Secondary DNS Server 1.1.1.7 –> 10.1.5.7
Ethernet1 ns2: 2.2.2.2
1.1.1.1/24
www ftp
Firewall 10.1.5.5 10.1.5.7
Ethernet2
10.1.5.1/24

DMZ Network
NIOS appliance
Primary DNS 
10.1.5.0/24
To Internal Server
Network ns1: 10.1.5.2

Switch corp100.com

Legacy Primary DNS Server

ns1: 10.1.5.3 mail
(Replaced by the NIOS appliance) 10.1.5.6

The NIOS appliance is the primary DNS server for the corp100.com domain. It answers queries from the
Internet for the three public-facing servers in the DMZ network:
• www.corp100.com
• mail.corp100.com
• ftp.corp100.com

340 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Deploying a NIOS Appliance as a Primary DNS Server

Cabling the Appliance to the Network and Turning On Power

Connect an Ethernet cable from the LAN1 port of the NIOS appliance to a switch in the DMZ network and turn on the
power. For information about installing and cabling the appliance, refer to the user guide or installation guide that
ships with the product.

Specifying Initial Network Settings

Before you can configure the NIOS appliance through Grid Manager, you must be able to make a network connection
to it. The default network settings of the LAN1 port are 192.168.1.2/24 with a gateway at 192.168.1.1 (the HA and
MGMT ports do not have default network settings). To change these settings to suit your network, use either the LCD
or the console port.
In this example, you change the IP address/netmask of the LAN1 port to 10.1.5.2/24, and the gateway to 10.1.5.1.

LCD
The NIOS appliance has an LCD and navigation buttons on its front panel.
At startup, the Infoblox logo appears in the LCD on the front panel of the appliance. Then the LCD scrolls repeatedly
through a series of display screens.
1. To change the network settings from the default, press one of the navigation buttons.
The LCD immediately goes into input mode, in which you can enter the IP address, netmask, and gateway for the
LAN1 port.
2. Use the navigation buttons to enter the following information:
— IP Address: 10.1.5.2
— Netmask: 255.255.255.0
— Gateway: 10.1.5.1

Specifying Appliance Settings

When you make the initial HTTPS connection to the NIOS appliance, the NIOS Startup Wizard guides you through the
basic deployment of the appliance on your network. Use the wizard to enter the following information:
• Deployment: single independent appliance
• Host name: ns1.corp100.com
• Password: SnD34n534
• NTP (Network Time Protocol) server: 10.120.3.10; time zone: (UMT – 8:00 Pacific Time (US and Canada), Tijuana
1. Open an Internet browser window and enter https://10.1.5.2.
2. Accept the certificate when prompted.
Several certificate warnings may appear during the login process. This is normal because the preloaded
certificate is self-signed and has the hostname www.infoblox.com, which does not match the destination IP
address you entered in step 1. To stop the warning messages from occurring each time you log in to Grid
Manager, you can generate a new self-signed certificate or import a third-party certificate with a common name
that matches the FQDN (fully-qualified domain name) of the appliance. This is a very simple process. For
information about certificates, see Creating a Login Banner on page 59.
3. Enter the default username and password (admin and infoblox) on the Grid Manager login page, and then click
Login or press Enter. For information, see Logging in to the GUI on page 58.
4. Read the Infoblox End-User License Agreement, and then click I Accept to proceed. Grid Manager may take a few
seconds to load your user profile.
5. In the first screen of the NIOS Startup wizard, complete the following:
— Type of Network Connectivity: Select IPv4 from the drop-down list.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 341

Deploying Independent Appliances

— Are you configuring an HA pair or a standalone appliance?: Select Configuring a standalone appliance. To
configure an independent HA pair, see Deploying an Independent HA Pair on page 346.
6. Click Next and complete the following to configure network settings:
— Host Name: Enter ns1.corp100.com.
— Ports and Addresses: Specify the network settings for LAN1(IPv4) port.
Enter correct information for the following by clicking the field:
— IP Address: Enter 10.1.5.2 as the IPv4 address for the LAN1 port.
— Subnet Mask (IPv4) or Prefix Length (IPv6): Enter 255.255.255.0 as the subnet mask for the
LAN1(IPv4) port.
— Gateway: Enter 10.1.5.1 as the gateway of the subnet on which the LAN1 port is set.
— Port Settings: Use the default value Automatic.
7. Click Next and complete the following to set admin password:
— Would you like to set admin password?: Click Yes.
— Password: Enter SnD34n534.
— Retype Password: Enter SnD34n534 again.
8. Click Next and complete the following to configure the time settings:
— Time Zone: Select UMT – 8:00 Pacific Time (US and Canada), Tijuana from the drop-down list.
— Would you like to enable NTP?: Select Yes to synchronize the time with external NTP servers, and then click
the Add icon. Grid Manager adds a row to the NTP Server table. Click the row and enter 10.120.3.10 in the
NTP Server field.
9. Click Next to view the summary of the configuration. Review the information and verify that it is correct. You can
change the information you entered by clicking Previous to go back to a previous step.
10. Click Finish.

Enabling Zone Transfers on the Legacy Name Server

To allow the appliance to import zone data from the legacy server 10.1.5.3, you must configure the legacy server to
allow zone transfers to the appliance at 10.1.5.2.

Legacy BIND Server

1. Open the named.conf file using a text editor and change the allow-transfer statement as shown below:
For All Zones — To set the allow-transfer statement as a global statement in the named.conf file for all zones:
options {
zone-statistics yes;
directory "/var/named/named_conf";
version "";
recursion yes;
listen-on { 127.0.0.1; 10.1.5.3; };
…
allow-transfer {10.1.5.2; };
transfer-format many-answers;
};
For a Single Zone — To set the allow-transfer statement in the named.conf file for the corp100.com zone:
zone "corp100.com" in {
type master;
allow-transfer {10.1.5.2;};
notify yes;
};
2. After editing the named.conf file, restart DNS service on the appliance for the change to take effect.

342 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Deploying a NIOS Appliance as a Primary DNS Server

Legacy Windows 2000/2003 Server

1. Click Start -> All Programs -> Administrative Tools -> DNS.
2. Click + (for ns1) -> + (for Forward Lookup Zones) -> corp100.com.
3. Right-click corp100.com, and then select Properties -> Zone Transfers.
4. On the Zone Transfers page in the corp100.com Properties dialog box, enter the following:
— Allow zone transfers: Select this.
— Only to the following servers: Select this.
— IP address: Enter 10.1.5.2, and then click Add.
5. To save the configuration and close the corp100.com Properties dialog box, click OK.

Importing Zone Data on an Independent Appliance

You can import zone data from a legacy server or manually enter it. When you import both forward-mapping and
reverse-mapping zone data, the NIOS appliance automatically creates Infoblox host records if corresponding A and
PTR records are present. You can then modify the host records to add MAC addresses. However, if you only import
forward-mapping zone data, the NIOS appliance cannot create host records from just the A records. In that case,
because you cannot later convert A records to host records, it is more efficient to create the corp100.com zone, and
define host records manually.
Infoblox host records are data models that represent IP devices within the Infoblox semantic database. The NIOS
appliance uses a host object to define A, PTR, and CNAME resource records in a single object as well as a DHCP fixed
address if you include a MAC address in the host object definition. The host object prevents costly errors because
you only maintain a single object for multiple DNS records and a DHCP fixed address. Therefore, it is advantageous
to use host records instead of separate A, PTR, and CNAME records.

Note: If you only have forward-mapping zones on your legacy servers and you want to add reverse-mapping zones
and automatically convert A records to host records in the imported forward-mapping zones and create reverse
host records in corresponding reverse-mapping zones, create the reverse-mapping zones on the NIOS
appliance and then import the forward-mapping zones data. The NIOS appliance automatically converts the
imported A records to host records in the forward-mapping zones and creates reverse host records in the
reverse-mapping zones.

You also have the option of using the Data Import Wizard for loading DNS and DHCP data. For large data sets, this
option is an efficient approach. To download the Data Import Wizard, visit www.infoblox.com/import/.
In this example, when you create the corp100.com forward-mapping zone, you import zone data for the existing
corp100.com zone from the legacy server at 10.1.5.3. When you create the 1.1.1.0/24 reverse-mapping zone, you
also import the reverse-mapping zone records from the legacy server. After the appliance has both the forward- and
reverse-mapping zone data, it converts the A and PTR records to Infoblox host records.

Creating a Name Server Group

1. Open an Internet browser window, enter https://10.1.5.2, and then log in to Grid Manager using the username
admin and password SnD34n534.
2. From the Data Management tab, select the DNS tab -> Name Server Groups tab, and then click the Add icon ->
Name Server Group.
3. In the Name Server Group wizard, complete the following:
— Name: Enter Corp100 as the group name.
— Name Servers: Click the Add icon -> Primary.
— In the Add Primary section, Grid Manager displays the host name of the independent appliance. Click Add.
Grid Manager adds the independent system as the primary server.
— Click the Add icon -> External Secondary.
— In the Add External Secondary section, complete the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 343

Deploying Independent Appliances

— Name: Enter ns2.corp100.com.

— Address: Enter 2.2.2.2.
— Stealth: Clear this check box.
— Click Add. Grid Manager adds the external secondary to the name server group.
4. Save the configuration and click Restart if it appears at the top of the screen.

Creating a Forward-Mapping Zone

Note: To import zone data, you must first create a zone and save it.

1. To create an authoritative zone, from the Data Management tab, select the DNS tab -> Zones tab, and then click
the Add icon -> Authoritative Zone.
2. In the Add Authoritative Zone wizard, select Add an authoritative forward-mapping zone.
3. Click Next and complete the following:
— Name: Enter corp100.com.
— Comment: Enter DNS zone.
4. Click Next to assign a name server group to the zone.
5. Click the Zones tab, select the corp100.com check box, and then click the Edit icon.
6. In the Authoritative Zone editor, select the Name Servers tab, and then complete the following:
— Use this name server group: Select this, and then select Corp100 from the drop-down list.
7. Save the configuration and click Restart if it appears at the top of the screen.

Importing Zone Data

1. To import zone data to the corp100.com zone that you created earlier, click the Zones tab, select the
corp100.com check box, and then click Import Zone from the Toolbar.
2. In the Import Zone editor, complete the following:
— Address: Enter the IP address 10.1.5.3 from which you want to import zone data.
— Automatically create hosts from A records: Select this to enable the appliance to create host records from
the imported A records.
3. Click Import.
4. After successfully importing the zone data, click corp100.com in the Zones tab.
You can see all the imported forward-mapping zone data in the Records panel. Because you have not yet
imported the reverse-mapping zone data, most of the records appear as A records.
5. To import the reverse-mapping zone data, from the Zones tab, click the Add icon -> Authoritative Zone.
6. In the Add Authoritative Zone wizard, select Add an authoritative IPv4 reverse-mapping zone.
7. Click Next and complete the following:
— IPv4 Network: Enter 1.1.1.0.
— Netmask: Select 24 from the drop-down list.
— Comment: Enter Reverse-mapping zone.
8. Click Save & Close.
9. To assign a name server group to the reverse-mapping zone, click the Zones tab, select the 1.1.1.in-addr.arpa
check box, and then click the Edit icon.
10. In the Authoritative Zone editor, select the Name Servers tab, and then complete the following:
— Use this name server group: Select this, and then select Corp100 from the drop-down list.
11. Click Save & Close.

344 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Deploying a NIOS Appliance as a Primary DNS Server

12. To import reverse-mapping zone data, click the Zones tab, select the corp100.com check box, and then click
Import Zone from the Toolbar.
13. In the Import Zone editor, complete the following:
— Address: Enter 10.1.5.3 from which you want to import zone data.
— Automatically create hosts from A records: Select this to enable the appliance to create host records from
the imported A records.
14. Click Import.
15. After successfully importing the zone data, click 1.1.1.in-addr.arpa in the Zones tab.
You can see all the imported reverse-mapping zone data in the Records panel.
16. Click corp100.com in the Forward Mapping Zones list.
Because you have now imported both the forward- and reverse-mapping zone data, most of the records appear
as host records.
17. Finally, you must remove the ns1 host record for the legacy server (value 1.1.1.3). To remove it, select the ns1
check box (the host record for 1.1.1.3), and then click the Delete icon.

Designating the New Primary on the Secondary Name Server (at the ISP Site)
In this example, the external secondary name server is maintained by an ISP, so you must contact your ISP
administrator to change the IP address of the primary (or master) name server. (If you have administrative access to
the secondary name server, you can make this change yourself.)
Because a firewall performing NAT exists between the secondary and primary name servers, specify the NAT address
1.1.1.2 for the primary name server instead of 10.1.5.2.

Secondary BIND Server

1. Open the named.conf file using a text editor and set ns1 (with NAT address 1.1.1.2) as the primary (or master)
from which ns2 receives zone transfers in the named.conf file for the corp100.com zone:
zone "corp100.com" in {
type slave;
masters {1.1.1.2;};
notify yes;
file “/var/named/db.corp100.com”;
};
2. After editing the named.conf file, restart DNS service for the change to take effect.

Secondary Windows 2000/2003 Server

1. Click Start -> All Programs -> Administrative Tools -> DNS.
2. Click + (for ns2) -> + (for Forward Lookup Zones) -> corp100.com.
3. Right-click corp100.com, and then select Properties -> General.
4. On the General page in the corp100.com Properties dialog box, enter the following:
— Zone file name: corp100.com.dns
— IP address: Enter 1.1.1.2, and then click Add.
— In the IP Address field, select 1.1.1.3 (the NAT IP address of the legacy DNS server), and then click Remove.
5. To save the configuration and close the corp100.com Properties dialog box, click OK.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 345

Deploying Independent Appliances

Configuring NAT and Policies on the Firewall

Change the NAT and policy settings on the firewall to allow bidirectional DNS traffic to and from ns1.corp100.com and
NTP traffic from ns1.corp100.com to the NTP server at 10.120.3.10.
For example, enter the following commands on a Juniper firewall running ScreenOS 4.x or later:
set address dmz ns1 10.1.5.2/32
set address untrust ntp_server 10.120.3.10/32
set interface ethernet1 mip 1.1.1.2 host 10.1.5.2
set policy from dmz to untrust ns1 any dns permit
set policy from untrust to dmz any mip(1.1.1.2) dns permit
set policy from dmz to untrust ns1 ntp_server ntp permit
At this point, the new DNS server can take over DNS service from the legacy server. You can remove the legacy server
and unset any firewall policies permitting traffic to and from 10.1.5.3.

Deploying an Independent HA Pair

To deploy an independent HA pair, you cable the HA and LAN1, LAN1 (VLAN), or LAN2, LAN2 (VLAN) ports to the
network and configure the IP settings for these ports and the VIP address within the same subnet. For more
information about HA pairs, see About HA Pairs on page 282.
The default LAN1 or LAN2 settings are as follows:
• IP address: 192.168.1.2
• Netmask: 255.255.255.0
• Gateway: 192.168.1.1.
You can configure an HA pair using the Infoblox NIOS Startup Wizard. IPv4 and IPv6 network values are supported for
the NIOS Startup Wizard and for HA Pair configuration. The NIOS appliance MGMT port also can be configured to
support an IPv6 address.
• Requirements: HTTPS connections from your management system to the Ethernet ports on the two appliances.
• Advantage: The startup wizard provides step-by-step guidance for configuring the network settings of the VIP
address and HA and LAN1 or LAN1 (VLAN) ports on both nodes, for setting the host name, admin password, and
system clock, and—if using NTP (Network Time Protocol)—for enabling the HA pair as an NTP client.

Using the Infoblox NIOS Startup Wizard to Configure an HA Pair

When you first make an HTTPS connection to the NIOS appliance, the Infoblox NIOS Startup Wizard guides you
through various deployment options, basic network settings, and opportunities for changing the password of the
superuser admin and for setting the system clock.

Configuring the Connecting Switch

To ensure that VRRP (Virtual Router Redundancy Protocol) works properly, configure the following settings at the port
level for all the connecting switch ports (HA, LAN1, LAN1 (VLAN), LAN2, and LAN2 (VLAN)):
• Spanning Tree Protocol: Disable. For vendor specific information, search for “HA” in the Infoblox Knowledge
Base system at https://support.infoblox.com.
• Trunking: Disable
• EtherChannel: Disable
• IGMP Snooping: Disable
• Port Channeling: Disable
• Speed and Duplex settings: Match these settings on both the Infoblox appliance and switch
• Disable other dynamic and proprietary protocols that might interrupt the forwarding of packets

346 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Deploying an Independent HA Pair

Note: By default, a NIOS appliance automatically negotiates the optimal connection speed and transmission type
(full or half duplex) on the physical links between its LAN1, HA, and MGMT ports and the Ethernet ports on the
connecting switch. If the two appliances fail to auto-negotiate the optimal settings, see Modifying Ethernet
Port Settings on page 456 for steps you can take to resolve the problem.

Putting Both Nodes on the Network

1. Use one of the methods described in Deploying a Single Independent Appliance on page 334 to configure the
network settings of the LAN1 port of each node so that they are on the same subnet and you can reach them
across the network.
2. Cable the LAN1 port and the HA port on each node to the network switch.

Note: The Ethernet ports on the TE-810, TE-820, TE-1410, TE-1420, TE-2210, TE-2220, and IB-4010 appliances
are autosensing, so you can use either a straight-through or cross-over Ethernet cable for these
connections.

3. Cable your management system to the network switch.

Configuring Node 1
1. Open an Internet browser window and enter https:// <the IP address of the appliance> to make an
HTTPS connection to the first node. For information about supported browsers, see Supported Browsers on page
56.
Several certificate warnings may appear during the login process because the preloaded certificate is
self-signed and has the hostname www.infoblox.com, which may not match the destination IP address you
entered in step 1. To stop the warning messages from occurring each time you log in to Grid Manager, you can
generate a new self-signed certificate or import a third-party certificate with a common name that matches the
FQDN (fully qualified domain name) of the appliance. For information, see Creating a Login Banner on page 59.
2. Enter the default username and password (admin and infoblox) on the Grid Manager login page, and then click
Login or press Enter. For information, see Logging in to the GUI on page 58.
3. Read the Infoblox End-User License Agreement, and then click I Accept to proceed. Grid Manager may take a few
seconds to load your user profile.
4. In the first screen of the NIOS Setup wizard, complete the following:
— Type of Network Connectivity: Select the type of network connectivity from the drop-down list:
— IPv4 and IPv6: Select this to configure a dual mode HA pair.
— IPv4: Select this to configure an IPv4 HA pair.
— IPv6: Select this to configure an IPv6 HA pair.
— Select Configuring an HA pair and click Yes for the first appliance of the HA pair.
— Send HA and Grid Communication over: Select either IPv4 or IPv6. This field is displayed only when you
configure a dual mode (IPv4 and IPv6) HA pair.
5. Click Next and complete the following to configure network settings:
— Host Name: Enter a valid domain name for the node.
— HA Pair Name: Enter a name for the HA pair. The default name is Infoblox.
— Shared Secret: Enter the shared secret that both nodes use to authenticate each other when establishing a
VPN tunnel for ensuing bloxSYNC traffic. The default shared secret is test.
— Confirm Shared Secret: Enter the shared secret again.
6. Click Next and complete the following to set properties for the first node:
— Virtual Router ID: Enter the VRID (virtual router ID). This must be a unique VRID number—from 1 to 255—for
this subnet.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 347

Deploying Independent Appliances

Ports and Addresses: This table lists the network interfaces depending on the type of network connectivity.
For IPv4 HA pair, specify the network information for VIP (IPv4), Node1 HA (IPv4), Node2 HA (IPv4), Node1
LAN1 (IPv4), and Node2 LAN1 (IPv4) interfaces. For IPv6 HA pair, specify the network information for VIP
(IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6) interfaces.
For a dual mode HA pair, if you select IPv4 in the Send HA and Grid Communication over field in step 2 of
the NIOS Startup wizard, specify the network information for the following interfaces: VIP (IPv4), Node1 HA
(IPv4), Node1 LAN1 (IPv4), Node2 HA (IPv4), Node2 LAN1 (IPv4), VIP (IPv6), Node1 LAN1 (IPv6), and Node2
LAN1 (IPv6) ports. If you select IPv6 in the Send HA and Grid Communication over field in step 2 of the NIOS
Startup wizard, specify the network information for the following interfaces: VIP (IPv4), Node1 LAN1 (IPv4),
Node2 LAN1 (IPv4), VIP (IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6).
Click the empty fields and complete the following information:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Type the IPv4 or IPv6 address depending on the type of interface.
— Subnet Mask (IPv4) or Prefix Length (IPv6): Specify an appropriate subnet mask for IPv4 address or
prefix length for IPv6 address. The prefix length ranges from 2 to 127.
— Gateway: Type the IPv4 or IPv6 address of the default gateway depending on the type of interface. For
IPv6 interface, you can also type Automatic to enable the appliance to acquire the IPv6 address of the
default gateway and the link MTU from router advertisements.
— Port Settings: Select the port settings from the drop-down list. The list contains all settings supported
by the hardware model. The default is Automatic. The appliance automatically detects the port
settings.
7. Click Next and complete the following to set admin password:
— Yes: To change the default password.
— No: To keep the default password.
If you select Yes, complete the following:
— Password: Enter a password for the superuser admin account. The password cannot contain spaces and it
must be at least four characters long. The password is case-sensitive.
— Retype Password: Enter the same password.
8. Click Next and complete the following to configure time settings:
— Time Zone: Select the applicable time zone from the drop-down list. The default is (UTC) Coordinated
Universal Time.
— Would you like to enable NTP?:
— Select Yes to synchronize the time with external NTP servers. Click the Add icon. Grid Manager adds a row to
the NTP Server table. Click the row and enter either the IPv4 or IPv6 address or the resolvable host name of
an NTP server. You can view a list of public NTP servers at ntp.isc.org.
— Select No to specify a date and time.
— Date: Enter the data in YYYY-MM-DD format. You can also click the calendar icon to select a date from
the calendar widget.
— Time: Enter the time in HH:MM:SS AM/PM format. You can also click the clock icon to select a time from
the drop-down list.
9. Click Next to view the summary of the configuration. Review the information and verify that it is correct. You can
change the information you entered by clicking Previous to go back to a previous step.
10. Click Finish.

348 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Deploying an Independent HA Pair

Configuring Node 2
1. Open an Internet browser window and enter https:// <the IP address of the appliance> to make an
HTTPS connection to the second node. For information about supported browsers, see Supported Browsers on
page 56.
Several certificate warnings may appear during the login process because the preloaded certificate is
self-signed and has the hostname www.infoblox.com, which may not match the destination IP address you
entered in step 1. To stop the warning messages from occurring each time you log in to Grid Manager, you can
generate a new self-signed certificate or import a third-party certificate with a common name that matches the
FQDN (fully qualified domain name) of the appliance. For information, see Creating a Login Banner on page 59.
2. Enter the default username and password (admin and infoblox) on the Grid Manager login screen, and then click
Login or press Enter. For information, see Logging in to the GUI on page 58.
3. Read the Infoblox End-User License Agreement, and then click I Accept to proceed. Grid Manager may take a few
seconds to load your user profile.
4. In the first screen of the NIOS Setup Wizard, complete the following:
— Type of Network Connectivity: Select the type of network connectivity from the drop-down list:
— IPv4 and IPv6: Select this to configure a dual mode HA pair.
— IPv4: Select this to configure an IPv4 HA pair.
— IPv6: Select this to configure an IPv6 HA pair.
— Select Configuring an HA pair to configure an independent HA pair and click No to configure the first node of
an HA pair
5. Click Next and complete the following to configure network settings:
— HA Virtual IP address: Enter the VIP (virtual IP) address and its netmask.
— HA Pair Name: Enter a name for the HA pair. The default name is Infoblox. Ensure that you use the same
name as the first node.
— Shared Secret: Enter a text string that both nodes use as a shared secret to authenticate each other when
establishing a VPN tunnel. The default shared secret is test. This must be the same shared secret that you
entered on the first appliance.
— Show Password: Click this to display the shared secret. Clear it to conceal the shared secret.
6. Click Next, and then complete the following to set properties for the second appliance:
— IP Address: Enter the IPv4 or IPv6 address of the appliance.
— Subnet Mask: Enter the subnet mask of the appliance.
or
Prefix Length: Enter the prefix length if you have entered the IPv6 address in the IP Address field. The prefix
length ranges from 2 to 127.
— Gateway: Enter the IP address of the gateway of the subnet of the interface.
7. Click Next to view the summary of the configuration. Review the information and verify that it is correct. You can
change the information you entered by clicking Previous to go back to a previous step.
8. Click Finish.
The setup of the HA pair is complete. When you next make an HTTPS connection to the HA pair, use the VIP address.
The communication protocol for all the services in a dual mode (IPv4 and IPv6) HA appliance is the same protocol as
the one used for VRRP advertisements. For example, if you select IPv4 in the Send HA and Grid Communication Over
field on the first screen of the NIOS Setup wizard, then IPv4 is set as the communication protocol for all the services.
However, you can override the communication protocol for all the services in a dual mode HA pair. For information,
see Changing the Communication Protocol for a Dual Mode Independent Appliance on page 339.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 349

Deploying Independent Appliances

Configuration Example: Configuring an HA Pair for Internal DNS

and DHCP Services
In this example, you set up an HA pair of NIOS appliances to provide internal DNS and DHCP services. The HA pair
answers internal queries for all hosts in its domain (corp100.com). It forwards internal queries for external sites to
ns1.corp100.com at 10.1.5.2 and ns2.corp100.com at 2.2.2.2. It also uses DHCP to provide dynamic and fixed
addresses. You can deploy the HA appliance in IPv4, IPv6 or dual mode(IPv4 and IPv6), but the configuration example
uses IPv4 addresses.
The HA pair consists of two appliances (nodes). The IP addresses of the VIP (virtual IP) address of the HA pair and the
HA and LAN1 ports on each node, are as follows:

HA Pair IP Addresses
VIP 10.1.4.10 (the address that the active node of the HA pair uses)
Node 1 Node 2
• LAN1 10.1.4.6 • LAN1 10.1.4.8
• HA 10.1.4.7 • HA 10.1.4.9

The virtual router ID number for the HA pair is 150. The ID number must be unique for this network segment.
When you create the corp100.com zone on the HA pair, you import DNS data from the legacy server at 10.1.4.11.

350 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring an HA Pair for Internal DNS and DHCP Services

Figure 6.6 Example 2 Network Diagram

ftp
10.1.5.7
Internet www 77:77:77
10.1.5.5
ISP 55:55:55
NOTE: The first six External Secondary
hexadecimal characters of DNS Server
all MAC addresses in the ns2: 2.2.2.2 DMZ Network
example are 00:00:00. Only ethernet1 ethernet2
the last six hexadecimal 10.1.5.0/24
1.1.1.1/24 10.1.5.1/24
characters are shown here.
Firewall
Relay Agent on
e2 interface) ethernet3
10.1.6.2/24 External Primary
DNS Server mail
ns1: 10.1.5.2 10.1.5.6
66:66:66
MGT Network

10.1.1.0/24

10.1.1.10 - ethernet0
10.1.1.50 10.1.6.1/24
ethernet1 HA Pair Primary DNS
Address printer1 10.1.1.1/24 Server, DHCP, IPAM
Range 10.1.1.2 ns3 VIP: 10.1.4.10
aa:aa:aa
ethernet2 ethernet4
10.1.2.1/24 10.1.4.1/24 Server Network
Dev Network
10.1.4.0/24
10.1.2.0/24
10.1.2.10 -
10.1.2.50 Legacy Primary DNS Server
ns3: 10.1.4.11
(Replaced by the HA Pair) storage1 proxymail
Address printer2 10.1.4.2 10.1.4.f
Range 10.1.2.2 dd:dd:dd ff:ff:ff
bb:bb:bb storage2 proxyweb
10.1.4.3 10.1.4.5
ee:ee:ee 11:11:11

An HA pair of NIOS appliances provides internal DNS services. It answers internal queries for all hosts in its
domain. It forwards internal queries for external sites to ns1 and ns2. It also serves DHCP, providing both
dynamic and fixed addresses. For information on configuring the NIOS appliance as a primary DNS server, see
Configuration Example: Deploying a NIOS Appliance as a Primary DNS Server on page 340.

Cabling Appliances to the Network and Turning On Power

Connect Ethernet cables from the LAN1 and HA ports on both NIOS appliances to a switch in the server network and
turn on the power for both appliances. For information about installing and cabling the appliance, refer to the user
guide or installation guide that ships with the product.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 351

Deploying Independent Appliances

Specifying Initial Network Settings

Before you can configure the appliances through Grid Manager, you must be able to make a network connection to
them. The default network settings of the LAN1 port are 192.168.1.2/24 with a gateway at 192.168.1.1 (the HA and
MGMT ports do not have default network settings). To change these settings, you can use the LCD or make a console
connection to each appliance.

Node 1
Using the LCD or console port on one of the appliances, enter the following information:
— IP Address: 10.1.4.6 (for the LAN1 port)
— Netmask: 255.255.255.0
— Gateway: 10.1.4.1

Node 2
Using the LCD or console port on the other appliance, enter the following information:
— IP Address: 10.1.4.8 (for the LAN1 port)
— Netmask: 255.255.255.0
— Gateway: 10.1.4.1
After you confirm your network settings, the Infoblox GUI application automatically restarts.

Specifying Appliance Settings

When you make the initial HTTPS connection to a NIOS appliance, the Infoblox NIOS Startup Wizard guides you
through the basic deployment of the appliance on your network. To set up an HA pair, you must connect to and
configure each appliance individually.

Node 1
1. Open an Internet browser window and enter https://10.1.4.6.
2. Accept the certificate when prompted.
Several certificate warnings may appear during the login process. This is normal because the preloaded
certificate is self-signed and has the hostname www.infoblox.com, which does not match the destination IP
address you entered in step 1. To stop the warning messages from occurring each time you log in to Grid
Manager, you can generate a new self-signed certificate or import a third-party certificate with a common name
that matches the FQDN (fully-qualified domain name) of the appliance. This is a very simple process. For
information about certificates, see Creating a Login Banner on page 59.
3. Enter the default username and password (admin and infoblox) on the Grid Manager login page, and then click
Login or press Enter. For information, see Logging in to the GUI on page 58.
4. Read the Infoblox End-User License Agreement, and then click I Accept to proceed. Grid Manager may take a few
seconds to load your user profile.
5. In the first screen of the NIOS Setup wizard, complete the following:
— Type of Network Connectivity: Select IPv4 as the communication protocol from the drop-down list.
— Select Configuring an HA pair and click Yes to configure the first appliance.
— Send HA and Grid Communication over: Select IPv4 from the drop-down list for VRRP advertisements.
6. In the NIOS Startup wizard, select Configuring an HA pair. Click Yes to configure the first appliance.
7. Click Next and complete the following to configure network settings:
— Host Name: Enter ns3.corp100.com.
— HA Pair Name: Use the default name Infoblox.
— Shared Secret: Enter 37eeT1d.

352 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring an HA Pair for Internal DNS and DHCP Services

8. Click Next and complete the following to set properties for the first node:
— Virtual Router ID: Enter 150.
— Required Ports and Addresses: In the table, click the empty fields and enter the following information for
each corresponding interface in the table:
— VIP (IPv4): 10.1.4.10
— Node 1 HA (IPv4): 10.1.4.7
— Node 2 HA (IPv4): 10.1.4.9
— Node 1 LAN1 (IPv4): 10.1.4.6
— Node 2 LAN1 (IPv4): 10.1.4.8
— Subnet Mask: 255.255.255.0
— Gateway: 10.1.4.1

Note: Some fields are prepopulated by Grid Manager based on the existing configuration of the appliance. All
fields are required.

9. Click Next and complete the following to set admin password:

— Would you like to set admin password?: Click No.
10. Click Next and complete the following to configure time settings:
— Time Zone: Select UMT – 8:00 Pacific Time (US and Canada), Tijuana from the drop-down list.
— Would you like to enable NTP?: Select Yes to synchronize the time with external NTP servers, and then click
the Add icon. Grid Manager adds a row to the NTP Server table. Click the row and enter 10.120.3.10 in the
NTP Server field.
11. Click Next to view the summary of the configuration. Review the information and verify that it is correct. You can
change the information you entered by clicking Previous to go back to a previous step.
12. Click Finish.

Node 2
1. From the System tab, select the System Manager tab, and then click System Properties -> Setup Wizard from the
Toolbar.
2. In the first screen of the NIOS Setup wizard, complete the following:
— Type of Network Connectivity: Select IPv4 as the communication protocol from the drop-down list.
— Select Configuring an HA pair and click Yes for configuring node 2 of the HA pair.
3. In the NIOS Startup wizard, select Configuring an HA pair to configure an independent HA pair. Click No for
configuring node 2 of the HA pair.
4. Click Next, and then complete the following to configure network settings:
— HA Virtual IP address: Enter 10.1.4.10.
— HA Pair Name: Use the default name Infoblox.
— Shared Secret: Enter 37eeT1d.
— Show Password: Click this to display the shared secret.
5. Click Next, and then complete the following to set properties for the second appliance:
— IP Address: Enter 10.1.4.8.
— Subnet Mask: Enter 255.255.255.0.
— Gateway: Enter 10.1.4.1.
6. Click Next to view the summary of the configuration. Review the information and verify that it is correct. You can
change the information you entered by clicking Previous to go back to a previous step.
7. Click Finish.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 353

Deploying Independent Appliances

The setup of the HA pair is complete. From now on, when you make an HTTPS connection to the HA pair, use the VIP
address 10.1.4.10.

Enabling Zone Transfers

To allow the NIOS appliance to import zone data from the legacy server at 10.1.4.11, you must configure the legacy
server to allow zone transfers to the appliance at 10.1.4.10.

Legacy BIND Server

1. Open the named.conf file using a text editor and change the allow-transfer statement to allow zone transfers to
the appliance at 10.1.4.10. For a sample of the required changes to the named.conf file, see Legacy BIND Server
on page 342.
2. After editing the named.conf file, restart DNS service for the change to take effect.

Legacy Windows 2000/2003 Server

Navigate to the corp100.com Properties dialog box, and add 10.1.4.10 to the list of IP addresses to which you want
to allow zone transfers. For more detailed navigation and configuration instructions, see Legacy Windows 2000/2003
Server on page 343.

Importing Zone Data

You can import zone data from a legacy server to an independent HA pair, as described in Importing Zone Data on an
Independent Appliance on page 343. Use the following information:
• Forward-mapping zone: corp100.com
• Import zone from: 10.1.4.11
• Reverse-mapping zone: 1.1.1.0

Defining Networks, Reverse-Mapping Zones, DHCP Ranges, and Infoblox Hosts

In this task, you enter data manually. For large data sets, you have the option of using the Data Import Wizard for
loading DNS and DHCP configurations and data to make the process more efficient. To download the Data Import
Wizard, visit www.infoblox.com/import/.

Networks
You can create all the subnetworks individually (which in this example are 10.1.1.0/24, 10.1.2.0/24, 10.1.4.0/24,
and 10.1.5.0/24), or you can create a parent network (10.1.0.0/16) that encompasses all the subnetworks and then
use the Infoblox split network feature to create the individual subnetworks automatically. The split network feature
accomplishes this by using the IP addresses that exist in the forward-mapping zones to determine which subnets it
needs to create. This example uses the split network feature. For information about creating networks, see
Configuring IPv4 Networks on page 1111.
1. From the Data Management tab, select the IPAM tab, and then click Add -> Add IPv4 Network from the Toolbar.
2. In the Add Network wizard, complete the following:
— Address: 10.1.0.0
— Netmask: Use the netmask slider to select the /16 (255.255.0.0) netmask.
3. Click Next to select a server. Click the Add icon. Grid Manager displays ns3.corp100.com in the table.
4. Click Save & Close.
5. In the IPAM tab, select the 10.1.0.0/16 check box, and then select Split from the Toolbar.

354 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring an HA Pair for Internal DNS and DHCP Services

6. In the Split Network dialog box, complete the following:

— Subnetworks: Move the slider to 24.
— Immediately Add: Select Only networks with ranges and fixed addresses.
— Automatically create reverse-mapping zones: Select this check box.
7. Click OK.
The appliance creates the following 24-bit subnets for the imported Infoblox hosts:
— 10.1.1.0/24
— 10.1.2.0/24
— 10.1.4.0/24
— 10.1.5.0/24
8. From the IPAM tab, click the 10.1.1.0/24 check box, and then click the Edit icon.
9. In the DHCP Network editor, enter information in the following tabs:
General
— Comment: MGT
Server Assignment
— Add ns3.corp100.com as a server.
10. Click Save & Close.
11. To modify the other networks, repeat steps #8 – 10 for each network and use the following information:
10.1.2.0/24 Network:
— Comment: Dev
— Server Assignment: ns3.corp100.com
10.1.4.0/24 Network:
— Comment: Server
— Server Assignment: ns3.corp100.com
10.1.5.0/24 Network:
— Comment: DMZ
— Server Assignment: ns3.corp100.com

DHCP Ranges
1. From the Data Management tab, select the DHCP tab -> Networks tab -> 10.1.1.0/24, and then click Add -> DHCP
Range from the Toolbar.
2. In the Add Range wizard, complete the following:
Start: 10.1.1.10
End: 10.1.1.50
3. Click Next, and then select Server, Grid Manager displays ns3.corp100.com as the assigned member.
4. Click Save & Close.
5. In the Networks tab, click 10.1.2.0/24, and then click Add -> DHCP Range from the Toolbar.
6. In the Add Range wizard, complete the following:
Start: 10.1.2.10
End: 10.1.2.50
7. Click Next, and then select Server, Grid Manager displays ns3.corp100.com as the assigned member.
8. Click Save & Close.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 355

Deploying Independent Appliances

Infoblox Hosts
Defining both a MAC and IP address for an Infoblox host definition creates a DHCP host entry—like a fixed address—
that you can manage through the host object. To add a MAC address to each host record that the appliance created
when you imported forward- and reverse-mapping zone records:
1. From the Data Management tab, select the IPAM tab -> 10.1.1.0/24 -> 10.1.1.2.
2. In the Related Objects tab, select the check box of the host record, and then click the Edit icon.
3. In the Host Record editor, click the MAC Address field, and then enter the following:
— MAC Address: 00:00:00:aa:aa:aa
4. Click Save & Close.
5. Follow steps 1 – 4 to modify hosts with the following information:
printer2
— IP Address: 10.1.2.2
— MAC Address: 00:00:00:bb:bb:bb
storage1
— IP Address: 10.1.4.2
— MAC Address: 00:00:00:dd:dd:dd
storage2
— IP Address: 10.1.4.3
— MAC Address: 00:00:00:ee:ee:ee
proxymail
— IP Address: 10.1.4.4
— MAC Address: 00:00:00:ff:ff:ff
proxyweb
— IP Address: 10.1.4.5
— MAC Address: 00:00:00:11:11:11
www
— IP Address: 10.1.5.5
— MAC Address: 00:00:00:55:55:55
mail
— IP Address: 10.1.5.6
— MAC Address: 00:00:00:66:66:66
ftp
— IP Address: 10.1.5.7
— MAC Address: 00:00:00:77:77:77

Defining Multiple Forwarders

Because ns3.corp100.com is an internal DNS server, you configure it to forward DNS queries for external DNS name
resolution to the primary and secondary DNS servers—ns1.corp100.com at 10.1.5.2 and ns2.corp100.com at
2.2.2.2.
1. From the Data Management tab, select the DNS tab, and then select System DNS Properties from the Toolbar.
2. In the System DNS Properties editor, click the Add icon in the Forwarders tab. Grid Manager adds a row to the
table. Complete the following:
— Address: Type 2.2.2.2. Click Add again to add another forwarder.
— Address: Type 10.1.5.2.

356 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring an HA Pair for Internal DNS and DHCP Services

3. Save the configuration and click Restart if it appears at the top of the screen.
Each of the forwarders is assigned a random response time. The appliance sends the initial outbound query to the
forwarder that has the lowest response time. If the first forwarder does not reply, the appliance tries the one with the
next lowest random response time. The appliance adjusts and keeps track of the response times of the forwarders,
and uses the quicker one for future queries. If the quicker forwarder does not respond, the appliance then uses
another one.

Enabling Recursion on External DNS Servers

Because the HA pair forwards outbound queries to the two external DNS servers ns1.corp100.com (10.1.5.2) and
ns2.corp100.com (2.2.2.2) for resolution, you must enable recursion on those servers. When a DNS server employs
recursion, it queries other DNS servers for a domain name until it either receives the requested data or an error that
the requested data cannot be found. It then reports the result back to the server that queried—in this case, the
internal DNS server ns3.corp100.com (10.1.4.10), which in turn reports back to the DNS client.

Infoblox Server in the DMZ Network (ns1.corp100.com, 10.1.5.2)

1. From the Data Management tab, select the DNS tab, and then click System DNS Properties from the Toolbar.
2. In the System DNS Properties editor, select the Allow Recursion check box from the Queries tab, and then click
the Add icon -> IPv4 Address. Grid Manager adds a row to the Allow recursive queries from table. Complete the
following:
— Permission: Select Allow from the drop-down list.
— Name: Enter 10.1.1.52.
3. Save the configuration and click Restart if it appears at the top of the screen.

BIND Server at ISP Site (ns2.corp100.com, 2.2.2.2)

1. Open the named.conf file using a text editor and change the recursion and allow-recursion statements to allow
recursive queries from 1.1.1.8 (the NAT address of ns3).
options {
zone-statistics yes;
directory "/var/named/named_conf";
version "";
recursion yes;
listen-on { 127.0.0.1; 2.2.2.2; };
…
allow-recursion {1.1.1.8;};
transfer-format many-answers;
};
2. After editing the named.conf file, restart DNS service for the change to take effect.

Windows 2000/2003 Server at ISP Site (ns2.corp100.com, 2.2.2.2)

1. Click Start -> All Programs -> Administrative Tools -> DNS.
2. Right-click ns3, and then select Properties -> Advanced.
3. On the Advanced page in the ns3 Properties dialog box, clear the Disable recursion check box.
4. To save the configuration change and close the ns3 Properties dialog box, click OK.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 357

Deploying Independent Appliances

Modifying the Firewall and Router Configurations

Configure the firewall and router in your internal network to allow the following DHCP, DNS, and NTP traffic:
• To allow messages to pass from the DHCP clients in the DMZ—the web, mail, and FTP servers—to ns3 in the
Server network, configure policies and DHCP relay agent settings on the firewall.
• To forward DHCP messages from DHCP clients in the MGT and Dev networks to ns3 in the Server network,
configure relay agent settings on the router.
• To translate the private IP address of ns3 (10.1.4.10) to the public IP address (1.1.1.8) when forwarding DNS
queries from ns3 to ns2, set a MIP (mapped IP) address on the firewall.
• To allow DNS queries from ns3 to ns1 and ns2 and NTP traffic from ns3 to the NTP server, configure firewall
policies.

Firewall
For example, enter the following commands on a Juniper firewall running ScreenOS 4.x or later:
DHCP Relay Configuration
set address trust ns3 10.1.4.10/32
set interface ethernet2 dhcp relay server-name 10.1.4.10
set policy from dmz to trust ns1 ns3 DHCP-Relay permit
DNS Forwarding
set interface ethernet1 mip 1.1.1.8 host 10.1.4.10
set policy from trust to untrust ns3 ns2 dns permit
set policy from trust to dmz ns3 ns1 dns permit
NTP
set policy from dmz to untrust ns1 ntp_server ntp permit

Router
For example, enter the following commands on a Cisco router running IOS for release 12.x or later:
DHCP Relay Configuration
interface ethernet1
ip helper-address 10.1.4.10
interface ethernet2
ip helper-address 10.1.4.10

Enabling DHCP and Switching Service to the NIOS Appliance

With the Infoblox in place and the firewall and router configured for relaying DHCP messages, you can switch DHCP
service from the legacy DHCP server at 10.1.4.11 to the HA pair at 10.1.4.10 (VIP address).

Tip: To minimize the chance of duplicate IP address assignments during the transition from the legacy DHCP server
to the appliance, shorten all lease times to a one-hour length in advance of the DHCP server switch. Then, when
you take the legacy DHCP server offline, the DHCP clients quickly move to the new server when their lease
renewal efforts fail and they broadcast DHCPDISCOVER messages. To determine how far in advance you need to
shorten the lease length, find the longest lease time (for example, it might be two days). Then change the lease
length to one hour at a slightly greater interval of time before you plan to switch DNS service to the appliance
(for example, three days before the switch over). By changing the lease length this far in advance, you can be
sure that all DHCP leases will be one-hour leases at the time of the switch-over. If the longest lease length is
longer—such as five days—and you want to avoid the increased amount of traffic caused by more frequent lease
renewals over a six-day period, you can also employ a stepped approach: Six days before the switch-over,
change the lease lengths to one-day leases. Then two days before the switch-over, change them to one-hour
leases.

358 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring an HA Pair for Internal DNS and DHCP Services

1. Open an Internet browser window, enter https://10.1.4.10, and then log in to the appliance using the username
admin and password SnD34n534.
2. From the Data Management tab, select the DHCP tab, and then click Start from the Toolbar.
3. In the Start Member DHCP Service dialog box, click Yes.
The HA pair is ready to provide DHCP service to the network.
4. Take the legacy DHCP server at 10.1.4.11 offline.
When the DHCP clients are unable to renew their leases from the legacy DHCP server, they broadcast
DHCPDISCOVER messages to which the new DHCP server responds.

Managing and Monitoring

Infoblox provides tools for managing IP address usage and several types of logs to view events of interest and DHCP
and DNS data. After configuring the appliance, you can use the following resources to manage and monitor IP address
usage, DNS and DHCP data, and administrator and appliance activity.

IPAM (IP Address Management)

IPAM offers the following services:
• Simple IP address modification – Within a single IP address-centric data set, you can modify the Infoblox host,
DHCP, and DNS settings associated with that IP address.
• Address type conversion — Through IPAM functionality, you can make the following conversions:
— Currently active dynamic addresses to fixed addresses, reserved addresses, or Infoblox hosts.
— Fixed addresses to reservations or hosts.
— Reservations to hosts.
• Device classification – You can make detailed descriptions of appliances in DHCP ranges and appliances
defined as Infoblox hosts and as fixed addresses.
• Three distinct views of IP address usage – To monitor the usage of IP addresses on your network, you can see
the following different views:
— High-level overall network view: From the Data Management tab, select the IPAM tab -> member. You can
view the network usage in the Net Map or List view. You can also drill down to specific IP address to get
detailed information.
— DHCP lease history records: From the Data Management tab, select the DHCP tab -> Leases tab -> Lease
History.

Logs
The following are some useful information:
• Logs, as described in Monitoring the Appliance on page 1325.
— Audit Log – Contains administrator-initiated events.
— System Log – Contains events related to hardware and software operations.
• DNS statistics, as described in Configuring DNS Services on page 751.
— DNS Configuration – Contains DNS server settings for the Infoblox DNS server.
— Zone Statistics – Contains the results of all DNS queries per zone.
• DHCP information, as described in Configuring DHCP Properties on page 1069.
— DHCP Configuration – Contains DHCP server settings and network, DHCP range, and host settings for the
Infoblox DHCP server.
— DHCP Leases – Contains a real-time record of DHCP leases.
— DHCP Lease History – Contains an historical record of DHCP leases.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 359

Deploying Independent Appliances

— DHCP Statistics – Contains the number of currently assigned static and dynamic addresses, and the high
and low watermarks per network.
— Network Statistics – Contains the number of static hosts, dynamic hosts, and available hosts per network.

Verifying the Deployment

After you deploy a single independent appliance or HA pair, you can make an HTTPS connection to it, log in, and check
its status.

Single Independent Appliance

From the Dashboard, check the appliance status in the System Status widget. For information, see Member Status
(System Status) on page 147.
• If the Status icon is green, the appliance has a network connection and is operating properly.
• If the Status icon is red, there is a problem. To determine what it is, look at the system log file for this appliance
by selecting the Administration tab -> Logs tab -> Syslog.

Independent HA Pair
1. Make an HTTPS connection to the VIP address of the HA pair, log in, and check the status of both nodes.
2. From the Dashboard, check the appliance status in the System Status widget. For information, see Member
Status (System Status) on page 147.
— If the Status icon is green, both nodes have connectivity with each other and are operating properly.
— If the Status icon is yellow, the two nodes are in the process of forming an HA pair.
— If the Status icon is red, the passive node is offline or there is a problem. To determine what it is, look at the
system log file by selecting the Administration tab -> Logs tab -> Syslog. You can also gather information
from the System tab -> System Manager tab. For information, refer to the online Help.

Infoblox Tools for Migrating Bulk Data

Typically, the next step after cabling a single independent appliance to a network and configuring its network
settings—or cabling two independent appliances to a network and configuring them as an HA pair—is to import data
from legacy DNS, DHCP, and TFTP servers. Infoblox provides several tools to accomplish this:
• The CSV import feature allows you to import DNS, DHCP, and IPAM data through Grid Manager. You can add,
overwrite, or merge data using this feature. The appliance updates the database based on import settings and
the data you specify in the data files. From the Data Management tab of Grid Manager, you can access the
Import Manager editor from which you start a data import. You can also export existing data to a CSV file. You
can use this file to modify data, and then re-import the data into the database using the CSV import feature. For
information, see About CSV Import on page 101.
• The Infoblox Data Import Wizard is a useful tool that simplifies the importation of DNS, DHCP and IPAM, and
TFTP settings and data into a NIOS appliance. For large data sets, this option is an efficient approach. To
download the Data Import Wizard, visit www.infoblox.com/import/.
• For smaller DNS data sets, you can use the zone import feature, which allows you to import data on a per-zone
basis (seeImporting Zone Data on page 849).

360 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 7 Deploying Cloud Network
Automation
With valid licenses installed, you can configure Cloud Platform Appliances in your Grid to provide DNS and DHCP
services for virtual machines and network devices deployed through a CMP (Cloud Management Platform). To deploy
a Grid that contains cloud members, it is important to understand the required components, how to configure the
members to enable Cloud Network Automation, and which cloud API objects are supported.
This chapter contains the following sections:
• Introduction to Cloud Network Automation on page 362
— Licensing Requirements on page 364
— Licensing Configurations on page 365
— Administrative Permissions on page 366
— Supported Cloud Platform Appliance Models on page 367
— Setting Up Cloud Network Automation on page 368
• About Cloud API Service on page 368
— Starting the Cloud API Service on page 369
— Monitoring Cloud API Service on page 369
— Cloud API Request Process on page 370
— Supported Cloud API Objects on page 370
— Proxying Cloud API Requests on page 374
• About Authority Delegation on page 376
— Guidelines for Delegating Authority on page 377
— Delegating Authority for Cloud Objects on page 378
• Configuring Grid and Member Cloud API Properties on page 385
• Extensible Attributes for Cloud Objects on page 386
• Viewing Cloud Objects on page 388
— Viewing All Tenants on page 389
— Viewing All Cloud Networks on page 391
— Viewing All Cloud VMs on page 392
— Viewing All Cloud Platform Members on page 393

NIOS 7.3 NIOS Administrator Guide (Rev. A) 361

Deploying Cloud Network Automation

Introduction to Cloud Network Automation

The Infoblox Cloud Network Automation solution automates IPAM (IP address management) for physical and virtual
network devices on your CMP (whether it is private, public, or hybrid). Instead of manually provisioning IP addresses
and DNS name spaces for network devices and interfaces, you can use Cloud Network Automation to leverage DNS
and DHCP features of the Grid to manage your cloud networks. When your cloud consists of a large number of servers
and VMs (virtual machines) that have multiple associated network interfaces, manually provisioning and
de-provisioning IP addresses and managing DNS and DHCP data can become error-prone. Utilizing Cloud Network
Automation can minimize human errors by streamlining IPAM, improve visibility of your cloud networks, and
maximize the flexibility and efficiency that virtualization offers in your cloud environment.
To maximize the capability of Cloud Network Automation, ensure that you understand the operations of Cloud
Network Automation and how to deploy necessary components to suit your network topology and CMP. For detailed
information about the Cloud Network Automation operations, see Cloud Network Automation Operations.

Cloud Network Automation Operations

Figure 7.1 shows the basic concept and operations of Cloud Network Automation, which includes two major
components: the Grid Master that has a Cloud Network Automation license installed and one or more Cloud Platform
Appliances that provide the ability to process API requests. Instead of sending all API requests to the Grid Master, you
can send requests directly to the Cloud Platform Appliances. The Cloud Network Automation license installed on the
Grid Master enables visibility and reporting on cloud tenants, VM IP addresses, and DNS record allocation. This
license can be used in conjunction with Cloud Platform Appliances to provide local survivability and additional
scalability of cloud API requests within individual data centers, or it can be used with an existing Grid Master servicing
all cloud API requests.
A Cloud Platform Appliance is a Grid member designed and dedicated to accept and process WAPI (RESTful API)
requests related to cloud objects, in addition to serving DNS and DHCP protocols. You can deploy multiple Cloud
Platform Appliances within your Grid to scale the processing of API requests or to provide redundancy. Cloud Platform
Appliances include built-in HTTPS proxy capability that redirects cloud API requests to the appropriate Cloud Platform
Appliance or to the Grid Master for processing. In other words, cloud API requests can be sent to any of the Cloud
Platform Appliances within the Grid and the call is either processed locally or transparently forwarded to the
appliance that is authoritative for the object referenced in the cloud API request. For information about supported
Cloud Platform Appliances and their specifications, see Supported Cloud Platform Appliance Models on page 367.
Once you have installed the Cloud Platform license on the appliance, fixed address configuration takes effect
immediately by default and no DHCP service restart is required on the Cloud Platform Appliance. For information
about this feature, see Configuring Fixed Addresses without Restarting DHCP Service on page 1073. You can also add
and delete IPv4 and IPv6 fixed addresses, reservations, and host records within any delegated IP address ranges
through Grid Manager (the Infoblox GUI), in addition to using cloud API calls. For more information, see Managing
IPv4 DHCP Data on page 1107 and Managing IPv6 DHCP Data on page 1159.
On the CMP, you can either deploy a cloud adapter and use it as the cloud API client for sending cloud API requests
to the Cloud Platform Appliances, or you can customize your CMP to make cloud API requests directly to Cloud
Platform Appliances or to the Grid Master. The cloud adapter can be configured to send API requests always to a
single Cloud Platform Appliance or to different Cloud Platform Appliances to handle situations where the primary
Cloud Platform Appliance may not be available or to distribute API load among multiple Cloud Platform Appliances.
Infoblox Cloud Network Automation supports the following cloud adapters: Infoblox IPAM Plug-In for VMware,
OpenStack Adapter, and AWS (Amazon Web Services) API Proxy. For information about the IPAM Plug-In for VMware
and OpenStack Adapter, refer to their respective Quick Start Guides. For information about the AWS API Proxy and
how to set up AWS configurations, refer to the Infoblox Installation Guide for vNIOS for AWS.
In order to distribute API processing and provide additional scalability both for updating APIs and serving DNS and
DHCP protocols, Cloud Network Automation enables you to delegate specific sets of IPAM, DNS, and DHCP data to
one or more Cloud Platform Appliances. Once authority for an object or set of objects has been delegated to a Cloud
Platform Appliance, cloud API requests to create, modify, or delete objects under the scope of delegation for that
appliance are processed locally and available immediately for serving DNS and DHCP to VMs within the cloud. This
eliminates the need to send requests to the Grid Master to create, modify, or delete objects within the Grid. Changes

362 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Introduction to Cloud Network Automation

made to objects on individual Cloud Platform Appliances are synchronized with the Grid Master in near real time
using Grid replication to provide centralized visibility while retaining distributed processing capability. If a Cloud
Platform Appliance is not authoritative for the object referenced in the cloud API requests, it automatically proxies
that request to the Cloud Platform Appliance that is authoritative for the object or to the Grid Master (if it is
authoritative for the object). Similarly, cloud API requests made to the Grid Master are proxied to the authoritative
Cloud Platform Appliance or processed locally on the Grid Master if it is authoritative for the object. For information
about authority delegation for supported objects, see About Authority Delegation on page 376. For information
about proxying cloud API requests, see Proxying Cloud API Requests on page 374.
Cloud API requests are processed through the cloud API service that operates on the Cloud Platform Appliance. This
service can also be enabled on the Grid Master as well as other Cloud Platform Appliances. The cloud API service is
HTTPS-based; therefore, to ensure that the cloud API service functions properly, port 443 for HTTPS connectivity must
be open between the CMP and each Cloud Platform Appliance and/or the Grid Master receiving the cloud API
requests. To ensure that the proxying function works properly, port 443 for HTTPS must be open bi-directionally
between each of the Cloud Platform Appliances as well as between each Cloud Platform Appliance and the Grid
Master. You must also configure your firewalls and ACLs accordingly. Note that this service uses the VIP address on
each Infoblox appliance as the destination address.
All objects created, modified, or deleted by the cloud adapter are reflected in the NIOS database. You can view cloud
objects and their associated data in the Cloud tab of Grid Manager if the Cloud Network Automation license is
installed on the Grid Master. For more information, see Viewing Cloud Objects on page 388. Note that it is possible
to use Cloud Platform Appliances without deploying the Cloud Network Automation license. However, without the
Cloud Network Automation license, VM and tenant information is only displayed as extensible attributes associated
with IPAM, DHCP, and DNS objects in Grid Manager rather than in separate tables under the Cloud Tab.
Before you can send cloud API requests to a Cloud Platform Appliance or the Grid Master, you must create admin
groups that have cloud API access. Only admin users that have cloud API access and applicable permissions may be
used for sending cloud API requests. If the Cloud Network Automation license is installed on the Grid Master, it is also
possible to assign Tenant permissions to admin users to restrict these users to only be able to view objects related
to a given tenant or a set of tenants. For information about admin groups and how to manage admin users, see
Managing Administrators on page 183.
Note that there is no current capability to bi-directionally synchronize NIOS data with CMP data. Therefore, cloud
information in NIOS is accurate only up to the point when specific cloud API requests are received by the Cloud
Platform Appliance from an adapter running on a CMP. Only cloud information obtained through API requests to the
Infoblox API service will be available in NIOS.

Note: Unlike standard WAPI requests, all cloud API related events are logged to the NIOS syslog instead of the NIOS
audit log.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 363

Deploying Cloud Network Automation

Figure 7.1 Cloud Network Automation

2 The cloud adapter sends the 3 The Cloud Platform Appliance

corresponding cloud API processes the API request. If it is not
request to the Cloud Platform authoritative for objects referenced in
Appliance through the cloud the request, it proxies the request to
API service. the Grid Master or another Cloud
Platform Appliance, depending on the
Cloud Adapter authority delegation.
(API Client)
Cloud Grid Master

HTTPS NIOS
Connectivity Database
Cloud
Administrator Cloud
Platform
Appliance
1 The Cloud administrator makes a HTTPS
change to the cloud such as Connectivity
creating a network or a new VM. Grid
Cloud
Platform
Note: To ensure that the cloud API service is Appliance
functioning properly, open up port 443 for Cloud Platform
HTTPS connectivity and configure your Appliance
firewalls accordingly.

Licensing Requirements
To enable Cloud Network Automation, you must install valid licenses on the Grid Master and Cloud Platform Appliance
members. Depending on your deployment scenarios, you can take advantage of Elastic Scaling to automatically
deploy virtual cloud appliances, either inside or outside your CMP. For more information about Elastic Scaling and
how to use it, see About Elastic Scaling on page 486.
The following valid licenses are part of the Cloud Network Automation solution:
— Cloud Network Automation license on the Grid Master and Grid Master Candidate
— Cloud Platform license on the Cloud Platform Appliances
The license you install on the Grid Master enables the Cloud user interface functions in Grid Manager and Tenant
permissions. The license you install on the Cloud Platform Appliance enables the cloud API service on the Cloud
Platform Appliance.
Note that it is possible to use the Cloud Network Automation solution only with the Cloud Network Automation license
or with one or more Cloud Platform Appliances. In the case when only the Cloud Network Automation license is
installed on the Grid Master, all cloud API requests are sent to the Grid Master instead of to individual Grid members.
Creation of cloud objects through cloud API requests is visible in the Cloud tab of Grid Manager on the Grid Master.
When Cloud Platform Appliances are used without the Cloud Network Automation license, cloud API requests are
sent either to the Cloud Platform Appliances or to the Grid Master. However, the Cloud tab in Grid Manager is not
available on the Grid Master for viewing cloud objects created through cloud API requests.
You can also use the CLI command set temp_license to generate and install temporary licenses. This provides
licensed features and functionality for the interim, while you wait for your permanent licenses to arrive. For
information about how to install a temporary license, see Adding Temporary Licenses on page 483. Note that the
temporary license is only effective on the Grid Master, not the Grid Master Candidate.

364 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Introduction to Cloud Network Automation

For an HA pair, ensure that you use the same appliance models for both nodes and install the Cloud Platform license
on both nodes as well. For information about supported models, see Supported Cloud Platform Appliance Models on
page 367. If a failover occurs and the passive node does not have a valid license, the cloud API service will stop and
all resource delegations to the Cloud Platform Appliance will also stop.
Note that the Cloud Network Automation license on the Grid Master is incompatible with the following licenses:
— Multi-Grid Manager
— Reporting
Cloud Platform licenses are only supported on Cloud Platform Appliances. They may not be installed on any other
Infoblox physical or virtual appliances. The following licenses and functionality are not supported on the Cloud
Platform Appliances:
— Microsoft Management
— Multi-Grid Management
— Network Insight
— Reporting
— Tiered DNS Cache Acceleration
— DNS Cache Acceleration
— Load Balancing
— Infoblox External DNS Security
— RIR (Regional Internet Registry)
Before you install or remove the Cloud Platform license, consider the following:
• Installing or removing the Cloud Platform license stops the cloud API service.
• When you remove the Cloud Platform license from the appliance, it still serves DNS and DHCP if those
licenses are installed on the appliance. However, the appliance will no longer be able to run the cloud API
service. In addition, you cannot delegate authority to this member for objects that have not already been
delegated to this appliance. Existing delegations to this member remain in the NIOS database, but API
requests proxied from other Cloud Platform Appliances or from the Grid Master will fail.

Licensing Configurations
Depending on your Grid configuration and how you want to deploy Cloud Network Automation, Infoblox supports the
following licensing configurations. For information about cloud licenses and how to install them, see Licensing
Requirements on page 364.
• In an Infoblox Grid, the Grid Master has the Cloud Network Automation license installed and the Cloud
Platform Appliance has the Cloud Platform license installed: The Grid Master can process both regular
RESTful API and cloud API requests and the Cloud Platform Appliance can process cloud API requests. With
the Cloud Platform license installed, cloud API requests can be proxied among the Grid Master and Cloud
Network Appliances based on the delegation authority of the referenced objects. You can also manage the
cloud API service and cloud objects through the Cloud tab in Grid Manager
• In an Infoblox Grid, the Grid Master does not have the Cloud Network Automation license installed but the
Cloud Platform Appliance has the Cloud Platform license installed: The Grid Master can process both
regular RESTful API and cloud API requests and the Cloud Platform Appliance can process cloud API
requests. With the Cloud Platform license installed, cloud API requests can be proxied among the Grid
Master and Cloud Network Appliances based on the authority delegation of the referenced objects. Without
the Cloud Network Automation license however, only objects whose authority has been delegated to Cloud
Platform Appliances can be managed through Grid Manager. You will not have visibility of cloud objects,
such as tenant information, through Grid Manager because the Cloud user interface function (the Cloud
tab) is not available without the Cloud Network Automation license. You may manage cloud objects and
their respective data through cloud API requests.
• In an Infoblox Grid with other Grid members but without Cloud Platform Appliances, the Grid Master has the
Cloud Network Automation license installed: The Grid Master can process both regular RESTful API and
cloud API requests. You can also manage cloud objects through the Cloud tab in Grid Manager.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 365

Deploying Cloud Network Automation

• Standalone Grid Master with the Cloud Network Automation license installed: The appliance can process
both regular RESTful API and cloud API requests. You can also manage the cloud API service and cloud
objects through the Cloud tab in Grid Manager.
• Standalone Grid Master without the Cloud Network Automation license installed: The appliance can
process only regular RESTful API requests, but not cloud API requests. You cannot manage the cloud API
service nor cloud objects through Grid Manager because the Cloud user interface function (the Cloud tab) is
not available.
The following table summarizes the supported licensing scenarios:

Supports Supports Cloud API

Cloud Network Cloud Platform Regular Calls on Grid Master Cloud User
Automation License on RESTful API and/or Cloud Interface
License on Cloud Platform Calls on Grid Platform Function in
Grid Master Appliance Master Appliance(s) Grid Manager

Infoblox Grid with Cloud

Platform Appliance(s)     
Infoblox Grid with Cloud
Platform Appliance(s)     
Infoblox Grid with other
Grid members but
without Cloud Platform
Appliance(s)  N/A   
Standalone Grid Master  N/A   
Standalone Grid Master  N/A   

Administrative Permissions
You must define admin users and their permissions in the admin group and assign specific roles to it before you can
use these admin users to send cloud API requests. You can also define object permissions to specific admin groups
or admin users so they can manage specific objects through cloud API requests. For more information, see About
Admin Accounts on page 186 and About Admin Groups on page 188.
Depending on where a cloud API request is sent and whether the scope of delegation for an object is explicit or
implicit, permissions configured for the admin user and object may or may not apply. In addition, depending on the
objects referenced in cloud API requests, specific restrictions may apply. For supported objects and their restrictions,
see Supported Cloud API Objects on page 370.
For cloud API requests, admin permissions are applied based on the delegation status of the objects referenced in
the requests. If an object is not delegated (owned by the Grid Master) and the cloud API request is sent directly to the
Grid Master or proxied to the Grid Master, all applicable admin and object permissions apply. On the other hand, if
authority for an object referenced in a cloud API request is explicitly delegated to a Cloud Platform Appliance and the
request is sent to this appliance, the admin user has full permission for this object within the scope of delegation. In
this case, specific permissions configured for the admin user and the referenced object are ignored. For more
information about admin and object permissions, see About Administrative Permissions on page 195.
It is important to note that once you delegate authority of an object to the Cloud Platform Appliance, specific admin
and object permissions are not enforced. Therefore, if you do not want certain objects to be created or modified
through a cloud API request, do not delegate the authority of these objects and their parent objects to a Cloud
Platform Appliance. For example, if you do not want host records to be created through cloud API requests, do not
delegate the authority of the relevant networks, zones, or both to the Cloud Platform Appliance.
On the other hand, if you want the ability to restrict permissions for specific objects referenced in cloud API updates,
you can create different admin groups or admin users that are authorized to make cloud API updates on respective
Cloud Platform Appliances. The following example illustrates this capability.

366 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Introduction to Cloud Network Automation

Configuration Example
If you want to restrict the creation and modification of records for networks 10.10.10.0/24 and 10.10.20.0/24
through cloud API updates, do the following:
1. Create two admin users APIUser1 and APIUser2 in an admin group.
2. Delegate the authority of network 10.10.10.0/24 to Cloud Platform Appliance 1 (CP1) and 10.10.20.0/24 to
Cloud Platform Appliance 2 (CP2).
3. On CPI, add APIUser1 and on CP2, add APIUser2 to the list of administrators that can send cloud API
requests, as described in Configuring Grid and Member Cloud API Properties on page 385.
Now when you use APIUser1 to send cloud API requests, you can add and modify records for network
10.10.10.0/24, but you cannot do so for network 10.10.20.0/24. Conversely, you can add and modify records for
network 10.10.20.0/24 only when you use APIUser2.

Supported Cloud Platform Appliance Models

The following table lists the Infoblox vNIOS virtual appliances that you can use as Cloud Platform Appliances. A Cloud
Platform Appliance can only be configured as a Grid member, not a standalone appliance. To configure an HA pair,
you must use the same vNIOS models for both the active and passive nodes. For information about HA pairs, see
About HA Pairs on page 282.

Note: Cloud Platform Appliances do not support auto-provisioning. Pre-provisioning is supported for DNS and DHCP
data. For information about pre-provisioning Cloud Platform Appliances, see Pre-Provisioning NIOS and vNIOS
Appliances on page 309.

Table 7.1 Supported Cloud Platform Appliances

Virtual CPU Core

vNIOS Appliance Storage (GB) # of CPU Cores Frequency Memory Allocation

CP-V800 160 2 2000 MHz 2 GB

CP-V1400 160 4 6000 MHz 8 GB
CP-V2200 160 4 12000 MHz 12 GB

NIOS 7.3 NIOS Administrator Guide (Rev. A) 367

Deploying Cloud Network Automation

Setting Up Cloud Network Automation

To set up Cloud Network Automation, ensure that you understand the required components, licenses, and firewall
configuration, as described in Cloud Network Automation Operations on page 362. You also need to understand
what a Grid is and how to set up a Grid and deploy vNIOS appliances. For more information, see Introduction to Grids
on page 271.
Following are high-level steps for setting up Cloud Network Automation:
1. Evaluate your network topology and IPAM requirements, and then decide how you want to set up your Grid in the
cloud environment. Based on your requirements, install and configure a cloud adapter that supports Cloud
Platform Appliances on your CMP. This adapter functions as the cloud API client. For information about how to
install and configure the cloud adapter, refer to the Quick Start Guide for the cloud adapter you are deploying,
available on the Infoblox Support site. If you are implementing Cloud Network Automation in your Amazon VPCs
(Virtual Private Clouds), refer to the Infoblox Installation Guide for vNIOS for AWS.
2. Obtain valid licenses through your Infoblox representatives. Note that Cloud Platform licenses may only be
installed on cloud virtual appliances. They may not be installed on physical or virtual Trinzic Enterprise
appliances. Deploy the Cloud Platform Appliances and install the Cloud Platform license along with the
Enterprise, vNIOS, DHCP, and DNS licenses included in the license bundle for the Cloud Platform Appliance. If you
plan to use the Cloud user interface functionality on the Grid Master, obtain a Cloud Network Automation license
for your Grid Master and Grid Master Candidate. For information about how to obtain and install licenses, see
Managing Licenses on page 478.
If you are implementing Cloud Network Automation in AWS, consider Elastic Scaling to see if it better fits your
business needs when you purchase your licenses. You can purchase multiple dynamic licenses and
automatically pre-provision vNIOS cloud appliances according to your business needs. For information about
Elastic Scaling, see About Elastic Scaling on page 486.
3. If the Cloud Platform Appliance is not part of the Grid, join it to the Grid. For more information about how to join
a member to the Grid, see Joining Appliances to the Grid on page 302. If you have implemented Elastic Scaling,
ensure that you follow the necessary steps to automatically provision your vNIOS cloud appliances and join them
to the Grid. For more information, see Using Elastic Scaling to Pre-provision and Launch vNIOS Members on page
486.
4. Log in to Grid Manager and complete the following:
— Start the cloud API service on the Cloud Platform Appliance, as described in Starting the Cloud API Service
on page 369. The cloud API service is disabled by default.
— Define admin groups and admin permissions for Cloud Network Automation, as described in About Admin
Accounts on page 186 and About Admin Groups on page 188.
— Control which users can send API requests, as described in Configuring Grid and Member Cloud API
Properties on page 385.
— Add global and object permissions for admin users who can manage cloud objects, as described in
Managing Permissions on page 205.
You can now start sending API requests through the cloud adapter or AWS API Proxy. To understand the API request
process and the supported API objects, see About Cloud API Requests on page 369.

About Cloud API Service

The cloud API service provides the ability to automate management of IP addresses and DNS records so your cloud
environment can take full advantage of IPAM, DNS, and DHCP capabilities in NIOS without the need for manual
intervention. This service is supported for the following scenarios:
• Communication between the cloud adapter (acting as an API client) and the Cloud Platform Appliance or
between Cloud Platform Appliances. This cloud API service accepts and processes a subset of the WAPI
requests that are currently supported on the Grid Master either directly from an adapter or proxied through
another Cloud Platform Appliance or from the Grid Master.

368 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Cloud API Requests

• Communication between the cloud adapter and the Grid Master, or between Cloud Platform Appliances and
the Grid Master. This cloud API service processes requests received directly from the cloud adapter or
processes requests received by other Cloud Platform Grid members.
The admin users that you use to send cloud API requests must have applicable access to the cloud API in order for
the API requests to be processed. For information about admin groups, see Managing Admin Groups and Admin Roles
on page 193.

Starting the Cloud API Service

To start the cloud API Service:
1. From the Grid tab, select the Services tab -> cloud_member check box.
2. Click Cloud API on the top navigation bar, and then click Start from the Toolbar.

Monitoring Cloud API Service

To monitor the status of the cloud API service, from the Cloud tab, select the Members tab -> cloud_member link. Grid
Manager displays the service status, as described in Service Status on page 1333.
You can also monitor the cloud API service through the following:
• View the cloud API service through the Member service status, as described in Member Status on page 1326.
• Configure the appliance to receive SNMP traps for the cloud API service, as described in Monitoring with SNMP
on page 1363.
• View Cloud Statistics widget on the Dashboard, as described in Cloud Statistics on page 162.
• Review event messages in the syslog, as described in Viewing the Syslog on page 1341.

About Cloud API Requests

In your cloud environment, the cloud adapter acts as the cloud API client. Only API requests made by admin users
who have the correct permissions on the cloud API ACL (Access Control List) are processed by the cloud API service.
When the Cloud Platform Appliance receives a cloud API request, it processes the request based on authority
delegation of the objects and respective cloud extensible attributes. For information about cloud extensible
attributes, see Extensible Attributes for Cloud Objects on page 386. If the Cloud Platform Appliance is not
authoritative for the referenced objects, it proxies the request to the authoritative appliance that can be another
Cloud Platform Appliance or to the Grid Master if no authority delegation is defined. For information about proxying
cloud API requests, see Proxying Cloud API Requests on page 374.

Note: For the cloud API service to function properly, configure your networks and firewalls accordingly to allow port
443 HTTPS connectivity between the cloud adapter and Cloud Platform Appliance, between the cloud adapter
and the Grid Master (if applicable), between the Grid Master and Cloud Platform members, and between each
Cloud Platform member.

If you are using the AWS API Proxy to send API requests, ensure that you understand how to set up and configure the
proxy. For detailed information, refer to the Infoblox Installation Guide for vNIOS for AWS.
When implementing Cloud Network Automation in AWS, you can use Elastic Scaling to allocate and deallocate
dynamic licenses and automatically spin up vNIOS Grid members and join them to the Grid. You can purchase and
install NIOS feature licenses in advance and store them in a license pool container on the Grid Master. You can then
decide when and how to automatically provision and configure vNIOS for AWS cloud virtual appliances. When you
remove a vNIOS cloud appliance, the licenses on this appliance are released and returned to the license pool and are
available for the next deployment. For more information about Elastic Scaling, see About Elastic Scaling on page 486.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 369

Deploying Cloud Network Automation

Cloud API Request Process

As described in Table 7.2, all cloud API requests are subject to the following process before responses are returned.
The appliance

Table 7.2 Cloud API Request Process

Configuration that affects the

Steps Descriptions outcome of this step
Authentication and All cloud API requests are authenticated based on the Define admin user accounts that can be
categorization authentication sources. Once authenticated, the used to send cloud API requests.
requests are categorized as either a cloud API request or For information, see Managing Admin
not. All requests that specify user identity as users Groups and Admin Roles on page
defined in admin groups with cloud API access are 193.
categorized as cloud API requests.
Authorization All cloud API requests are subject to authorization based Define ACLs on the Grid Master or Cloud
on the ACLs (Access Control Lists) defined for the Grid or Platform Appliance.
Cloud Platform Appliance. You can control which admin For information, see Configuring Grid
accounts can be used to send API requests. The ACLs can and Member Cloud API Properties on
contain admin users in admin groups with cloud API page 385.
access or remote authenticated users.
Proxying Requests If a Cloud Platform Appliance is not authoritative for a Ensure that HTTPS connectivity
cloud API request, it proxies the request either to the between each Cloud Platform member
authoritative Cloud Platform Appliance or to the Grid and between each Cloud Platform
Master for processing. Similarly, if an object has been member and the Grid Master is
delegated and the API request is made to the Grid functioning properly for proxying.
Master, the Grid Master proxies that request to the For information, see Proxying Cloud API
authoritative Cloud Platform Appliance. Requests on page 374.
Validation NIOS performs a final validation on the cloud API request Define admin permissions for admin
based on permissions configured for the admin users groups with cloud API access.
and restrictions for the applicable objects. If the request For information, see About Admin
is processed within the scope of an explicit delegation, Groups on page 188.
the admin user is considered to have full permissions
within the scope, and any permission defined for admin
groups with cloud API access is ignored. Otherwise, the
request is subject to validation for all permissions
defined for admin groups with cloud API access.
Auditing Cloud API related events are logged to the NIOS syslog of Configure syslog server for the cloud
the Grid member that processes the API requests instead member.
of to the NIOS audit log. For information, see Viewing the
Syslog on page 1341.

Supported Cloud API Objects

Table 7.3 lists all the supported cloud API object types, methods, and functions. In your cloud API requests, you
cannot include RESTful API object types, methods, and functions that are not listed in the table, even when the Grid
Master supports them for other purposes. Note that the supported types and operations for cloud API requests are
sub sets of all types and operations supported on the Grid Master.
Before you send any cloud API requests, ensure that you understand the implications and restrictions for each
supported object. NIOS uses extensible attributes to associate specific information with a cloud object. For
information about the default cloud extensible attributes and how to use them, see Extensible Attributes for Cloud
Objects on page 386.

370 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Cloud API Requests

In AWS (Amazon Web Services), you can create a VPC (Virtual Private Cloud) and a subnet using the same network
address and subnet mask. For example, you can add 172.29.02.0/24 as the VPC and 172.29.2.0/24 as the subnet
and create VMs in the subnet. However, you cannot add a network container and a network using the same network
address and subnet mask in NIOS. Therefore, when you send an API request to create such VPC and subnet in AWS,
NIOS recognizes only the VPC, not the subnet. As a result, you are not able to create VMs under the subnet. For more
information about how to create VPCs and subnets in AWS for NIOS, refer to the Infoblox Installation Guide for vNIOS
for AWS.
In addition, when you delegate authority for supported cloud objects, NIOS may process the requests differently
based on the following:
• How the object was first created.
• Whether authority for the object has already been delegated to a Cloud Platform Appliance.
For details about authority delegation and restrictions for each object, see About Authority Delegation on page 376.

Note: NIOS does not process cloud API requests that contain unsupported object types or any combination of
supported object types with unsupported methods and functions. Although you can use all the fields in a
supported object type, some restrictions may apply to supported values for some of these fields. For
restrictions, see the Comments field in Table 7.3 for the corresponding object.

Table 7.3 Supported Cloud API Objects for Cloud API Service

Note: The cloud API service does not support scheduling and workflow approval requests. Objects deleted
through a cloud API request are not stored in the Recycle Bin, except for DNS zones and network views.
For information about the Recycle Bin, see Using the Recycle Bin on page 73.

Supported Cloud API Object Allowed Operations in cloud Authority Delegation and Required
Object Type API Requests Restrictions Extensible
Attributes in cloud
API Requests (for
creations only)

Network View networkview Read, Create, Modify, Delete See Network Views on Tenant ID
page 378 for information Cloud API Owned
about authority CMP Type
delegation.

IPv4 Network networkcontainer Read, Create, Modify, Delete Split network, join Tenant ID
Container Function: networks, and RIR related Cloud API Owned
next_available_network operations are not CMP Type
supported. See IPv4 and
IPv6 Networks and
Network Containers on
page 378 for information
about authority
delegation.

IPv6 Network ipv6networkcontainer Read, Create, Modify, Delete Split network, join Tenant ID
Container Function: networks, and RIR related Cloud API Owned
next_available_network operations are not CMP Type
supported. See IPv4 and
IPv6 Networks and
Network Containers on
page 378 for information
about authority
delegation.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 371

Deploying Cloud Network Automation

Supported Cloud API Object Allowed Operations in cloud Authority Delegation and Required
Object Type API Requests Restrictions Extensible
Attributes in cloud
API Requests (for
creations only)
IPv4 Network network Read, Create, Modify, Delete Split network, join Tenant ID
Function: next_available_ip networks, and RIR related Cloud API Owned
operations are not CMP Type
supported. See IPv4 and
IPv6 Networks and
Network Containers on
page 378 for information
about authority
delegation.

IPv6 Network ipv6network Read, Create, Modify, Delete Split network, join Tenant ID
Function: next_available_ip networks, and RIR related Cloud API Owned
operations are not CMP Type
supported. See IPv4 and
IPv6 Networks and
Network Containers on
page 378 for information
about authority
delegation.

IPv4 DHCP range Read, Create, Modify, Delete See DHCP Ranges on Tenant ID
Range Function: next_available_ip page 380 for information Cloud API Owned
about authority CMP Type
delegation.

IPv6 DHCP ipv6range Read, Create, Modify, Delete See DHCP Ranges on Tenant ID
Range Function: next_available_ip page 380 for information Cloud API Owned
about authority CMP Type
delegation.

IPv4 Fixed fixedaddress Read, Create, Modify, Delete See IPv4 and IPv6 Fixed Tenant ID
Address Function: next_available_ip Addresses on page 381 Cloud API Owned
(Reservation) You can also create and for information about CMP Type
delete through Grid Manager. authority delegation.
All required Cloud EAs are
automatically populated in
the GUI.
IPv6 Fixed ipv6fixedaddress Read, Create, Modify, Delete See IPv4 and IPv6 Fixed Tenant ID
Address Function: next_available_ip Addresses on page 381 Cloud API Owned
(Reservation) You can also create and for information about CMP Type
delete through Grid Manager. authority delegation.
All required Cloud EAs are
automatically populated in
the GUI.
DNS View view Read, Modify See DNS Views on page N/A
382 for information about
authority delegation.

DNS Zone zone_auth Read, Create, Modify, Delete See DNS Zones on page Tenant ID
382for information about Cloud API Owned
authority delegation. CMP Type

372 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Cloud API Requests

Supported Cloud API Object Allowed Operations in cloud Authority Delegation and Required
Object Type API Requests Restrictions Extensible
Attributes in cloud
API Requests (for
creations only)
Host Record record:host Read, Create, Modify, Delete See Host Records on page Tenant ID
You can also create and 384 for information about Cloud API Owned
delete through Grid Manager. authority delegation. CMP Type
All required Cloud EAs are
automatically populated in
the GUI.

record:host_ipv4addr Read, Create, Modify, Delete

Function: next_available_ip
You can also create and
delete through Grid Manager.
All required Cloud EAs are
automatically populated in
the GUI.

record:host_ipv6addr Read, Create, Modify, Delete

Function: next_available_ip
You can also create and
delete through Grid Manager.
All required Cloud EAs are
automatically populated in
the GUI.

Resource record:a Read, Create, Modify, Delete See DNS Resource Tenant ID
Record Function: next_available_ip Records on page 384 for Cloud API Owned
information about CMP Type
record:aaaa Read, Create, Modify, Delete authority delegation.
Function: next_available_ip

record:cname Read, Create, Modify, Delete

record:ptr Read, Create, Modify, Delete

Function: next_available_ip

record:mx Read, Create, Modify, Delete

record:naptr Read, Create, Modify, Delete

record:srv Read, Create, Modify, Delete

record:txt Read, Create, Modify, Delete

Grid Member member Read only API requests calling for N/A
Function: restartservices service restarts on a Grid
member can be
processed by the Cloud
Platform Appliance only if
the member requested is
also the Cloud Platform
Appliance processing the
request.

Grid grid Read only All cloud API requests N/A

Function: restartservices calling for service restarts
are proxied to the Grid
Master.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 373

Deploying Cloud Network Automation

Supported Cloud API Object Allowed Operations in cloud Authority Delegation and Required
Object Type API Requests Restrictions Extensible
Attributes in cloud
API Requests (for
creations only)
Extensible extensibleattributedef Read only You can use cloud N/A
Attribute attributes as source
objects to obtain the next
available IP address or
network. When doing so,
you must also include the
respective network view
for the object.

Proxying Cloud API Requests

In Cloud Network Automation, the primary Cloud Platform Appliance that receives cloud API requests can act as a
proxy for other authoritative Cloud Platform members and for the Grid Master. This proxying mechanism is important
when the Cloud Platform Appliance cannot process requests that contain objects for which it is not authoritative, or
when objects in the requests do not have authority delegation and must be processed by the Grid Master.
Note that only successfully authenticated and authorized requests that require proxying are sent to the respective
appliance for processing. Proxying is limited to one hop within the Grid. Therefore, if the destination appliance cannot
process a proxied request, the request will not be forwarded and an error is returned to the client.

Note: Only cloud API requests can be proxied.

To ensure that the proxying mechanism functions properly, configure your systems to allow for the following
communication:
— Allow all HTTPS connectivity among the Cloud Platform Appliances as well as to the Grid Master based on
your organization’s firewall requirements.
— Ensure that you use the VIP or the MGMT address if it is enabled (including that for the Grid Master) as the
destination IP for the HTTPS connectivity. Note that this is a per member setting.
— Grant appropriate permissions to admin groups with cloud API access to ensure that tasks for objects
outside of the delegation function properly on the Grid Master.

Sample Cloud API Requests

This section includes sample cloud API requests for supported objects:
Adding a network view:
curl -H "Content-Type: application/json" -k1 -u cloud:infoblox -X POST
https://10.0.0.2/wapi/v2.0/networkview -d '{"name": "netview1", "extattrs": 
{ "Tenant ID":{"value": "1011"} ,"Cloud API Owned":{"value":"True"},"CMP
Type":{"value":"vCO/vCAC"}}}'
Adding a network within the delegated network view in the above example:
curl -H "Content-Type: application/json" -k1 -u cloud:infoblox -X POST
https://10.0.0.2/wapi/v2.0/network -d '{ "network":
"20.0.0.0/24","network_view":"netwview1","extattrs": { "Tenant ID":{"value": "1011"}
,"Cloud API Owned":{"value":"True"},"CMP Type":{"value":"vCO/vCAC"}}}'
Adding a DHCP range within the network created in the above example:
curl -H "Content-Type: application/json" -k1 -u cloud:infoblox -X POST
https://10.0.0.2/wapi/v2.0/range -d '{ "end_addr": "20.0.0.40", "member":
{"_struct": "dhcpmember1", "ipv4addr": "10.0.0.2", "name": "corp100.com"},"network":

374 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Cloud API Requests

"20.0.0.0/24", "network_view": "netview1", "start_addr": "20.0.0.35", "extattrs": {

"Tenant ID":{"value": "1011"} ,"CMP Type":{"value":"vCO/vCAC"},"Cloud API
Owned":{"value":"True"}}}'
Adding an A Record:
curl -H "Content-Type: application/json" -k1 -u cloud:infoblox -X POST
https://10.0.0.2/wapi/v2.0/record:a -d '{"name": "corp200.com",
"ipv4addr":"20.0.0.2","view": "default.netview1","extattrs": {"Tenant ID":{"value":
"1011"} , "CMP Type":{"value":"vCO/vCAC"},"Cloud API Owned": {"value":"True"},"VM
ID":{"value":"12"}}}'
Adding a Fixed address:
curl -H "Content-Type: application/json" -k1 -u cloud:infoblox -X POST
https://10.0.0.2/wapi/v2.0/fixedaddress -d '{"ipv4addr": "20.0.0.5", "network_view":
"netview1","mac":"15:06:32:16:00:00","extattrs": { "Tenant ID":{"value": "1011"}
,"CMP Type":{"value":"vCO/vCAC"} ,"VM ID":{"value":"352"},"Cloud API
Owned":{"value":"True"}}}'
Adding a zone:
curl -H "Content-Type: application/json" -k1 -u cloud:infoblox -X POST
https://10.0.0.2/wapi/v2.0/zone_auth -d '{ "fqdn":"test.com","grid_primary":
[{"name": "infoblox.localdomain", "stealth": false},{"name": "corp100.com",
"stealth": false}],"view": "default.netview1","extattrs": { "Tenant ID":{"value":
"1011"} , "CMP Type":{"value":"vCO/cCAC"} ,"Cloud API Owned":{"value":"True"}}}'
Adding a network container:
curl -H "Content-Type: application/json" -k1 -u cloud:infoblox -X POST
https://10.0.0.2/wapi/v2.0/networkcontainer -d '{ "network":
"200.0.0.0/24","network_view": "netview1","extattrs": { "Tenant ID":{"value":
"1011"} ,"Cloud API Owned":{"value":"True"},"CMP Type":{"value":"vCO/vCAC"}}}'
Add a host record:
curl -H "Content-Type: application/json" -k1 -u cloud:infoblox -X POST
https://10.0.0.2/wapi/v2.0/record:host -d '{ "ipv4addrs": [{ "configure_for_dhcp":
false,"ipv4addr": "20.0.0.1", "mac": "11:11:22:22:33:33"}],"ipv6addrs":
[{"configure_for_dhcp": false,"duid": "11:22", "ipv6addr":
"13::1"},{"configure_for_dhcp": false,"duid": "21:22", "ipv6addr": "13::2"}],"name":
"host.corp100.com", "view": "default.netview1"}'
Adding an MX Record:
curl -H "Content-Type: application/json" -k1 -u cloud:infoblox -X POST
https://10.0.0.2/wapi/v2.0/record:mx -d '{ "mail_exchanger":
"abc.com","name":"def.corp100.com", "preference":
10,"view":"default.netview1","extattrs": { "Tenant ID":{"value": "1011"} , "CMP
Type":{"value":"vCO/vCAC"}, "Cloud API Owned":{"value":"False"},"VM
ID":{"value":"230"}}}'

Sample Cloud API Requests for Elastic Scaling

Creating a Member:
curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X POST
https://10.40.240.88/wapi/v2.2/member -d '{"platform": "VNIOS", "host_name":
"test1.com", "vip_setting": {"address": "1.1.1.1", "gateway": "1.1.0.2",
"subnet_mask": "255.255.0.0"}}'
Getting a Member:
curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X GET
https://10.40.240.88/wapi/v2.2/member
Adding Pre-Provisioned Information for the Member:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 375

Deploying Cloud Network Automation

curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X PUT

https://10.40.240.101/wapi/v2.2/member/b25lLnZpcnR1YWxfbm9kZSQ3:test1.com -d
'{"pre_provisioning": {"hardware_info": [{"hwmodel": "CP-V1400", "hwtype":
"IB-VNIOS"}], "licenses": ["cloud_api", "dhcp", "dns", "enterprise", "vnios"]}}'
Creating and Delegating a Network View:
curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X POST
https://10.40.240.88/wapi/v2.2/networkview -d '{"name":"testnv", "extattrs":{
"Tenant ID":{"value": "1011"} , "CMP Type":{"value":"vm130ctest"}, "Cloud API
Owned":{"value":"True"}} }
Creating and Delegating a Network:
curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X POST
https://10.40.240.88/wapi/v2.2/network -d '{"network":"21.0.0.0/8",
"network_view":"default", "cloud_info":{"delegated_member": {"ipv4addr":
"1.1.1.1","name":"test1.com"}},"extattrs":{ "Tenant ID":{"value": "1011"} , "CMP
Type":{"value":"vm130ctest"}, "Cloud API Owned":{"value":"True"}} }'
Undelegating a Network:
curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X PUT
https://10.40.240.88/wapi/v2.2/network/ZG5zLm5ldHdvcmskMjEuMC4wLjAvOC8w:21.0.0.0/8/
default -d '{"cloud_info": {"delegated_member": null }}'
Creating and Delegating an Authoritative Zone
curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X POST
https://10.40.240.88/wapi/v2.2/zone_auth -d '{"fqdn": "test.com", "grid_primary":
[{"name": "test1.com", "stealth": false}], "view": "default", "extattrs":{ "Tenant
ID":{"value": "1011"} , "CMP Type":{"value":"vm130ctest"}, "Cloud API
Owned":{"value":"True"}}}'
Deleting a Member:
curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X DELETE
https://10.40.240.88/wapi/v2.2/member/b25lLnZpcnR1YWxfbm9kZSQ3:test1.com
Creating Token for the Pre-Provisioned Member (note that only superuser can create a token; you must configure
superusers admin groups with cloud API access):
curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X POST
https://10.40.240.88/wapi/v2.2/member/b25lLnZpcnR1YWxfbm9kZSQ3:test1.com?_function=
create_token
Reading Token for the Pre-Provisioned Member (note that only superuser can create a token; you must configure
superusers admin groups with cloud API access):
curl -H "Content-Type: application/json" -k1 -u cloud:cloud -X POST
https://10.40.240.88/wapi/v2.2/member/b25lLnZpcnR1YWxfbm9kZSQ3:test1.com?_function=
read_token

About Authority Delegation

Authority delegation in Cloud Network Automation is the ability to assign full and exclusive control of IP addresses
and DNS name spaces to a Cloud Platform Appliance. You can perform authority delegation only through the Grid
Master. When you delegate the authority of IP addresses and DNS name spaces to a Cloud Platform Appliance, the
Grid Master loses its authority over the scope of delegation for these IP addresses and name spaces as well as any
objects within them. Note that authority delegation for an object can be explicitly assigned or inherited from parent
objects. For information about how to delegate authority for supported object types, see Guidelines for Delegating
Authority on page 377.

376 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authority Delegation

NIOS admin users who do not belong to admin groups with cloud API access are not allowed to create new cloud
objects, nor can they modify or delete existing cloud objects in delegated spaces; but they can modify the
permissions and certain extensible attribute values for these objects. Only admin users with cloud API access and
the correct global and object permissions can be used to send cloud API requests to create, modify, and delete
objects within the delegated scope.

Note: You can delegate authority only to Cloud Platform Appliances, but not to other Grid members.

Objects that are in queue for scheduled executions or approvals are locked and cannot be delegated. Authority
delegation and reclaiming of authority are subject to approval and can be scheduled.

Guidelines for Delegating Authority

You can initiate explicit delegation of authority only through Grid Manager on the Grid Master. The cloud API service
can only be used for implicit or automatic delegation of an object such as creating a network under a network
container that has been delegated, in which network is implicitly delegated to the member to which the network
container is delegated.
The Grid Master can explicitly delegate authority only for the following object types:
• Network View
• Network Container (both IPv4 and IPv6)
• Network (both IPv4 and IPv6)
• DHCP Range (IPv4 and IPv6)
• DNS Authoritative Zone (Note that zones are implicitly delegated if the assigned name server is a Cloud
Platform Appliance.)
Consider the following when you delegate authority for an object:
• You can delegate authority for supported objects to one and only one Cloud Platform Appliance, except for
DNS zones.
• When delegating authority for a parent object, all child objects within the scope of delegation inherit the
same authority delegation.
• You cannot delegate authority for the following:
— objects whose parents already have a delegation configured
— individual IPAM and DNS records including fixed addresses, host records, A/AAAA/PTR records, etc.
• When you use Elastic Scaling to pre-provision an offline Cloud Platform Appliance, any object authority
delegated to this offline member does not take effect until the member joins the Grid. Therefore, you can
still create child objects through Grid Manager under the delegated objects when the member is offline.
• You can override the inheritance of authority delegation at the object level only if the parent object has not
been delegated. The Grid Master assumes authority for objects that do not fall within the scope of
delegation.
• If a supported object has already been delegated, you cannot re-delegate it to another appliance. If you
want to re-delegate this object, you must first un-delegate it.
• For explicitly delegated objects, you can only modify the permission and extensible attributes from Grid
Manager and the Infoblox API other than cloud API requests. For explicitly delegated zones however, you
can modify any properties from Grid Manager and the Infoblox API other than cloud API requests.
• When you create or delete a delegated object through a cloud API request, the appliance returns an OK
message if the operation is successful. It returns an ERROR message if the operation fails. You can then
change the options in the request and try again. The appliance sends a WARNING message when certain
operations require attention.
• You can reclaim the authority that you delegated to a Cloud Platform Appliance. Once the authority is
reclaimed, it goes back to the Grid Master. Before you reclaim authority for any object, ensure that the
Cloud Platform Appliance is online and properly connected to the Grid Master for the reclaiming process to
function properly.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 377

Deploying Cloud Network Automation

• The Cloud Platform Appliance can run discovery on any network containers or networks that are reachable
by the appliance. The default discovery settings for network containers and networks are inherited from
their parent objects. For information about discovery, see About Discovery on page 619.

Note: Any Cloud Platform Appliances that are removed from the Grid automatically lose authority over objects
that were delegated to them. The Grid Master becomes authoritative for these objects.

Delegating Authority for Cloud Objects

You can delegate authority when you create a new object that has not been delegated or does not inherit authority
delegation from one of its parent object.
See the following sections for detailed information about delegating authority for supported objects.

Network Views
Consider the authority delegation guidelines in Table 7.4 when you create, modify, or delete a network view.
See Sample Cloud API Requests on page 374 for a sample cloud API request.
For information about how to create network views from the Grid Master, see Adding Network Views on page 1065.

Table 7.4 Authority Delegation for Network Views

Cloud API Requests Standard API and WAPI Requests Comments

• You can delegate authority for a • You can delete a network view from the Grid • When you create a
network view to only one Cloud Master only if it has not been delegated to network view through
Platform Appliance. any Cloud Platform Appliance. a cloud API request,
• When you create a new network • When you create a network view on the Grid you must include the
view, authority is automatically Master, it is shared among all Grid following extensible
delegated to the Cloud Platform members in the Grid. attributes in the cloud
Appliance that processes the • You can delegate a network view from the API request: Tenant
request. Grid Master to a Cloud Platform Appliance ID, Cloud API Owned,
• To balance network views among only if the child objects within the network and CMP Type.
multiple Cloud Platform Appliances view are delegated to the same Cloud
in the Grid, ensure that you Platform Appliance.
configure your cloud adapter • When you reclaim authority for a network
accordingly. view, any DNS zones in the network view
• If you want to share a network view remain assigned to their name servers,
among different Cloud Platform including the Cloud Platform Appliance that
members, you must manually has lost authority over the network view. In
provision it and its child objects other words, the DNS zone remains under
and delegate them to the the authority of that Cloud Platform
respective Cloud Platform Appliance.
members.

IPv4 and IPv6 Networks and Network Containers

Consider the authority delegation guidelines in Table 7.5 when you create, modify, or delete a network or network
container. See Sample Cloud API Requests on page 374 for a sample cloud API request. For information about how
to create IPv4 and IPv6 networks from the Grid Master, see Adding IPv4 Networks on page 1111 and Adding IPv6
Networks on page 1161.
For information about how to create IPv4 and IPv6 networks using network templates from the Grid Master, see
Adding IPv4 Network Templates on page 1146 and Adding IPv6 Network Templates on page 1154.

378 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authority Delegation

Table 7.5 Authority Delegation for Networks and Network Containers

Cloud API Requests Standard API and WAPI Requests Comments

• You can delegate authority for a network or • You cannot create, modify, or • When you create a
network container to only one Cloud Platform delete a network or network network or network
Appliance, but you can delegate authority of container on the Grid Master if container through a
multiple networks and network containers to the the object has been delegated cloud API request,
same Cloud Platform Appliance. to a Cloud Platform Appliance. you must include the
• When you create a new network or network • You can create a network or following extensible
container through a cloud API request, authority network container and attributes in the
is automatically delegated to the primary Cloud delegate it to a Cloud Platform request: Tenant ID,
Platform Appliance that processes the request. Appliance using a network Cloud API Owned, and
• When you create a network using a network template. CMP Type.
template, you must provide the name of the • You can delegate a network or • If a network is
template and reference it in the cloud API network container to a Cloud explicitly delegated
request. Platform Appliance only if the (not through
• Delegation for a network or network container child objects within the inheritance), you can
(except for unmanaged networks) can be done network or network container convert a network to a
through explicit delegation or inheritance from are delegated to the same network container
the parent object. Cloud Platform Appliance. only if the size of the
• You cannot perform a network remains the
• You cannot delete networks and network
recursive deletion of a same; the network
containers using cloud API requests if they have
network container if one of the delegation is
already been explicitly delegated. You must first
child objects in the container transferred to the
un-delegate them before deleting them.
has been delegated. network container.
• Networks and network containers associated
• DHCP utilization usage for a • The Cloud Platform
with a DNS zone cannot be delegated.
network or network container Appliance does not
• You can delegate a network or network container support split network,
if all the following are true: is only updated on the Grid
Master. john networks, and
— It has not been delegated to a Cloud RIR related
Platform Appliance. • Discovered IP addresses that
operations.
are within a delegated
— It is not part of a network or network
network are created on the
container that has been delegated to a
Grid Master and replicated to
Cloud Platform Appliance.
the Cloud Platform Appliance
— It does not contain any networks or DHCP that is relevant to the IP
ranges that are delegated to a different addresses.
Cloud Platform Appliance.
— It does not belong to a delegated network
view.
• All discovery related attributes for a network or
network container return the default values.
• You cannot modify the discovery settings for
networks that are in a delegated network
container. You cannot create discovered
networks in a network container whose authority
has been delegated. You also cannot convert
unmanaged networks. A discovered unmanaged
IP address may co-exist with an IP address
created through a cloud API request.
• Although no DHCP service restart is required,
you can perform a DHCP service restart on a
Cloud Platform Appliance through a cloud API
request.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 379

Deploying Cloud Network Automation

DHCP Ranges
Consider the authority delegation guidelines in Table 7.6 when you create, modify, or delete a DHCP range.
See Sample Cloud API Requests on page 374 for a sample cloud API request.
For information about how to create IPv4 and IPv6 ranges, see Adding IPv4 Address Ranges on page 1122 and
Modifying IPv6 Address Ranges on page 1169.
For information about how to create IPv4 and IPv6 ranges using range templates, see Adding IPv4 Range Templates
on page 1143 and Adding IPv6 Range Templates on page 1151.

Table 7.6 Authority Delegation for DHCP Ranges

Cloud API Requests Standard API and WAPI Comments

Requests
• You can delegate authority for a DHCP range to only one • You cannot create, • When you create a
Cloud Platform Appliance, but you can delegate authority modify, or delete a DHCP range through
for multiple DHCP ranges to the same Cloud Platform DHCP range on the Grid a cloud API request,
Appliance. Master if it has been you must include
• When you create a new DHCP range, authority is delegated to a Cloud the following
automatically delegated to the Cloud Platform Appliance Platform Appliance. extensible
that processes the request or to the Grid Master if the • You can create a DHCP attributes in the
Grid Master processes the request. range and delegate it to request: Tenant ID,
• When you create a DHCP range using a range template, a Cloud Platform Cloud API Owned,
you must know the name of the template and reference it Appliance using a range and CMP Type.
in the cloud API request. template.
• You can delegate authority for reserved ranges in a • You can increase the
Microsoft synchronized network if: size of a DHCP range
— It is not included in any exclusions. that has been explicitly
delegated to a Cloud
— It does not conflict with another reserved range.
Platform Appliance. The
You can manage these range addresses through a cloud increased size is
adapter, such as the IPAM Plug-In for VMware. available for use by the
• Delegation for a DHCP range can be done through explicit Cloud Platform
delegation or inheritance from the parent object. You Appliance after
cannot override inherited delegation. replication.
• Note that you cannot delete DHCP ranges using cloud API
requests if they have already been explicitly delegated.
You must first un-delegate them before deleting them.
However, if the delegation is inherited, you can delete
the objects through a cloud API request.
• You can delegate a DHCP range to a Cloud Platform
Appliance if all the following are true:
— It has not been delegated to a Cloud Platform
Appliance.
— It is not part of a delegated network or network
container in the same network view.
— It does not belong to a delegated network view.
— It is a reserved range or a range that has been
assigned to a DHCP member that is the same Cloud
Platform Appliance to which you want to delegate
the range.

380 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authority Delegation

Cloud API Requests Standard API and WAPI Comments

Requests
• You cannot delegate a DHCP range that has been
assigned to a failover association, nor can you assign a
DHCP range that has been delegated to a failover
association.
• Authority is delegated from the start address to the end
address, including exclusions. Note that the exclusions
can be used only to restrict IP addresses generated by
the next available IP feature.
• All discovery related attributes for a DHCP range return
the default values.
• Although no DHCP service restart is required, you can
perform a DHCP service restart on a Cloud Platform
Appliance through a cloud API request.

IPv4 and IPv6 Fixed Addresses

Consider the following authority delegation guidelines when you create, modify, or delete a fixed address:
• You can delegate authority for a fixed address only through inheritance from one of its parent objects, such
as its associated network view, network container, network, or DHCP reserved range.
• When you create or modify an IPv4 or IPv6 fixed address, you must include the following extensible
attributes in the cloud API request: Tenant ID, Cloud API Owned, and CMP Type.
• You can create a fixed address from the Grid Master using a fixed address template. Note that when you
want to reference a template in the cloud API request, you must know the name of the template
beforehand.
• When performing any operations on a Cloud Platform Appliance, all discovery related attributes for a fixed
address return the default values.
• No DHCP service restart is required when performing any operations for a fixed address on the Cloud
Platform Appliance unless automatic DHCP restart is disabled on the appliance. You can however perform a
DHCP service restart on the Cloud Platform Appliance to which authority is delegated for a fixed address
through a cloud API request.
• You can create, modify, or delete an IPv4 or IPv6 fixed address and reservation on the Grid Master through
Grid Manager if the fixed address or reservation is within the scope of a network view, network container,
network, or DHCP reserved range whose authority has been delegated to a Cloud Platform Appliance.
See Sample Cloud API Requests on page 374 for a sample cloud API request.
For information about how to create IPv4 and IPv6 fixed addresses, see Adding IPv4 Fixed Addresses on page 1126
and Adding IPv6 Fixed Addresses on page 1171.
For information about how to create IPv4 and IPv6 fixed address templates, see Adding IPv4 Fixed
Address/Reservation Templates on page 1145 and Adding IPv6 Fixed Address Templates on page 1153.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 381

Deploying Cloud Network Automation

DNS Views
Consider the following authority delegation guidelines when you create, modify, or delete a DNS view:
• You cannot explicitly delegate authority for a DNS view. The Cloud Platform Appliance automatically gains
authority over any DNS view that exists in the network view whose authority is delegated to that appliance.
• You cannot create or delete a DNS view from the Cloud Platform Appliance.
• Through a cloud API request, you can update DNS views defined in a network view that has been delegated to
the Cloud Platform Appliance.
• You cannot create, modify, or delete a DNS view in network views that have been delegated to a Cloud Platform
Appliance through a standard API request.
• You cannot delete a DNS view as long as it contains at least one DNS zone that has been delegated to a Cloud
Platform Appliance.

DNS Zones
Consider the following authority delegation guidelines in Table 7.7 when you create, modify, or delete a DNS zone.
See Sample Cloud API Requests on page 374 for a sample cloud API request.
For information about how to create DNS zones, see About Authoritative Zones on page 829.

382 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authority Delegation

Table 7.7 Authority Delegation for DNS Zones

Cloud API Requests Standard API and WAPI Comments

Requests
• The Grid primary of a DNS zone automatically gains • You cannot create, • Only authority for
authority for the zone if the primary is a Cloud Platform modify, or delete a authoritative
Appliance. When there are multiple primaries configured DNS zone in a forward-mapping and
for the zone, multiple delegations to these primaries are network view whose reverse-mapping
allowed as long as they are Cloud Platform Appliances. authority has been zones can be
• You cannot assign both a Microsoft server and a Grid delegated to a Cloud delegated. You cannot
member as primaries at the same time, although you can Platform Appliance. delegate authority for
assign a Microsoft server as the Grid primary and a Cloud • You cannot assign a forward zones, stub
Platform Appliance as the Grid secondary. This allows the Cloud Platform zones, and delegated
Microsoft server to serve changes sent from the cloud Appliance as the zones even though
adapter. Grid primary for a they may exist in a
• All resource records in a DNS zone inherit authority zone that is locked delegated network
delegation from the zone. However, you cannot modify the or disabled. view.
NS record through a cloud API request. • You can modify • When you create a
• You can modify all the fields for a zone whose authority extensible attributes DNS zone using a
has been explicitly delegated. of any DNS zone cloud API request,
whose authority has you must include the
• The cloud member to which authority for a network view is
been delegated from following extensible
delegated automatically gains authority for authoritative
the Grid Master. attributes in the
zones defined in that network view. This Cloud Platform
request: Tenant ID,
Appliance is the only cloud member that can be the Grid
Cloud API Owned, and
primary for the zones defined in this network view. The
CMP Type.
Grid Master does not have authority for any zone in this
network view unless it is assigned as a Grid primary.
• The Cloud Platform Appliance can create, modify, and
delete a DNS zone in any DNS view defined in a network
view whose authority has been delegated to that cloud
member.
• The Cloud Platform Appliance that is authoritative for a
DNS zone can perform changes to the assigned Grid
primaries, Grid secondaries, and external servers
assigned to the zone as long as the Cloud Platform
Appliance remains a Grid primary. But it cannot create,
modify, or delete the NS record.
• The Cloud Platform Appliance that is authoritative for a
DNS zone can create, modify, and delete DNS delegations
that are directly parented to that zone. In particular, it may
specify any Grid primary, Grid secondary, or external
server for that zone.
• DNSSEC operations, network associations, and zone
locking are not supported if at least one Cloud Platform
Appliance is assigned as the Grid primary for any DNS
zones.
• Although no DHCP service restart is required, you can
perform a DHCP service restart on a Cloud Platform
Appliance through a cloud API request.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 383

Deploying Cloud Network Automation

DNS Resource Records

Consider the following authority delegation guidelines in Table 7.8 when you create, modify, or delete a resource
record, including A, AAAA, CNAME, PTR, MX, SRV, TXT, NAPTR records.
See Sample Cloud API Requests on page 374 for a sample cloud API request.

Table 7.8 Authority Delegation for DNS Resource Records

Cloud API Requests Standard API and WAPI Requests Comments

• Authority delegation for resource records (A, AAAA, • You cannot create, modify, • When you create a
CNAME, PTR, MX, SRV, TXT, and NAPTR) is inherited or delete a resource record if resource record
from their parent zones. You can delegate authority it is in a network view whose through a cloud API
for these records by delegating authority for their authority has been request, you must
respective parent zones. delegated to a Cloud include the following
• All resource records in a DNS zone inherit authority Platform Appliance. extensible attributes
delegation from their parent zones. However, you in the request: Tenant
cannot modify the NS record through a cloud API ID, Cloud API Owned,
request. and CMP Type.
• If the Cloud Platform Appliance is a Grid primary for
a zone, requests that include a supported record is
processed locally by the Cloud Platform Appliance.
Otherwise, the request is proxied to the Cloud
Platform Appliance that is assigned as the only
Grid primary for the zone.
• If the DNS resource records belong to a zone that is
served only by Cloud Platform Appliances,
authority for these records are considered
delegated. You must create, modify, or delete
these records on one of these Cloud Platform
Appliances.

Host Records
Consider the following authority delegation guidelines in Table 7.9 when you create, modify, or delete a host record.
See Sample Cloud API Requests on page 374 for a sample cloud API request.

384 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Grid and Member Cloud API Properties

Table 7.9 Authority Delegation for Host Records

Cloud API Requests Standard API and WAPI Requests Comments

• Authority delegation for a host record is inherited • IP addresses defined in the • When you create a
from both the DNS and DHCP portions of the host record that is enabled host record through a
record. For DNS, you can delegate authority for all DHCP follow the same rules cloud API request,
DNS zones for which the host record is defined. For for a fixed address. See IPv4 you must include the
DHCP, you can delegate authority for the parent and IPv6 Fixed Addresses following extensible
network view, network container, network, or DHCP on page 381 for more attributes in the
range defined for the host record. information. request: Tenant ID,
• You can create, modify, or delete a host record or a • Names or aliases defined in Cloud API Owned, and
host IP address whose authority is delegated to a the host record follow the CMP Type.
Cloud Platform Appliance through Grid Manager. same rules set for resource
Note that when you create a host record, you must records. See DNS Resource
enable it for DNS within the delegated network Records on page 384 for
view. Otherwise, you will not be able to save the more information.
host record.
• The Cloud Platform Appliance can process a cloud
API request that includes a host record only if it has
gained authority for both DNS and DHCP portions
of the host record, as follows:
— All IP addresses enabled for DHCP within one
or more delegation scopes are delegated to
the same Cloud Platform Appliance.
— All DNS records defined for one or more DNS
zones have the same Cloud Platform
Appliance assigned as the Grid primary.
• IP addresses defined in the host record that is
enabled for DHCP follow the same rules set for a
fixed address. See IPv4 and IPv6 Fixed Addresses
on page 381 for more information.
• Names or aliases defined in the host record follow
the same rules set for resource records. See DNS
Resource Records on page 384 for more
information.
• Although no DHCP service restart is required, you
can perform a DHCP service restart on a Cloud
Platform Appliance through a cloud API request.

Configuring Grid and Member Cloud API Properties

Only admin users in admin groups with cloud API access can be used to send cloud API queries by default. For
information about how to add users to an admin group, see Creating Local Admins on page 208. To control which
admin users, either from this group or from remote servers, can perform cloud API tasks, you can further define ACLs
at the Grid and member levels.
1. Grid: From the Cloud tab, click Grid Cloud API Properties from the Toolbar. Configuration done for the Grid only
applies to the current Grid Master; it is not inherited by other Cloud Platform Appliances.
Member: From the Cloud tab, select the Members tab -> member check box, and then click the Action icon
and select Edit from the menu. Configuration done at the member level applies only to the Grid member.
2. In the Grid Cloud API Properties (for the current Grid Master) or the Member Cloud API Properties editor, select
the General tab, and then complete the following:
Administrator allowed to make WAPI request on the Grid Master

NIOS 7.3 NIOS Administrator Guide (Rev. A) 385

Deploying Cloud Network Automation

— None: When you select this, none of the admin users in admin groups with cloud API access can send cloud
API requests to the Grid Master or Cloud Platform Appliance.
— All: When you select this, all admin users in admin groups with cloud API access can send cloud API
requests to the Grid Master or cloud Platform Appliance. This is the default.
— Set of administrators: Select this to create a list of admin users, both remote and local, who can send cloud
API requests. Local users are users defined in admin groups with cloud API access. Remote users are users
who log in from other remote servers. These users will be authenticated before they can access the Grid
Master or Cloud Platform Appliance.
To add local users, click the Add icon and select Local. In the Cloud API Admin Selector, select an admin
user from the list. Grid Manager adds the selected user to the table. If you have only one cloud API user,
Grid Manager automatically adds this user to the table.
To add remote users, click the Add icon and select Remote. Grid Manager adds a row to the table. Click the
Admin column to add the username of the administrator. Note that the username you enter here must
match the username used on the remote server. Depending on the remote server type, you must create a
server group for these remote users and add the group to the admin authentication policy to ensure these
admin users can send cloud API requests. For information about how to configure admin server groups and
admin authentication policy, see About Remote Admins on page 211.
Click the Add icon again to add additional admin users.
Recycle cloud objects: This only applies to the Grid Master. Select this check box to enable the recycling of
cloud objects. This is selected by default.
3. Save the configuration.

Extensible Attributes for Cloud Objects

When you first enable Cloud Network Automation, NIOS installs a set of extensible attributes that are specific for
cloud usage. Use these cloud extensible attributes to tag objects that belong to the CMP. Note the following when
defining cloud extensible attributes through Grid Manager:
• You cannot assign cloud extensible attributes to other NIOS objects, yet you can create smart folders using
these cloud attributes or modify their definitions.
• You can define and update cloud extensible attributes on the Grid Master, through cloud API requests or
Grid Manager, as long as the authority for the corresponding cloud objects are not delegated.
To identify a cloud object, you must reference some of these cloud attributes when you create, modify, or delete a
specific object. For more information about which extensible attributes are required for cloud API requests, see
Supported Cloud API Objects on page 370.
Table 7.10 lists the default cloud extensible attributes come installed on the appliance. Note that some of the
attributes are read-only and you cannot modify their properties. These attributes are applicable for specific object
types or for identification purposes. See Comments for more information about each attribute.

Note: All cloud extensible attributes are displayed in the Administration tab -> Extensible Attributes tab in Grid
Manager.

Table 7.10 Extensible Attributes for Cloud Usage

Attribute Name Attribute Type Comments

Account String The CMP user account for creating networks.

Application Type String Indicates the application type, such as Web, DB, or
CRM.

386 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Extensible Attributes for Cloud Objects

Attribute Name Attribute Type Comments

Availability Zone String

Cloud API Owned List [True, False] This is read-only. Defines whether an object was
created by the cloud adapter.
CMP Type String This is read-only. Defines the type of CMP, such as
VMware or OpenStack.
Host Aggregates String

Interface Name String The name of the interface.

Is External List [True, False] This is read-only. Limited to the object type
Network and Network Container.

Is Shared List [True, False] This is read-only. Limited to the object type
Network and Network Container.
IP Type List [ Private, Public, Fixed, Floating, Type of IP address
Elastic]

Location String

Network Encap String

Network ID String Network ID in OpenStack

Network Name String Network name

Physical Network Name String

Port Attached Device - String Device ID for associated device, such as OpenStack
Device ID or equivalent, in other CMPs.

Port Attached Device - String Device name for associated device, such as
Device Owner OpenStack or equivalent, in other CMPs (e.g.
compute:nova, network:dhcp, or
netowrk:router_interface.
Port Group String VMware or equivalent in other Hypervisors or
CMPs.
Port ID String Port ID for associated device, such as OpenStack or
equivalent, in other CMPs.

Port Name String Port name for associated device, such as

OpenStack or equivalent, in other CMPs.

Segmentation ID String

Subnet ID String

Subnet Name String

Tenant ID String This is read-only. The unique ID for the tenant

object.
vDC String

VLAN iD Integer The VLAN ID.

VM ID String This is read-only. This is the Instance ID in

OpenStack.

VM Name String Instance Name in OpenStack.

vCD App String The application name defined in vCloud Director;

previously vApp.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 387

Deploying Cloud Network Automation

Attribute Name Attribute Type Comments

vCD Org String The organization name defined in vCloud Director;
previously vOrg.

You can modify some of the properties for the cloud extensible attributes, except for the read-only attributes. By
default, all cloud extensible attributes are configured to allow Read/Write access for the Cloud Platform Appliances.
You can change this configuration to read-only so the Cloud Platform Appliances can only access the attribute values,
but not modify them. Note that when you reference modification for a read-only attribute in a cloud API request, the
Cloud Platform Appliance returns an error because it cannot modify the attribute value. For information about how to
configure extensible attributes, see About Extensible Attributes on page 417.

Note: An upgrade could fail if the name of an existing extensible attribute matches the name of any of the cloud
extensible attribute for a different object type. You must define values for all required cloud extensible
attributes in a cloud API request.

Viewing Cloud Objects

When you enable the Cloud Network Automation license on the Grid Master, NIOS adds the ability to view new cloud
objects such as Tenants and VM IP addresses. You can view cloud objects and their related information in the Cloud
tab of Grid Manager. The Cloud tab provides the following sub tabs for viewing different information related to cloud
objects: Tenants, VPCs, Networks, VMs (by IP Address), and Cloud Platform Members.
In addition to viewing data in these tabs, you can do the following:
• Click the Action icon and select an action from the menu.
— Select Show Active Users to view all the users who are currently active on the Active Directory domain. For
information, see Viewing Active Network Users on page 615.
• Modify some of the data in the table. Double click a row, and either modify the data in the field or select an item
from a drop-down list. Click Save to save the changes. Note that some fields are read-only.
• Edit the properties of an object.
— Select the object, and then click the Edit icon.
• Export the list of objects to a .csv file.
— Click the Export icon.
• Print the list of objects.
— Click the Print icon.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria:
— In the filter section, click Show Filter and define filter criteria for the quick filter.
— Click Save and complete the configuration In the Save Quick Filter dialog box.
The appliance adds the quick filter to the quick filter drop-down list in the panel. Note that global filters are
prefixed with [G], local filters with [L], and system filters with [S].

388 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Cloud Objects

Viewing All Tenants

The Tenants tab lists all tenants from the CMP. Tenant is an abstract administrative concept. Similar to a tenant in the
CMP, a tenant object in NIOS encompasses all network elements such as networks, zones, VMs, and IP addresses
(fixed and floating), network views, default DNS view, and all related extensible attributes associated with that
tenant. Multiple tenants can be mapped to the same network view. A tenant can also have VMs (with IP addresses)
in its shared or external networks that are in different network views.
In Grid Manager, you can click a tenant name in the Cloud tab -> Tenants tab and drill down to the Networks and VMs
(by IP Address) sub tabs to view networks and VMs associated with the selected tenant. In the Tenants tab -> VMs tab,
you can click a VM name and drill down more to view the Networks and IP Addresses sub tabs for the selected VM.
You can always click the bread crumb at the top of the viewer to go back to the Tenants home tab.
Each tenant has a name and a unique tenant ID. The tenant ID is provided through cloud API requests. You cannot
create or delete tenant objects through Grid Manager. All tenants are created and deleted through cloud API requests.
However, you can modify the name, extensible attributes, and permissions for a specified tenant through the Tenant
editor in Grid Manager if you have valid tenant permissions: All Tenants or per tenant object. Note that you cannot
delegate the authority of any given tenants.
To view all tenant objects:
1. From the Cloud tab, click the Tenants tab.
2. Grid Manager displays the following information for each tenant:
— Actions: Click the action icon (shown as a gear in each row) next to a selected tenant and choose from
the following:
— Edit: Modify certain general properties.
— Extensible Attributes: Add or modify extensible attributes.
— Permissions: Modify the administrative permissions.
— Mgmt Platform: Displays the CMP that manages this tenant. When it displays Amazon, it indicates a
successful validation of the Amazon account from NIOS to AWS.
— Name: The tenant name.
— ID: The unique tenant ID.
— VMs: The total number of VM objects associated with this tenant. This can include the following object
types: Host Record, Fixed Address, and any resource record type such as A, AAAA, PTR, and CNAME records.
It also includes unmanaged IP addresses that are associated with the tenant.
— Networks: The total number of IPv4 and IPv6 networks and network containers associated with this tenant.
Note that this number includes only networks and network containers created by the cloud adapter.
— Created: The timestamp when the tenant was first created. You cannot modify this field. This timestamp
reflects the time when the tenant object was first seen by the Grid Master, so it may not match the
timestamp when the original cloud API request was sent.
— Last Updated: The timestamp when the last event associated with this tenant happened. You cannot modify
this field. This timestamp reflects the time when the last event associated with this tenant was processed
by the Cloud Platform Appliance, so it may not match the timestamp when the original cloud API request
was sent.
— Comment: Information about this tenant.
— Network Views: The network view to which this tenant belongs.
— Managed: Indicated whether this tenant is a managed or an unmanaged object in NIOS.
— Site: The value entered for this predefined extensible attribute.
You can also select other cloud extensible attributes for display by clicking the down arrow next to any column
header and selecting Columns -> Edit Columns.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 389

Deploying Cloud Network Automation

Viewing All VPCs (Virtual Private Clouds)

The VPCs tab displays all AWS VPCs . You can also manage selected VPCs, primarily for changing permissions,
defining or changing extensible attributes, and changing the delegation settings for a VPC to a different NIOS Cloud
member. An Amazon VPC is analogous to a network container in NIOS, and is hence represented as a network
container with a special icon.
To view all VPCs:
1. From the Cloud tab, click the VPCs tab.
2. Grid Manager displays the following information for each VPC:
— Actions: Click the action icon (shown as a gear in each row) next to a selected tenant and choose from
the following:
— Edit: Modify certain general properties.
— Extensible Attributes: Add or modify extensible attributes.
— Permissions: Modify the administrative permissions.
— Mgmt Platform: Displays the CMP that manages the VPC. When it displays Amazon, it indicates a successful
validation of the Amazon account from NIOS to AWS.
— VPC Name: The AWS virtual private cloud name. The name is automatically defined by AWS. Each VPC name
is a link that opens the Networks tab for the selected VPC. This page lists the individual private networks
that exist within the VPC.
— Networks: The number of individual private networks contained in the VPC.
— VMs: The number of Amazon EC2 virtual machine instances currently discovered in the VPC. (You can run a
vDiscovery in any VPC.) For information about how to start a vDiscovery, see Configuring vDiscovery Jobs on
page 630.
— Tenants: The number of cloud tenants associated with each VPC.
— Cloud Usage: indicates whether the VPC is associated with any specific cloud extensible attributes or within
a scope of delegation. It can be one of the following:
— Cloud from adapter: Indicates that this object has been created by a cloud adapter and it may or may
not be within a scope of delegation at the moment.
— Cloud from delegation: Indicates that this object is within the scope of delegation or the object itself
defines a scope of authority delegation, and it is not created by a cloud adapter.
— Used by cloud: Indicates that this network or network container is associated with the extensible
attribute Is External or Is Shared and the value is set to True, which implies the network is a private or
shared network managed by the CMP, and it is not Cloud from adapter or Cloud from delegation.
— Non-cloud: The object is a regular NIOS object and is not within the scope of any authority delegation
nor is it associated with any of these extensible attributes: Cloud API Owned, Is External or Is Shared.
NIOS admin users can modify this object based on their permissions.
— Owned By: A cloud object can be owned by the Grid Master or the cloud adapter. When the object is created
by the Grid Master, this shows Grid. If the object is created by the cloud adapter, this shows Cloud Adapter.
— Delegated to: The NIOS Cloud appliance to which management of the AWS VPC is delegated. This field tells
you whether or not a cloud object (in this case, a virtual private cloud) has been delegated to a Cloud
Platform Appliance.
— Network: The network IP. The network listed in this column for the VPC is also viewable from the main Data
Management –> IPAM tab.
— Site: Extensible Attribute listing the site information for the VPC.
— Availability Zone: the Amazon availability zone in which the VPC resides.
You can also select other cloud extensible attributes for display by clicking the down arrow next to any column
header and selecting Columns -> Edit Columns.

390 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Cloud Objects

Viewing All Cloud Networks

The Networks tab displays all IPv4 and IPv6 networks and network containers from the CMP as well as all delegated
networks. You can select a specific network or network container and modify its properties in the Cloud IPv4 Network
or Cloud IPv6 Network editor.
To view all cloud networks and network containers:
1. From the Cloud tab, click the Networks tab.
2. Grid Manager displays the following information for each network and network container:
• Actions: Click the action icon (shown as a gear in each row) next to a selected tenant and choose from
the following:
— Go to Tenant: Go to the Tenant tab to view associated tenant.
— Go To DHCP Network Details: Go to the DHCP -> Networks tab to view associated details.
— Go To IPAM Network Details: Go to the IPAM -> Networks tab to view associated details.
— Go To Network View Details: Go to the IPAM -> Network View tab to view associated details.
— Edit: Modify certain general properties.
— Extensible Attributes: Add or modify extensible attributes.
— Permissions: Modify the administrative permissions.
• Mgmt Platform: Displays the CMP that manages the network. When it displays Amazon, it indicates a
successful validation of the Amazon account from NIOS to AWS.
• Network: The IP address and netmask of the network.
• Tenant: The associated tenant for the network.
• VPC Name: The name of the associated VPC in AWS.
• Cloud Usage: This field indicates whether this object is associated with any specific cloud extensible
attributes or within a scope of delegation. It can be one of the following:
— Cloud from adapter: Indicates that this object has been created by a cloud adapter and it may or may
not be within a scope of delegation at the moment.
— Cloud from delegation: Indicates that this object is within the scope of delegation or the object itself
defines a scope of authority delegation, and it is not created by a cloud adapter.
— Used by cloud: Indicates that this network or network container is associated with the extensible
attribute Is External or Is Shared and the value is set to True, which implies the network is a private or
shared network managed by the CMP, and it is not Cloud from adapter or Cloud from delegation.
— Non-cloud: The object is a regular NIOS object and is not within the scope of any authority delegation
nor is it associated with any of these extensible attributes: Cloud API Owned, Is External or Is Shared.
NIOS admin users can modify this object based on their permissions.
• Owned By: A cloud object can be owned by the Grid Master or the cloud adapter. When the object is created
by the Grid Master, this shows Grid. If the object is created by the cloud adapter, this shows Adapter.
• Delegated To: This tells you whether a cloud object has been delegated to a Cloud Platform Appliance or
not. If the cloud object has a parent object and the parent has been delegated, this field shows the parent
delegation and you cannot modify the field.
— Network View: The network view to which this network belongs.
— Active Users: Displays the number of active users on the selected network.
— Site: The value entered for this predefined extensible attribute.
You can also select other cloud extensible attributes for display by clicking the down arrow next to any column
header and selecting Columns -> Edit Columns.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 391

Deploying Cloud Network Automation

Viewing All Cloud VMs

The VMs tab lists all cloud VMs by IP addresses. A VM object is an abstract object representing a virtual machine that
is running on the CMP. A VM belongs to one and only one tenant. However, the same VM may have more than one IP
addresses (including unmanaged IP addresses) associated with it. Each VM may have an IP address that is part of an
overlapping private IP address space and one or more IP addresses in the shared or external networks.
A VM object in NIOS can be a collection of supported object types that have the same value for the extensible attribute
VM ID. Only the following NIOS object types are considered as existing VMs when they are tagged with the VM ID
attribute: Host Record, A Record, AAAA Record, and PTR Record, and Fixed Address. A VM object may be defined by
objects from different network views, and it can have more than one IP addresses associated with it.

Note: Since a VM can be defined by objects from different network views, the same IP address may appear multiple
times if it has been defined in more than one network view. A VM object is a read-only abstract object,
therefore you cannot create, modify, or delete it.

After a vDiscovery job is completed, the appliance displays discovered data for each VM in this tab. Available data is
displayed based on the vDiscovery configuration and your CMP. For example, if your CMP is AWS, discovered data can
include the VPC to which the VM belongs. You can click a VM name and drill down to the Networks and IP Addresses
sub tabs to view networks and IP addresses associated with the selected VM. For more information about vDiscovery,
see Configuring vDiscovery Jobs on page 630.
Note that in addition to managing discovered data through Grid Manager, you can clear any managed or unmanaged
discovered data, or clear all discovery data related to a vDiscovery job through a cloud API request. You can use this
feature to properly identify VMs that you spin up or de-provision through a cloud adapter. For example, when you use
Infoblox IPAM Plug-In for VMware as the cloud adapter to de-provision a VM, you can send a cloud API call to remove
the discovered data for this VM so you can avoid IP address conflict with IP addresses manually allocated by the
VMware vCenter. For information about cloud API requests, see About Cloud API Requests on page 369.
In the VMs tab, discovered VMs are highlighted in different background colors, as follows:
• Yellow: Unmanaged VMs that do not have associated NIOS objects.
• White: Discovered VMs that have at least one associated NIOS object and there is no conflicting
information between the discovered data and the NIOS data.
• Red: Discovered VMs that have at least one associated NIOS object and there is conflicting information
between the discovered data and the NIOS data. Depending on the nature of the conflict, you can resolve
them as described in Resolving Conflicting Addresses on page 647. You may also be able to convert or
clear unmanaged data, as described in Managing Unmanaged Data on page 645.
To view all VM objects in NIOS:
1. From the Cloud tab, click the VMs tab.
2. Grid Manager displays the following information for all cloud VM by IP address:
• Actions: Click the action icon (shown as a gear in each row) next to a selected tenant and select the
action you want to perform.
• Mgmt Platform: Displays the CMP to which this tenant belongs. This can be Amazon, OpenStack, or
VMware.
• VM Name: The name of the VM.
• VM ID: The unique tenant ID to which this VM belongs.
• Networks: The number of networks that belong to this VM.
• IP Address: The IP address of the VM.
• VM VPC: The VPC to which this VM belongs.
• VM Tenant: The tenant to which this VM belongs.
• Port ID: The port ID for the VM.
• Network View: The network view to which this VM belongs.
• Active Users: The number of active users on the selected network.

392 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Cloud Objects

• FQDN: The FQDN of the VM.

• VM Last Updated: The timestamp when the VM data was last updated.
• First Discovered: The timestamp when the VM was first discovered.
• Last Discovered: The timestamp when the VM was last discovered.
• Comment: Information about the VM.
Depending on you CMP, you can also select additional discovered fields to be displayed in the VMs tab by
clicking the down arrow next to any column header and selecting Columns -> Edit Columns. Note that some of
these fields contain discovered data that is only relevant to your CMP.

Viewing All Cloud Platform Members

The Members tab displays all members that are currently running the cloud API service.
To view all cloud members in NIOS:
1. From the Cloud tab, click the Members tab.
2. Grid Manager displays the following information for each member:
• Actions: Click the action icon (shown as a gear in each row) next to a selected tenant and select the
action you want to perform.
• Name: The member name.
• Status: The current status of this member.
• Comment: Information about this cloud member.
• Site: The value entered for this predefined extensible attribute.
Select other cloud extensible attributes for display by clicking the down arrow next to any column header and
selecting Columns -> Edit Columns.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 393

Deploying Cloud Network Automation

394 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 8 Managing Appliance Operations
Managing the operations of a NIOS appliance involves defining system parameters such as time, security, and port
settings. It also includes configuring operations such as scheduling tasks, defining approval workflows, managing
licenses, managing extensible attributes, and configuring access control for supported operations.
The tasks covered in this chapter include:
• Configuring Access Control on page 398
— Administrative Permissions on page 398
— Operations that Support Access Control on page 398
— Defining Named ACLs on page 400
— Managing Named ACLs on page 401
— Applying Access Control to Operations on page 403
• Managing Time Settings on page 404
— Changing Time and Date Settings on page 404
— Changing Time Zone Settings on page 404
— Monitoring Time Services on page 405
• Using NTP for Time Settings on page 405
— Authenticating NTP on page 406
— NIOS Appliances as NTP Clients on page 408
— Configuring the Grid to Use NTP on page 409
— Configuring Grid Members to Use NTP on page 411
— NIOS Appliances as NTP Servers on page 413
— Configuring a NIOS Appliance as an NTP Server on page 414
— Monitoring NTP on page 416
• About Extensible Attributes on page 417
— Adding Extensible Attributes on page 419
— Configuring Inheritable Extensible Attributes on page 421
— Using Extensible Attributes on page 427
— Viewing Extensible Attributes on page 425
— Modifying Extensible Attributes on page 425
— Deleting Extensible Attributes on page 427
— Configuration Examples for Inheritable Extensible Attributes on page 430

NIOS 7.3 NIOS Administrator Guide (Rev. A) 395

Managing Appliance Operations

• Managing Security Operations on page 439

— Enabling Support Access on page 439
— Enabling Remote Console Access on page 439
— Permanently Disabling Remote Console and Support Access on page 439
— Restricting GUI/API Access on page 439
— Enabling HTTP Redirection on page 440
— Modifying the Session Timeout Setting on page 440
— Disabling the LCD Input Buttons on page 440
— Configuring Security Features on page 440
• Configuring Proxy Servers on page 442
— Configuring Members and Interfaces for Automatic Updates on page 443
• Configuring Ethernet Ports on page 443
— Enabling GUI and API Access on the MGMT and LAN1/VIP Ports on page 444
— About Virtual LANs on page 444
— Implementing Quality of Service Using DSCP on page 447
— Ethernet Port Usage on page 448
— Modifying Ethernet Port Settings on page 456
— Using the LAN2 Port on page 457
— About Port Redundancy on page 457
— Configuring the LAN2 Port on page 459
— Enabling DHCP on LAN2 on page 459
— Enabling DNS on LAN2 on page 460
• Using the MGMT Port on page 461
— Appliance Management on page 462
— Grid Communications on page 463
— DNS Services on page 465
• About Lights Out Management on page 467
— Enabling LOM on page 468
— Modifying LOM Settings on page 470
— Viewing LOM Users on page 470
— IPMI Commands and Examples on page 470
• Setting Static Routes on page 472
• Enabling DNS Resolution on page 477
• Managing Licenses on page 478
— License Types on page 478
— Managing Static Licenses on page 478
— Managing Dynamic Licenses on page 481
— Adding Permanent Licenses on page 482
— Adding Temporary Licenses on page 483
— Viewing Licenses on page 483
— Backing Up Licenses on page 485
— Removing Licenses on page 485
• About Elastic Scaling on page 486
— Using Elastic Scaling to Pre-provision and Launch vNIOS Members on page 486
— Generating Tokens for Grid Members on page 487

396 NIOS Administrator Guide (Rev. A) NIOS 7.3

 — Using CLI Commands to Join Grid Members on page 488
• Managing the Order of Match Lists on page 489
• Managing NIOS Appliances on page 489
— Restarting a Grid Member on page 489
— Rebooting a NIOS Appliance on page 490
— Shutting Down a NIOS Appliance on page 490
— Forcing an HA Failover on page 490
— Restarting GUI Sessions on page 491
— Resetting a NIOS Appliance on page 491
• Managing the Disk Subsystem on the Infoblox-4010 on page 492
— About RAID 10 on page 492
— Evaluating the Status of the Disk Subsystem on page 493
— Disk Drive Front Panel LEDs on page 494
— Replacing a Failed Disk Drive on page 494
— Disk Array Guidelines on page 495
• Restarting Services on page 496
— Restarting Grid Services on page 496
— Restarting Member Services on page 497
— Restarting Services by Groups on page 498
— Configuring Restart Settings on page 501
— Canceling a Scheduled Restart Task on page 501

NIOS 7.3 NIOS Administrator Guide (Rev. A) 397

Managing Appliance Operations

Configuring Access Control

To effectively manage your core network services, you can grant legitimate hosts access to specific tasks and
operations using an access control list (ACL) or anonymous access control entries (ACEs). Depending on your admin
permissions, you can configure a named ACL, and then apply it to multiple operations, such as file distribution and
DNS zone transfers. For information about admin permissions, see About Administrative Permissions on page 195.
When you define a named ACL, you add access control types such as IPv4 and IPv6 addresses, IPv4 and IPv6
networks, nested named ACLs, and TSIG key based ACEs to a list, and then grant each entry in the list the Allow or
Deny permission. For information about named ACLs and how to configure them, see Defining Named ACLs on page
400. Note that each operation supports specific access control types. You cannot apply a named ACL to an operation
that does not support the access control types contained in the named ACL. For more information about which NIOS
operations support access control and which access control types each operation supports, see Operations that
Support Access Control on page 398.
When you add or modify a named ACL, or when you import named ACLs and ACEs to an existing named ACL through
CSV import, the appliance does not automatically validate the ACEs in the list. For more information about how to
import named ACLs and ACEs, refer to the Infoblox CSV Import Reference. To avoid conflicts and unexpected results,
you must perform validations for all named ACLs before you use them for access control. When the appliance detects
a conflict or an optimized issue about a specific ACE during the validation process, it displays detailed information
in a CSV file. For more information about ACL validation, see Validating Named ACLs on page 401.

Administrative Permissions
You can configure a named ACL at the Grid level and override it at the member and object level. Superusers and
limited-access users with Read/Write permission to All Named ACLs can create, modify, and delete named ACLs.
Users with Read-only permission to All Named ACLs can apply a named ACL to a supported object if they have
Read/Write permission to the respective object. Other users can only view named ACLs and their entries. For
information about admin permissions, see About Administrative Permissions on page 195.

Operations that Support Access Control

On the appliance, only certain operations support access control. You can apply one named ACL or multiple
anonymous ACEs to each operation. However, you cannot apply multiple named ACLs or use a combination of named
ACLs and ACEs. Note that each operation supports different access control types. For example, DNS zone transfers
support IPv4 and IPv6 addresses and networks as well as TSIG key based ACEs, while AAAA filtering supports only
IPv4 addresses and networks.
When you apply a named ACL to an operation, the appliance validates to ensure that the named ACL contains ACEs
that are supported by the operation. The appliance also validates any new ACEs that you add to an existing named
ACL. If a named ACL contains access control types that an operation does not support, the appliance displays an error
message and you cannot apply that named ACL to the operation. Thus when defining a named ACL for a specific
operation or applying an existing named ACL, ensure that it contains access control types that the operation
supports. Table 8.1 lists access control types for NIOS operations that support access control.

398 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Access Control

Table 8.1 Operations that Support Access Control

Supported Access Control Types

IPv4 IPv6 Any

Operation Type Addresses Addresses DNSone
TSIG Key Address
2.x TSIG
and and Based ACEs and
Networks Networks Key Network
GUI and API Access Yes Yes No No No
NTP Service and NTP Queries Yes Yes No No Yes
File Distribution Services Yes No No No No
Syslog Proxy Access Control Yes Yes No No No
DNS Zone Transfers (excludes zone Yes Yes Yes Yes Yes
transfers for Microsoft servers)*
Dynamic DNS Updates Yes Yes Yes No Yes
DNS Queries Yes Yes Yes No Yes
Recursive Queries Yes Yes Yes No Yes
Blackhole Lists Yes Yes No No Yes
AAAA Filtering Yes No No No Yes
Forward DNS Updates Yes Yes Yes No Yes
Match Clients for DNS Views Yes Yes Yes Yes Yes
Match Destinations for DNS Views Yes Yes Yes Yes Yes
DNS64 Clients Yes Yes No No Yes
DNS64 Mapped Yes No No No Yes
DNS64 Exclude IPv6 No Yes No No Yes

Note: * Zone transfers for Microsoft servers do not support named ACLs. However, you can still use individual ACEs
to configure access control. For more information about how to configure zone transfer settings for Microsoft
servers, see Setting Zone Properties on page 1288. In addition, the DNSone 2.x TSIG key supports only the
“Allow” permission. You cannot change “Allow” to “Deny.”

Complete the following tasks to use a named ACL:

1. Define a named ACL, as described in Defining Named ACLs on page 400.
2. Validate the named ACL, as described in Validating Named ACLs on page 401.
3. Apply the named ACL to specific operations, as described in Applying Access Control to Operations on page 403.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 399

Managing Appliance Operations

Defining Named ACLs

Depending on how you plan to use a named ACL and which access control types an operation supports, you can add
one or all of the following when you define a named ACL: IPv4 and IPv6 addresses, IPv4 and IPv6 networks, TSIG key
based ACEs, DNSone 2.x TSIG keys. You can also add an existing named ACL as a nested ACL to a new or existing
named ACL.
When configuring a named ACL, ensure that you define it correctly for the intended operations using the supported
access control types. For example, if you want to apply a named ACL to AAAA filtering, do not include IPv6 addresses
or networks in the named ACL because AAAA filtering does not support IPv6 addresses and networks. For information
about supported access control types, see Table 8.1.
To define a named ACL:
1. From the Administration tab, select the Named ACLs tab, and then click the Add icon.
2. In the Add Named ACL wizard, complete the following:
— Name: Enter a name for the named ACL. You can enter up to 64 characters.
— Comment: Enter additional information about the named ACL.
3. Click Next. Complete the following to add ACEs to the named ACL:
— Click the Add icon and select one of the following access control types from the drop-down list. Depending
on your selection, Grid Manager adds a row to the table directly or expands the panel before adding a row.
— IPv4 Address: Select this to add an IPv4 address. Click the Entry field and enter the IPv4 address. The
Operation column displays Allow by default. You can change it to Deny by clicking the field and
selecting Deny from the drop-down list.
— IPv4 Network: When you select this, enter the network address in the Address field, select the netmask
using the slider, and then select Allow or Deny from the Permission drop-down list. Click Add and Grid
Manager adds the entry to the table.
— IPv6 Address: Select this to add an IPv6 address. Click the Entry field and enter the IPv6 address. The
Operation column displays Allow by default. You can change it to Deny by clicking the field and
selecting Deny from the drop-down list.
— IPv6 Network: When you select this, enter the network address and its netmask in the Address field,
and then select Allow or Deny from the Permission drop-down list. Click Add and Grid Manager adds
the entry to the table.
— TSIG Key: In the Add TSIG Key panel, complete the following, and then click Add to add the TSIG key to
the list:
• Key name: Enter a meaningful name for the key, such as a zone name or the name of the remote
name server. This name must match the name of the same TSIG key on other name servers.
• Key Algorithm: Select either HMAC-MD5 or HMAC-SHA256.
• Key Data: To use an existing TSIG key, type or paste the key in the Key Data field. Alternatively, you
can select the key algorithm, select the key length from the Generate Key Data drop down list, and
then click Generate Key Data to create a new key.
— DNSone 2.x TSIG Key: Select this when the client is a NIOS appliance running DNS One 2.x code. The
appliance automatically populates the value of the key in the Entry field. The Operation column
displays Allow by default. You cannot change the default permission.
— Any Address/Network: Select this to allow or deny permission for any addresses and networks.
— Named ACL: When you select this, Grid Manager displays the Named ACLs Selector. Select the named
ACLs you want to add to the new ACL. If you have only one existing named ACL, Grid Manager
automatically adds the named ACL to the list. The selected named ACL becomes a nested ACL in the
newly created named ACL.

Note: The Order field in the table displays the position of each entry based on the order it is placed in the list.
You can modify this number to change the order of an ACE. You can also select the ACE check box and use
the up and down arrows next to the table to place the entry in the desired position.

400 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Access Control

4. Click Next to enter extensible attributes for the named ACL. For information, see About Extensible Attributes on
page 417.
5. Save the configuration.

Managing Named ACLs

You can do the following after you have configured named ACLs for access control:
• Preview the list of ACEs in a named ACL, as described in Previewing ACEs in Named ACLs on page 401.
• Validate ACEs in a named ACL, as described in Validating Named ACLs on page 401.
• View a complete list of configured named ACLs, as described in Viewing Named ACLs on page 402.
• Modify information in a named ACL, as described in Modifying Named ACLs on page 403.
• Apply a named ACL to supported operations, as described in Applying Access Control to Operations on page
403.
• Delete a named ACL, as described in Deleting Named ACLs on page 403.
• Export and print the list of named ACLs.

Previewing ACEs in Named ACLs

You can preview the list of ACEs in a named ACL when you add or modify it. When you click the Preview icon in the
Add Named ACL wizard or Named ACL editor, the appliance lists all the entries in the named ACL, even if you have
selected only one or a few entries in the wizard or editor.
To preview a named ACL:
1. From the Administration tab, select the Named ACLs tab -> named_acl check box, and then click the Preview icon.
2. In a separate browser window, Grid Manager displays the following information for each ACE in the named ACL:
— Entry: Displays one of the following: IPv4 or IPv6 address, IPv4 or IPv6 network, or TSIG key. Note that if the
named ACL contains nested ACLs, all entries in the nested ACLs are displayed in a flat view. Grid Manager
does not display the name of the nested ACL.
— Type: The access control type of the entry. This can be IPv4 Address, IPv6 Address, IPv4 Network, IPv6
Network, TSIG Key, or DNSone 2.x TSIG Key.
— Operation: Displays the access permission for the entry. This can be Allow or Deny.

Validating Named ACLs

When you add or modify a named ACL, the appliance does not automatically validate the ACEs in the list. In addition,
when you import named ACLs or ACEs to a named ACL, no automatic validation is performed. To avoid unintended
consequences, ensure that you validate your named ACLs before you save them or use them for access control.

Note: When you click the Validate icon in the Add Named ACL wizard or Named ACL editor, the appliance validates
all the entries in the named ACL, even if you have selected only one or a few entries in the wizard or editor.

The following examples demonstrate the importance of validating named ACLs:

Example 1
You configure a named ACL “foo” that includes a Deny permission to 10.0.0.0/16. You then assign “foo” to DNS zone
transfers. You later import an “Allow/10.0.0.0/24” entry to “foo” through CSV import. The appliance appends the
entry to the end of “foo.” When you perform an ACL validation on “foo” after a DNS service restart, the appliance
displays a warning message indicating that the new “Allow/10.0.0.0/24” entry is now included in the previously
configured “Deny/10.0.0.0/16” entry. Since DNS service works on a first-match access control basis, zone transfers
will not be allowed for the 10.0.0.0/24 network, which is probably not your original intent. You can then modify the
named ACL to correct this error. On the other hand, if you do not perform the ACL validation, the appliance is not
notified about the new network entry in “foo.” As a result, you are not notified about the denial of zone transfers to
10.0.0.0/24.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 401

Managing Appliance Operations

Example 2
You add a nested named ACL “bar” as the first entry to the named ACL “foo.” You then add a “Deny All” entry right
after “bar” (as the second entry). You later import a new “Allow All” entry to “bar” through CSV import. The “Allow
All” entry will be appended to the end of “bar.” When you perform an ACL validation on “foo” after the CSV import,
the appliance detects a conflict between the “Allow All” (in “bar”) and “Deny All” (right after “bar”) permissions and
displays a warning. Imagine if you do not perform the ACL validation on “foo,” the appliance is not notified about the
new “Allow All” entry in “bar” and therefore cannot detect the conflict between the “Allow All” and “Deny All” entries.
As a result, almost all hosts will get zone transfers, which may not be the outcome you have intended.

Note: It is important that you manually validate each named ACL after a CSV import to ensure data and performance
integrity. The appliance does not automatically perform ACL validation.

To validate a named ACL:

1. From the Administration tab, select the Named ACLs tab -> named_acl check box, and then click the Validate icon.
or
In the Add Named ACL wizard or Named ACL editor, click the Validate icon.
2. Grid Manager validates all the ACEs in the named ACL and displays a system message at the top of the screen
indicating whether all ACEs in the named ACL are valid or not, depending on the validation results. When the
appliance detects conflicts or issues related to specific ACEs, it displays the results in a CSV file. You can save
the file or open it. Grid Manager displays the following information in the file:
— Defined ACL: The name of the named ACL.
— Type of Issue: The type of issue found. This can be one of the following:
— Optimize: An ACE is a duplicate of a previous entry or an ACE configuration can be a subset of another
entry. See optimized suggestions in the Issue field.
— Conflict: The same IP address or network has a conflicting permission. Re-configure the ACE based on
your requirements.
— Warning: An ACE is a subset of a previously configured entry, but it has a conflicting permission.
— ACE A: The ACE that has a conflict or an optimized issue with ACE B.
— ACE B: The ACE that has a conflict or an optimized issue with ACE A.
— Issue: Detailed information and optimized suggestions about the conflict or issue.

Note: It may take a long time to validate a named ACL that contains a large number of ACEs.

Viewing Named ACLs

To view a list of named ACLs:
• From the Administration tab, select the Named ACLs tab. Grid Manager displays the following information for
each named ACL:
— Name: The name of the named ACL.
— Comment: Information about the named ACL.
— Site: The site to which the named ACL belongs. This is one of the predefined extensible attributes.
You can also do the following in the Named ACLs tab:
• Modify data in the table. Double click a row, and either modify the data in the field or select an item from a
drop-down list. Click Save to save the changes or Cancel to exit.
• Sort the named ACLs in ascending or descending order by column.
• Select a named ACL and click the Edit icon to modify data, or click the Delete icon to delete it.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.

402 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Access Control

• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Print and export data in this tab.

Modifying Named ACLs

You can modify ACEs in an existing named ACL. When you update a named ACL, the appliance validates the updates
to ensure that ACEs in the named ACL are valid for the operations to which the name ACL has been applied. For
example, if a named ACL is used for file distribution access, you are not allowed to add IPv6 address access control
to it because the file transfer operation does not support IPv6 addresses.
To modify a named ACL:
1. From the Administration tab, select the Named ACLs tab -> named_acl check box, and then click the Edit icon.
2. The Named ACL editor provides the following tabs from which you can modify data:
— Genera Basic: You can modify data in this tab as described in Defining Named ACLs on page 400.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific named ACL.
You can also modify the values of the extensible attributes. For information, see About Extensible Attributes
on page 417.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.

Deleting Named ACLs

When you delete a named ACL, the appliance puts it in the Recycle Bin, if enabled. You can restore the named ACL
later if needed.

Note: You cannot delete a named ACL that has been applied to an operation or is currently in use by another
operation.

To delete a named ACL:

1. From the Administration tab, select the Named ACLs tab -> named_acl check box, and then click the Delete icon.
You can select multiple named ACLs for deletion.
2. In the Delete Confirmation dialog box, click Yes.

Applying Access Control to Operations

When you apply access control to NIOS operations, you can use anonymous ACEs or a named ACL. You cannot
combine ACEs and named ACLs for access control. Depending on the access control types each operation supports,
you may or may not be able to apply a named ACL to a specific operation. For information about which access control
types each operation supports, see Table 8.1 on page 399.

Note: If you disable access control or select None or Any for an operation, the appliance removes the previously
applied named ACL or the configured anonymous ACEs. To avoid losing your ACE configuration, Infoblox
recommends that you convert the ACEs to a named ACL.

For information about how to apply access control to each supported operation, see the following:
• DNS zone transfers, as described in Enabling Zone Transfers on page 788
• DNS queries, as described in Controlling DNS Queries on page 767
• Recursive queries, as described in Enabling Recursive Queries on page 769
• Dynamic DNS updates, as described in Enabling DNS Servers to Accept DDNS Updates on page 928
• AAAA filtering, as described in Controlling AAAA Records for IPv4 Clients on page 770
• Blackhole list, as described in Configuring a DNS Blackhole List on page 794
• Match clients list for DNS views, as described in Defining Match Clients Lists on page 815

NIOS 7.3 NIOS Administrator Guide (Rev. A) 403

Managing Appliance Operations

• Match destinations for DNS views, as described in Defining a Match Destinations List on page 817
• DNS64 clients, DNS64 mapped IPv4 addresses, and DNS64 excluded IPv6 addresses, as described in Setting
DNS64 Group Properties on page 800
• File distribution services, as described in Configuring Access Control for File Distribution on page 508
• Grid Manager and API access, as described in Configuring Security Features on page 440
• NTP access control, as described in Defining NTP Access Control on page 414
• Syslog proxy access, as described in Configuring Syslog for Grid Members on page 1339

Managing Time Settings

You can define the date and time settings for your NIOS appliance using the Infoblox Appliance Startup Wizard.
Alternatively, you can set the date and time of the appliance anytime after you first configure it if you did not do so
using the startup wizard or if you need to change it if, for example, you move an appliance from a location in one time
zone to a location in a different time zone. To set the date and time of the appliance, you can either manually enter
the values or configure the appliance to synchronize its time with a public NTP server.

Changing Time and Date Settings

If you do not use the NTP service, you can set the date and time for a Grid.

Note: You cannot manually set the date and time if the NTP service is enabled.

To set the time and date for a Grid using the Grid Properties editor:
1. From the Grid tab, select the Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
2. In the General tab of the Grid Properties editor, complete the following:
— Date: Click the calendar icon to select a date or enter the date in YYYY-MM-DD format.
— Time: Click the clock icon to select a time or enter the time in HH:MM:SS format. For afternoon and evening
hours, use the integers 13-24.
3. Save the configuration and click Restart if it appears at the top of the screen.

Note: Changing the date and time resets the application and terminates the management session.

Changing Time Zone Settings

Whether you enable NTP (Network Time Protocol) or manually configure the date and time, you must always set the
time zone manually. You can set the time zone for a Grid, which then applies to all members. If different members are
in different time zones, you can choose the time zone that applies to most members at the Grid level, and then
override the setting for the remaining members.

Note: Changing the time zone does not reset the application nor does it terminate the management session.

To set the time zone for a Grid or member:

1. Grid: From the Grid tab, select the Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then
click the Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the General tab of the editor, select the appropriate time zone.
3. Save the configuration and click Restart if it appears at the top of the screen.

404 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using NTP for Time Settings

Monitoring Time Services

In a Grid, the Grid Master and its members use an internal NTP daemon to synchronize their time. It is not
user-configurable and functions regardless of how you set the time on the Grid Master. The Detailed Status panel
contains an NTP Synchronization icon so you can monitor the internal NTP daemon that runs within a Grid to ensure
the time among its members is synchronized.
To display the Detailed Status panel, from the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member
check box, and then click the Detailed Status icon in the table toolbar of the Members panel.
The following are descriptions of the NTP status icons in the Detailed Status panel:

Icon Color Meaning

Green The NTP service is running properly.

Yellow The appliance is synchronizing its time.

Red The NTP service is not running properly. View the corresponding description for additional
information.

Using NTP for Time Settings

Note: vNIOS Grid members on Riverbed can be NTP clients only.

NTP (Network Time Protocol) is a standard protocol that system clocks use to ensure their time is always accurate.
Appliances that use NTP try to get their time as close as possible to UTC (Coordinated Universal Time), the standard
timescale used worldwide. NTP uses UDP (User Datagram Protocol) on port 123 for communications between clients
and servers.
NTP is based on a hierarchy where reference clocks are at the top. Reference clocks use different methods such as
special receivers or satellite systems to synchronize their time to UTC. NTP servers on the first level of the hierarchy
synchronize their time with the reference clocks, and serve time to clients as well. Each level in the hierarchy is a
stratum; stratum-0 is a reference clock. Stratum-1 servers synchronize their clocks with reference clocks. Stratum-2
servers synchronize their clocks with stratum-1 servers, and so forth. The stratum number indicates the number of
levels between the NTP server and the reference clock. A higher stratum number could indicate more variance
between the NTP server and the reference clock.
You can configure a NIOS appliance to function as an NTP client that synchronizes its clock with an NTP server. For
more information, see NIOS Appliances as NTP Clients on page 408. NTP clients typically use time information from
at least three different sources to ensure reliability and a high degree of accuracy. There are a number of public NTP
servers on the Internet with which the NIOS appliance can synchronize its clock. For a list of these servers, you can
access http://www.ntp.org. When NTP is configured, it listens on all interfaces, including the loopback interface on
the NIOS appliance.
In a Grid, the Grid Master and Grid members can function as NTP clients that synchronize their clocks with external
NTP servers. They can in turn function as NTP servers to other appliances in the network. For more information, see
NIOS Appliances as NTP Servers on page 413. Note that when the Grid Master functions as an NTP server, it
synchronizes its local clock with its NTP clients and does not synchronize time with any other external NTP server.
This allows you to deploy multiple NTP servers to ensure accurate and reliable time across the network. To configure
the Grid Master and Grid members as NTP clients, you must first enable the NTP service and configure external NTP
servers at the Grid level. You can then configure the Grid Master and Grid members to override the Grid-level NTP
servers and use their own external NTP servers. Note that a Grid member will not function as an NTP client if you do
not enable the NTP service at the Grid level. A Grid member synchronizes its clock with the Grid Master if you do not
configure it to use external NTP servers.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 405

Managing Appliance Operations

Figure 8.1 illustrates how NIOS appliances (the Grid Master and Grid members) in a Grid function as the NTP server
or the NTP client, depending on your NTP configuration.

Note: The NTP service supports both IPv4 and IPv6 networks.

Figure 8.1 Infoblox Appliances as NTP Servers

Internet

Stratum-1 NTP servers use reference Reference Clocks

clocks to synchronize their time to
UTC (Coordinated Universal Time).
Stratum-1 NTP Servers

Grid Member 2 synchronizes

In this example, the Grid Master—as its clock with an external NTP
an NTP client—synchronizes its time server. It also functions as a
with stratum-1 NTP servers. The Grid stratum-2 NTP server to
Master also functions as a stratum-2 external devices on its
NTP server to Grid Member 1. NTP Grid Master network.
messages between the Grid Master
and Grid Member 1 go through Grid
encrypted VPN tunnels. Member 2

VPN
As an NTP client, Grid Member 1 Grid Tunnel
synchronizes its clock with the Grid Member 1
Master. It also functions as a
stratum-3 NTP server to external
devices on its network.
2 Network

1 Network

Authenticating NTP
To prevent intruders from interfering with the time services on your network, you can authenticate communications
between a NIOS appliance and a public NTP server, and between a NIOS appliance and external NTP clients. NTP
communications within the Grid go through an encrypted VPN tunnel, so you do not have to enable authentication
between members in a Grid.
NTP uses symmetric key cryptography, where the server and the client use the same algorithm and key to calculate
and verify a MAC (message authentication code). The MAC is a digital thumbprint of the message that the receiver
uses to verify the authenticity of a message.
As shown in Figure 8.2, the NTP client administrator must first obtain the secret key information from the
administrator of the NTP server. The server and the client must have the same key ID and data. Therefore, when you
configure the NIOS appliance as an NTP client and want to use authentication, you must obtain the key information
from the administrator of the external NTP server and enter the information on the NIOS appliance. When you
configure a NIOS appliance as an NTP server, you must create a key and send the key information to clients in a secure
manner. A key consists of the following:
• Key Number: A positive integer that identifies the key.
• Key Type: Specifies the key format and the algorithm used to calculate the MAC (message authentication code)
of a message.

406 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using NTP for Time Settings

— M: The key is a 1-31 character ASCII string using MD5 (Message Digest).
— S: The key is a 64-bit hexadecimal number in DES (Data Encryption Standard) format. The high order 7 bits
of each octet form the 56-bit key, and the low order bit of each octet is given a value so that the octet
maintains odd parity. You must specify leading zeros so the key is exactly 16 hexadecimal digits long and
maintains odd parity.
— A: The key is a DES key written as a 1-8 character ASCII string.
— N: The key is a 64-bit hexadecimal number in NTP format. It is the same as the S format, but the bits in each
octet have been rotated one bit right so the parity bit is in the high order bit of the octet. You must specify
leading zeros and odd parity must be maintained.
• Key String: The key data used to calculate the MAC. The format depends on the Key Type you select.
When the NTP client initiates a request for time services to the NTP server, it creates the MAC by using the agreed
upon algorithm to compress the message and then encrypts the compressed message (which is also called a
message digest) with the secret key. The client appends the MAC to the message it sends to the NTP server. When the
NTP server receives the message from the client, it performs the same procedure on the message — it compresses
the message it received, encrypts it with the secret key and generates the MAC. It then compares the MAC it created
with the MAC it received. If they match, the server continues to process and respond to the message. If the MACs do
not match, the receiver drops the message.

Figure 8.2 NTP Client Administrator Obtaining Secret Key from NTP Server Administrator

NTP Server Secret Key NTP Client

Administrator Information Administrator NTP Client

NTP server administrator sends the secret key

information to the NTP client administrator, who
adds the key to the NTP client.

MD5 or DES
When the NTP client sends a request for time Message Digest
services to the NTP server, it uses the agreed
Message upon algorithm and secret key to create the MAC Message
(message authorization code). It then sends the
MAC and message to the NTP server.
+
MAC MAC
Encrypted with
Secret Key

NTP server uses the agreed upon

algorithm and secret key to create the
MD5 or DES
MAC. It compares this MAC with the MAC
Message Digest
it received. If they match, the server
responds to the request of the client for
time services. If the MACs do not match,
the server ignores the message from the
MAC client.
Encrypted with
Secret Key

NIOS 7.3 NIOS Administrator Guide (Rev. A) 407

Managing Appliance Operations

NIOS Appliances as NTP Clients

You can configure an independent NIOS appliance, a Grid Master, or any Grid member in a Grid as an NTP client that
synchronizes its system clock with an external NTP server.

Note: You can configure NIOS appliance as NTP client in either IPv4, IPv6, or dual mode (IPv4 and IPv6) network
environment.

When you enable a NIOS appliance to function as an NTP client, you must specify at least one NTP server with which
the appliance can synchronize its clock. Infoblox recommends that you specify multiple NTP servers that synchronize
their time with different reference clocks and that have different network paths. This increases stability and reduces
risk in case a server fails. For a list of public NTP servers, you can access www.ntp.org.
When you specify multiple NTP servers, the NTP daemon on the appliance determines the best source of time by
calculating round-trip time, network delay, and other factors that affect the accuracy of the time. NTP periodically
polls the servers and adjusts the time on the appliance until it matches the best source of time. If the difference
between the appliance and the server is less than five minutes, the appliance adjusts the time gradually until the
clock time matches the NTP server. If the difference in time is more than five minutes, the appliance immediately
synchronizes its time to match that of the NTP server.
To secure communications between a NIOS appliance and an NTP server, you can authenticate communications
between the appliance and the NTP server. When you configure authentication, you must obtain the key information
from the administrator of the NTP server and enter the key on the appliance. For information, see Authenticating NTP
on page 406.
In a Grid, you can configure the Grid Master and Grid members to synchronize their clocks with external NTP servers.
When you enable the NTP service on the Grid, the Grid Master automatically functions as an NTP server to the Grid
members. A Grid member can synchronize its time with the Grid Master, an external NTP server, or another Grid
member. When Grid members synchronize their times with the Grid Master, the Grid Master and its members send
NTP messages through an encrypted VPN tunnel, as shown in Figure 8.3. When a Grid member synchronizes its time
with another Grid member, the NTP messages are not sent through a VPN tunnel.

408 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using NTP for Time Settings

Figure 8.3 Grid Master as NTP Client

NTP Server 1 NTP Server 2 NTP Server 3 NTP Server 4

Secret Keys The Grid Master uses three public NTP

servers to calibrate its clock to the
correct time. It uses symmetric key
cryptography to authenticate NTP
messages.
Internet

The Grid Master serves time to Grid

Member 1. All NTP communications
with the Grid go through encrypted VPN
tunnels.
Grid Master

Grid Member 2
synchronizes its clock with
VPN Tunnels a public NTP server. The
Grid Master serves as a
backup NTP server when
the member cannot reach
Grid Member 1 the public NTP server.
Grid Member 2

Configuring the Grid to Use NTP

In a Grid, the Grid Master and Grid members can synchronize their clocks with external NTP servers. They then forward
the clock time to other appliances in the network. Likewise, in an independent HA pair, the active node
communicates directly with an external NTP server. The passive node then synchronizes its clock with the active
node.
In a Grid, you must first enable the NTP service and configure external NTP servers at the Grid level before you
configure the Grid Master and Grid members as NTP clients.
To configure a Grid Master as an NTP client, perform the following tasks:
• If you want to enable authentication between the Grid members and NTP servers, you must specify the
authentication keys before enabling the NTP service. You can specify authentication keys at the Grid and
member levels. For information, see Adding NTP Authentication Keys.
• Enable the NTP service on the Grid and specify one or more external NTP servers. For information, see
Synchronizing the Grid with External NTP Servers on page 410.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 409

Managing Appliance Operations

Adding NTP Authentication Keys

To enable authentication between the appliance and the NTP servers, add the authentication keys before enabling
the NTP service on the Grid. You can specify authentication keys at the Grid and member levels.
To add NTP authentication keys:
1. Grid: From the Grid tab, select the Grid Manager tab, expand the Toolbar and click NTP -> NTP Grid Config.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box. Expand the
Toolbar and click NTP -> NTP Member Config.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. Click the Add icon in the NTP Keys section and enter the following information.
— Key Number: A positive integer that identifies a key.
— Type: Specifies the key format and the algorithm used to calculate the MAC (message authentication code)
of a message.
— MD5 in ASCII format (M): The key is a 1-31 character ASCII string using MD5 (Message Digest).
— DES in hex format (S): The key is a 64-bit hexadecimal number in DES (Data Encryption Standard)
format. The high order 7 bits of each octet form the 56-bit key, and the low order bit of each octet is
given a value so that the octet maintains odd parity. You must specify leading zeros so the key is
exactly 16 hexadecimal digits long and maintains odd parity.
— DES in ASCII format (A): The key is a DES key written as a 1-8 character ASCII string.
— DES in NTP format (N): The key is a 64-bit hexadecimal number in NTP format. It is the same as the S
format, but the bits in each octet have been rotated one bit right so the parity bit is in the high order bit
of the octet. You must specify leading zeros and odd parity must be maintained.
— String: The key data used to calculate the MAC. The format depends on the Key Type you select.
3. Click Save to save the entry and keep the editor open so you can enable the Grid to synchronize its time with
external NTP servers, as described in Synchronizing the Grid with External NTP Servers.
Note that if you enter a new key, the appliance checks if the key already exists in the key list. If the key exists, but
either the key type or key string does not match, the NIOS appliance sends an error message.
After you enter an authentication key, you can modify or delete it. Note that you cannot delete a key that an NTP server
references. You must first delete all NTP servers that reference that key and then delete the key.

Synchronizing the Grid with External NTP Servers

To enable the Grid to synchronize its time with external NTP servers:
1. From the Grid tab, select the Grid Manager tab, expand the Toolbar and click NTP -> NTP Grid Config.
2. In the General tab of the Grid NTP Properties editor, select Synchronize the Grid with these External NTP Servers.
3. Click the Add icon to add external NTP servers and enter the following information in the Add NTP Server dialog
box:
— NTP Server (FQDN or IP Address): Enter either the IP address or the resolvable host name of an NTP server.
Entries may be an IPv4 or IPv6 address. You can view a list of public NTP servers at ntp.isc.org. To check
whether the DNS server can resolve the NTP server host name, click Resolve Name. You must have a DNS
name resolver configured. For information, see Enabling DNS Resolution on page 477.
— Enable Authentication: Select this option to enable authentication of NTP communications between the
external NTP server and the NIOS appliance (the Grid Master or Grid member in a Grid, an independent
NIOS appliance, or the active node in an independent HA pair).

Note: To prevent intruders from interfering with the time services on your network, you can authenticate
communications between a Grid member and an external NTP server, as well as between a Grid member
and external NTP clients. NTP communications within the Grid go through an encrypted VPN tunnel, so you
do not have to enable authentication between the Grid Master and Grid members.

— Authentication Key: Select a key that you previously entered from the drop-down list.

410 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using NTP for Time Settings

— Click Add to add the NTP server to the list or Cancel to cancel the operation. In the table, you can configure
some of the following settings:
— Preferred: Select this to mark an external NTP server as the preferred NTP server. You can select only
one server as the preferred NTP server. NIOS uses the responses from this preferred server over
responses from other external NTP servers. A response from a preferred server will be discarded if it
differs significantly from the responses of other servers. Infoblox recommends that you select an NTP
server that is known to be highly accurate as the preferred server, such as one that has special time
monitoring hardware. Note that this option is enabled only when you have selected the check box
Synchronize the Grid with these External NTP Servers.
— Server: Displays the FQDN or IP address of the NTP server that you added.
— Authentication: When you enable authentication, this column displays Yes. Otherwise, it displays No.
— Key Number: Displays the authentication key that you have selected.
— BURST: Select this check box to configure the NTP client to send a burst of eight packets if the external
NTP server is reachable and a valid source of synchronization is available. The NTP client transmits
each packet at a regular interval of two seconds. After you add an NTP server and save the
configuration, the appliance will enable this option by default. When you deselect this check box, the
client sends a single packet only once to the server.
— IBURST: Select this check box to configure the NTP client to send a burst of eight packets if the external
NTP server is not reachable when the client sends the first packet to the server. The NTP client transmits
each packet at a regular interval of two seconds. After you add an NTP server and save the
configuration, the appliance will enable this option by default. When you deselect this check box, the
client sends a single packet only once to the server.
For information about adding NTP authentication keys, see Adding NTP Authentication Keys on page 410.
4. Save the configuration and click Restart if it appears at the top of the screen.

Configuring Grid Members to Use NTP

Once you configure a Grid member to use external NTP server, make sure that the NTP service is enabled at Grid level.
Otherwise, the Grid member will not function as an NTP client. For information, see Synchronizing the Grid with
External NTP Servers on page 410.
To configure Grid members to synchronize their time with external NTP servers:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box.
2. Expand the Toolbar and click NTP -> NTP Member Config.
3. In the General tab of the Member NTP Properties editor, do the following:
— Enable the NTP Server on this Member: Select this check box to configure a Grid Master or a Grid member as
an NTP server. If you have configured DNS anycast on the appliance, it can answer NTP requests through the
anycast IP address.
— Synchronize this Member only with the Grid Master: Select this check box to enable this Grid member to
synchronize its time with the Grid Master. This is the default.
— Synchronize this Member with other NTP Servers: Select this check box to enable this Grid member to use
external NTP servers. When you select this check box, you must enter at least one external NTP server for
the member.
— Exclude the Grid Master as an NTP Server: Select this check box if you want to exclude the Grid Master from
being one of the time sources. By default, the appliance automatically configures the Grid Master as the
backup NTP server for a Grid member. When the member cannot reach any of its configured NTP servers, it
uses the Grid Master as the NTP server. The appliance does not display the Grid Master in the NTP external
server list. For a Grid Master, this check box has no meaning.
— External NTP Servers: Click Override and then click the Add icon.
In the Add NTP Server dialog box, enter the following information:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 411

Managing Appliance Operations

— NTP Server (FQDN or IP Address): Enter either the IP address or the resolvable host name of an NTP
server. You can view a list of public NTP servers at ntp.isc.org. To check whether the DNS server can
resolve the NTP server host name, click Resolve Name. You must have a DNS name resolver configured.
— Enable Authentication: Select this check box to enable authentication of NTP communications between
the external NTP server and the NIOS appliance (the Grid Master or Grid member in a Grid, an
independent NIOS appliance, or the active node in an independent HA pair).

Note: To prevent intruders from interfering with the time services on your network, you can authenticate
communications between a Grid member and an external NTP server, as well as between a Grid member and
external NTP clients. NTP communications within the Grid go through an encrypted VPN tunnel, so you do not
have to enable authentication between the Grid Master and Grid members.

— Authentication Key: Select a key that you previously entered from the drop-down list. Note that you
must enter authentication keys at the Grid level when you configure a Grid Master or Grid member to
use external NTP servers.
— Click Add to add the NTP server to the list or Cancel to cancel the operation. In the table, click Override
in the table to override configurable settings. To inherit the same properties as the Grid, click Inherit.
• Preferred: Select this to mark an external NTP server as the preferred NTP server. You can select
only one server as the preferred NTP server. NIOS uses the responses from this preferred server
over responses from other external NTP servers. A response from a preferred server will be
discarded if it differs significantly from the responses of other servers. Infoblox recommends that
you select an NTP server that is known to be highly accurate as the preferred server, such as one
that has special time monitoring hardware. Note that this option is enabled only when you have
selected the check box Synchronize this Member with other NTP Servers.
• Server: Displays the FQDN or IP address of the NTP server that you added.
• Authentication: When you enable authentication, this column displays Yes. Otherwise, it displays
No.
• Key Number: Displays the authentication key that you have selected.
• BURST: Select this check box to configure the NTP client to send a burst of eight packets if the
external NTP server is reachable and a valid source of synchronization is available. The NTP client
transmits each packet at a regular interval of two seconds. After you add an NTP server and save
the configuration, the appliance will enable this option by default. When you deselect this check
box, the client sends a single packet only once to the server.
• IBURST: Select this check box to configure the NTP client to send a burst of eight packets if the
external NTP server is not reachable when the client sends the first packet to the server. The NTP
client transmits each packet at a regular interval of two seconds. After you add an NTP server and
save the configuration, the appliance will enable this option by default. When you deselect this
check box, the client sends a single packet only once to the server.

Note: NTP members inherit NTP properties from the Grid. Click Override in the Member NTP Properties wizard to
override configurable settings. To inherit the same properties as the Grid, click Inherit.

For information about adding NTP authentication keys, see Adding NTP Authentication Keys on page 410.
4. Save the configuration and click Restart if it appears at the top of the screen.

Managing External NTP Servers

You can specify multiple NTP servers for failover purposes. The NIOS appliance attempts to connect to the NTP servers
in the order they are listed. A Grid member uses the Grid Master as the NTP server when it cannot reach any of its
external NTP servers.
You can change the order of the list by selecting an NTP server and dragging it to its new location or by clicking the
up and down arrows. You can add and delete servers and modify their information as well.

412 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using NTP for Time Settings

NIOS Appliances as NTP Servers

After you enable NTP on a Grid, the Grid members—including the Grid Master—can function as NTP servers to clients
in different segments of the network. Similarly, after you enable NTP on an independent appliance or an HA pair, and
it synchronizes its time with an NTP server, you can configure it to function as an NTP server as well. When you
configure DNS anycast addressing on a Grid member and use it as an NTP server, the member can answer NTP
requests from other NTP clients through the anycast IP address.

Figure 8.4 Grid Members as NTP Servers

NTP Server 1 NTP Server 2 NTP Server 3

Secret Keys
The Grid Master uses three public NTP The Grid members serve time to devices on
servers to calibrate its clock to the their networks. Each member uses symmetric
correct time. It uses symmetric key key encryption to secure NTP messages. Each
cryptography to secure NTP messages. member also has an access control list that
Internet defines which appliances can access the time
services. When a client that is not on the list tries
The Grid Master serves time to the Grid to access an appliance functioning as an NTP
members. All NTP communications server, the appliance ignores the message.
with the Grid go through the encrypted
VPN tunnels.
Grid Master
Access Control List

Grid Member
VPN
Grid Member
Tunnels
X

3 Network 2 Network

To configure a NIOS appliance as an NTP server, perform the following tasks:

• Enable the appliance as an NTP server.
• Enable authentication between the appliance and its NTP clients.
• Optionally, specify which clients can access the NTP service of the appliance.
• Optionally, specify which clients can use ntpq to query the appliance.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 413

Managing Appliance Operations

Configuring a NIOS Appliance as an NTP Server

You can configure a Grid member—including the Grid Master—or an independent appliance or HA pair to function as
an NTP server. When you enable a NIOS appliance to function as an NTP server, you can enable authentication
between a NIOS appliance functioning as an NTP server and its NTP clients. When you enable authentication, you
must specify the keys that the appliance and its clients must use for authentication. In a Grid, you can enter NTP
authentication keys at the Grid level so that all the members can use them to authenticate their clients. You can also
enter keys at the member level, if you want that member to use different keys from those set at the Grid level. After
you enter the keys, you can download the key file and distribute the file to the NTP clients.
On an HA member, the NTP service runs on the active node. If there is an HA failover, the NTP service is automatically
launched after the passive node becomes active and the NTP traffic uses the HA port on one of the nodes from an HA
pair, instead of the LAN1 port. You might receive an error message indicating that the NTP is out of synchronization.
During another HA failover, the currently passive node becomes active again and the NTP traffic uses the LAN1 port,
and the NTP is back in synchronization. For information, see About HA Pairs on page 282.
To enable an appliance as an NTP server and authenticate NTP traffic between a NIOS appliance and an NTP client,
perform the following tasks:
• Enable an appliance as an NTP server and define authentication keys. For information, see Enabling an
Appliance as an NTP Server on page 414.
• Optionally, define NTP access control, including KoD packet configuration. For information, see Defining NTP
Access Control on page 414.
• Optionally, configure anycast addressing for DNS and use the anycast IP address for NTP requests. For
information about how to configure DNS anycast, see Configuring Anycast Addresses on page 1036.

Enabling an Appliance as an NTP Server

To enable an appliance as an NTP server and add authentication keys:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box.
2. Expand the Toolbar and click NTP -> NTP Member Config.
3. In the General tab of the Member NTP Properties editor, do the following:
— Enable the NTP Server on this Member: Select this option to configure a Grid Master or a Grid member as an
NTP server. If you have configured DNS anycast on the appliance, it can answer NTP requests through the
anycast IP address.
— Click Override in the NTP Keys section to enter NTP authentication keys at the member level. The member
uses these keys when acting as an NTP server and authenticates requests from NTP clients. Clear the check
box to use the Grid-level authentication keys.
4. Click Add in the NTP Keys section. For information, see Adding NTP Authentication Keys on page 410.
5. Save the configuration and click Restart if it appears at the top of the screen.
After you enter the authentication keys, you can download the key file (usually called ntp.keys) and distribute it to
NTP clients as follows:
1. Grid: From the Grid tab, select the Grid Manager tab.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box.
2. Expand the Toolbar and click NTP -> Download NTP Keys.
3. In the Opening ntp.keys dialog box, save the file, and then click OK.
4. Distribute this to the NTP clients using a secure transport.

Defining NTP Access Control

The NTP access control list specifies which clients can use a NIOS appliance as an NTP server. If you do not configure
access control, then the NIOS appliance allows access to all clients. You can configure access control at the NTP Grid
level and override that at the member level.

414 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using NTP for Time Settings

In addition, the NIOS appliance can accept queries from clients using ntpq, the standard utility program used to query
NTP servers about their status and operational parameters. You can specify from which clients the NIOS appliance is
allowed to accept ntpq queries. The appliance does not accept ntpq queries from any client, by default.
You can use an existing named ACL (access control list) or multiple ACEs (access control entries) to control which
clients can use the NIOS appliance as an NTP server, as well as those clients from which the appliance can accept
queries using ntpq. For information about access control, see Configuring Access Control on page 398.
To specify which clients can access the NTP service of a NIOS appliance and from which clients a NIOS appliance can
accept ntpq queries, and to enable or disable KoD, complete the following:
1. Grid: From the Grid tab, select the Grid Manager tab, expand the Toolbar and click NTP -> NTP Grid Config.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box. Expand the
Toolbar and click NTP -> NTP Member Config.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the Access Control tab of the Grid or Member NTP Properties editor, select one of the following to configure NTP
access control:
— None: Select this if you do not want to configure access control for NTP service. When you select None, the
appliance allows all clients to access the NTP service. This is selected by default.
— Use Named ACL for Time only: Select this and click Select Named ACL to select a named ACL that contains
only IPv4 addresses and networks. NTP queries do not support TSIG key based ACEs. When you select this,
the appliance allows clients that have the Allow permission in the named ACL to use its NTP service. You
can click Clear to remove the selected named ACL. The appliance accepts ntpq queries from specified NTP
clients.
— Use Named ACL for Time + NTP Control (NTPQ): Select this and click Select Named ACL to select a named
ACL that contains only IPv4 addresses and networks. NTP queries do not support TSIG key based ACEs.
When you select this, the appliance allows clients that have the Allow permission in the named ACL to use
its NTP service, and for the appliance to accept ntpq queries from those clients as well. You can click Clear
to remove the selected named ACL.
— Use this set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the
following from the drop-down list. Depending on the item you select, Grid Manager either adds a row for the
selected item or expands the panel so you can specify additional information about the item you are
adding, as follows:
— IPv4 Address: Select this to add an IPv4 address. Click the Value field and enter the IPv4 address. The
default permission is Allow, which means that the appliance allows access to and from this IPv4 client.
You cannot change the default permission. In the Service field, select Time only to allow this client for
using the NTP service on the appliance; or select Time + NTP Control (NTPQ) to also accept ntpq queries
from this client.
— IPv4 Network: Select this to add an IPv4 network. Click the Value field and enter the IPv4 network. The
default permission is Allow, which means that the appliance allows access to and from this IPv4
network. You cannot change the default permission. In the Service field, select Time only to allow this
network for using the NTP service on the appliance; or select Time + NTP Control (NTPQ) to also accept
ntpq queries from this network.
— IPv6 Address: Select this to add an IPv6 address. Click the Value field and enter the IPv6 address. The
default permission is Allow, which means that the appliance allows access to and from this IPv6 client.
You cannot change the default permission. In the Service field, select Time only to allow this client for
using the NTP service on the appliance; or select Time + NTP Control (NTPQ) to also accept ntpq queries
from this client.
— IPv6 Network: Select this to add an IPv6 network. Click the Value field and enter the IPv6 network. The
default permission is Allow, which means that the appliance allows access to and from this IPv6
network. You cannot change the default permission. In the Service field, select Time only to allow this
network for using the NTP service on the appliance; or select Time + NTP Control (NTPQ) to also accept
ntpq queries from this network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 415

Managing Appliance Operations

— Any Address/Network: Select this to allow access to all IPv4 and IPv6 addresses and networks. The
default permission is Allow, which means that the appliance allows access to and from all IPv4 and
IPv6 clients. You cannot change the default permission. In the Service field, select Time only to allow
clients for using the NTP service on the appliance; or select Time + NTP Control (NTPQ) to also accept
ntpq queries from all clients.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
— Enable KoD: When you select this check box, the appliance (when acting as an NTP server) sends a KoD
(Kiss-o’-Death) packet to the NTP client if the client has exceeded the rate limit. The KoD packet contains the
stratum field set to zero and the ASCII string in the Reference Source Identifier field set to RATE, indicating
the packets sent by the client have been dropped by the server. When you clear the check box, the NTP
server drops the packets but does not send any KoD packet to the client. This check box is deselected by
default. For more information about KoD, see Enabling Kiss-o’-Death for NTP on page 416.
3. Save the configuration and click Restart if it appears at the top of the screen.

Enabling Kiss-o’-Death for NTP

When an NTP server denies service to an NTP client, which has exceeded the rate limit, it typically drops the packets
without notifying the client. In this case, the client, unaware of the situation, continues to transmit packets. To notify
the client so it either slows down or stops the packet transmission, you can enable the NIOS appliance (when acting
as an NTP server) to transmit a KoD (Kiss-o’-Death) packet. This packet contains the stratum field which is set to zero,
implying the sent packet was invalid, and the ASCII string that contains RATE in the reference identifier field,
indicating the status of the transmitted packet and access control. When the client receives the KoD packet, it may
reduce transmission rate or stop packet transmission to the server. For more information about KoD, refer to RFC 5905
(Network Time Protocol Version 4: Protocol and Algorithms Specification). You can enable KoD at the Grid level and
override it at the member level. For more information about enabling KoD, see Defining NTP Access Control on page
414.

Monitoring NTP
When you enable the Grid to synchronize its time with external NTP servers, you can monitor the status of the NTP
service by checking the NTP status icons in the Member Services panel. To access the panel, from the Grid tab, select
the Grid Manager tab -> Members tab -> Grid_member check box, and then select the Manage Member Services icon
in the table toolbar of the Members tab.
The following are descriptions of the NTP status icons in the Members Services panel. The type of information that
can appear in the Description column corresponds to the SNMP trap messages. For information about the Infoblox
SNMP traps, see Chapter 37, Monitoring the Appliance, on page 1325.

Icon Color Meaning

Green The NTP service is enabled and running properly.

Yellow The NTP service is enabled, and the appliance is synchronizing its time.

416 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Extensible Attributes

Icon Color Meaning

Red The NTP service is enabled, but it is not running properly or is out of synchronization.

Gray The NTP service is disabled.

After you upgrade the Grid to 6.6.x or later, the color of the Grid status icon changes based on the following:
• If you activate an external synchronization, or start the NTP service using the Grid Manager, or do not configure
any external NTP servers, except local, then the NTP behavior remains the same and the NIOS appliance
displays the Grid status icon in green.
• If you activate an external synchronization and configure one or more external NTP servers, or if the servers are
in synchronization with the Grid Master, then the Grid status icon is as follows:
— Green: NTP is synchronizing with an external server.
— Red: NTP is synchronizing with the local server and none of the external NTP servers are reachable. This
status icon also indicates if there are problems with the NTP service.
— Yellow: NTP is synchronizing with the local server and at least one external NTP server is reachable; but
there could be problems on the external server, such as an exceeded root distance error.

About Extensible Attributes

Extensible attributes are identifiers that you use to further define and track a NIOS object. For example, to specify the
location of a network, you can add the predefined attribute Site and enter a specific location for the network. You can
also specify whether an extensible attribute is required for an object or restrict the values that can be entered when
you create a new object.
You can also specify if an extensible attribute is inheritable by other objects in an inheritance chain. When you enable
the inheritance of an extensible attribute, all descendants in the inheritance chain can inherit the extensible attribute
so you do not have to configure it at all object levels. For example, if you define an extensible attribute for a network,
the attribute and its value can be automatically added for DHCP ranges and fixed addresses in the network.
An extensible attribute is inheritable by descendants in an inheritance chain if its definition does not restrict it to
objects that are not part of an inheritance chain. The appliance supports this inheritance chain: Network View ->
Network Container -> Network -> Range -> Host/Fixed Address/Reservation. A parent object can have descendants at
one or more levels. For example, a network view, network container, network, or DHCP range can be a parent object
and have descendants at one or more levels, while a host, fixed address, and reservation can only be a descendant,
not a parent. You can set an extensible attribute to be inheritable by selecting the Enable Inheritance option when
you define an attribute. For more information, see Configuring Inheritable Extensible Attributes on page 421.

Note: Only superusers can configure extensible attributes.

You can use predefined extensible attributes or specify new ones for different objects. The appliance provides the
following predefined extensible attributes that you can customize:
• Region
• Country
• State
• Site
• Building
• VLAN
• ReportingSite (Report Clustering)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 417

Managing Appliance Operations

When you use a predefined attribute, you can modify it and change its name, but you cannot change the type of data
it accepts. You can also delete predefined attributes that you do not use. All predefined attributes accept text strings.
You can define other settings though, as described in Modifying Extensible Attributes on page 425. You can also
create your own extensible attributes, as described in Adding Extensible Attributes on page 419.
For example, you can configure the predefined attribute Site for fixed addresses and hosts, and define a new attribute
Department for admin groups.
When you configure an extensible attribute, you can specify the following:
• The type of data that admins enter, such as text strings, integers, or email addresses. You can also restrict
admins to a list of values.
• Whether admins can enter multiple values
• A default value
• Whether the attribute is required
• Whether the attribute is inheritable
• The objects associated with the attribute, such as admin groups, DNS views, or DHCP networks.
• Whether the appliance makes an entry in the audit log each time an object with the attribute is added or
modified.
Activities such as additions, modifications, and deletions of inheritable extensible attributes, are recorded in the
audit log. For information about how to use the audit log, see Using the Audit Log on page 1344.
Figure 8.5 illustrates a network with different device types. Each device is represented as a host in the NIOS appliance
database. You can configure Device Type, Location and Owner as required attributes for hosts. Then when admins
add hosts, they will be required to enter values for these attributes in the Extensible Attributes tab of the Add Host
wizard.

Figure 8.5 Using Extensible Attributes to Define Network Devices

You can create extensible attributes such as

Device Type, Location, Owner, and Printer
Manufacturer, and associate them with Type .1.114
Device Cube 3
hosts. Each attribute tracks specific n
Locatio IT
information about the device. These details Owne r HP
cturer serJet
provide valuable information for network, Manufa 7200 La
asset, and service management. Model 84723B
05
ag
Asset T Date 7/15/20
08
Purc ha se 7/15/20 222
r ra n ty Exp. 800-55
5 -2
Wa
Service

evice
NAT D
Printer
Server Router
Laptop ll
Deskto
p Firewa

Network with an
assortment of classified
and unclassified device
types.

418 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Extensible Attributes

After you configure extensible attributes for an object, the attributes become available in the Extensible Attributes
tab of the wizard and editor of the corresponding object. Users then add or edit the attribute values, based on your
configuration. Users can also specify attributes when searching for data and add attributes as columns in the tables
of Grid Manager. For example, you can add the predefined Site attribute as a column in the Records panel of the Zones
tab. For information about adding columns to tables, see Customizing Tables on page 69.
Users can also group objects in smart folders according to their attributes. For example, a user can create a smart
folder that contains all networks in a certain site.
Users can enable the appliance to group members by extensible attributes. For information, see Grouping Members
by Extensible Attributes on page 303.
When you first enable Cloud Network Automation, NIOS installs a set of extensible attributes that are specific for
cloud usage. For more information, see Extensible Attributes for Cloud Objects on page 386.

Adding Extensible Attributes

To add a new extensible attribute:
1. From the Administration tab, select the Extensible Attributes tab.
2. Click the Add icon on any of the toolbars.
3. In the Add Extensible Attribute wizard, complete the following:
— Name: Enter the name of the attribute. This is a required field and is case-sensitive. You can enter up to 128
UTF-8 characters.
— Type: Specify the type of data that you want to capture for an object. Select one of the following:
— String: Select this when the attribute is used to define string values, such as names. When you select
this type, the wizard displays the Number of Characters field where you can enter the minimum and
maximum number of characters that users can enter.
— List: Select this when you want to define a list of values for the attribute. Users can then select a value
from this list. For example, if you want to restrict an attribute to five specific values, you can define the
attribute as a List and then list the five values in the List Values section. When a user uses the attribute,
they are limited to selecting from one of the five values.
When you select List, the wizard displays the List of values table, where you add the allowed values.
These values appear in the drop-down list when a user defines the attribute. Click the Add icon to enter
values in the table. You can enter up to 64 UTF-8 characters for each value.
You can also modify list values at a later time. When you modify list values, all object attributes using
the modified values are updated to the new values.
You can also delete values from the list. Note that when you delete a list value, all attributes using the
deleted values are removed from the objects. For objects with multiple attribute values, only the deleted
values are removed.
You can also move a value up or down in the list.
— Integer: Select this when the attribute is used to track whole numbers, such as serial numbers. When
you select this type, the wizard displays the Value Limits fields where you can enter the range of
allowed values. Note that you cannot change your entries in the Value Limits fields if you modify the
attribute at a later date.
— Email: Select this when the attribute is used for email addresses. Email addresses are entered in the
format [email protected].
— URL: Select this when the attribute is used for tracking URLs (Uniform Resource Locators). URLs must be
entered in a valid format.
— Date: Select this when the attribute is used for dates. The date value is in YYYY-MM-DD format.
— Comment: Enter additional information about the attribute. You can enter up to 256 UTF-8 characters.
4. Click Next and complete the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 419

Managing Appliance Operations

— Enable Inheritance: Select this check box if you want to allow the extensible attribute and its values to be
inherited by descendants in an inheritance chain. When you select this check box, inheritance is enabled
for network related objects only. When you select this check box and restrict an attribute to certain objects,
then the extensible attribute and its value will be inherited by those objects only.
Note the following:
— If you create an extensible attribute with inheritance disabled and later enable it, the Descendant
Actions dialog box may be displayed with the available options for adding an extensible attribute. For
information, see Managing Inheritable Extensible Attributes at the Parent and Descendant Level on
page 424.
— If you create an extensible attribute with inheritance enabled and later disable it, the Descendant
Actions dialog box may be displayed with the available options for deleting an extensible attribute. For
information, see Deleting Inheritable Extensible Attributes Associated with Parent Objects on page
427.
— Allow multiple values: Select this check box if you want to allow multiple values for this attribute to be set
on an object. You cannot change this value for predefined attributes.
— Default Value: Enter the default value that the appliance displays for the attribute. Leave this blank if there
is no default value for this attribute. If the attribute type is String, you can enter up to 256 UTF-8 characters.
If the attribute type is List, the value must be one of the list values and can be up to 64 UTF-8 characters.
— Required: If you select this option, it is required to enter a value for this attribute when adding or modifying
the corresponding object in the GUI.
— Recommended: If you select this option, it is recommended to enter a value for this attribute when adding
or modifying the corresponding object in the GUI.
— Optional: This is selected by default. By selecting this option, you may or may not enter a value for this
attribute when adding or modifying the corresponding object in the GUI.
— Restrict to Specific Object Types: Click the Add icon to select the object type with which you want to
associate the attribute. The appliance adds a row to the table. To delete an object type, select an object
type and click the Delete icon. By default, the appliance associates an extensible attribute with all the
supported object types.
— Log Attribute Values When Objects are Updated: Select this check box if you want the appliance to make an
entry in the audit log each time an object with this attribute is added or modified. When you select attribute
values for audit, they are included in all the audit log entries. For information about the audit log, see Using
the Audit Log on page 1344.
— Allow cloud members to have the following access to this extensible attribute: Select this if you are
configuring this extensible attribute for Cloud Network Automation. When you select this check box, the
Cloud Platform Appliance can access this extensible attribute and perform requested tasks based on the
cloud API requests. This function is enabled by default for all cloud specific extensible attributes. Note that
if you disable this function for any cloud attributes, you will receive an error when you try to perform tasks
that involve these attributes through cloud API requests. You can select Read/Write or Read only. For
information about this feature, see Deploying Cloud Network Automation on page 361.
— Read/Write (and disallow Write access from the GUI and the standard API): When you select this, the
Cloud Platform Appliance can access and modify the value of this extensible attribute based on the
tasks requested only through cloud API requests. You cannot modify this attribute using Grid Manager
or the Infoblox API.
— Read only: When you select this, the Cloud Platform Appliance can access this extensible attribute and
report the value based on the cloud API requests, but it cannot modify the value. You receive an error if
you try to modify this attribute when this option is selected.
5. Save the configuration and click Restart if it appears at the top of the screen.
Grid Manager adds the attribute to the Extensible Attributes tab in either the wizard or editor for the specified object
types.

420 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Extensible Attributes

Note: Infoblox recommends that you define values for mandatory extensible attributes using the Grid only and do
not use PAPI or RESTful API to define values.

Configuring Inheritable Extensible Attributes

An extensible attribute can be inherited by descendants when it is at the top or in the middle of the inheritance chain.
When you add a new extensible attribute to a parent object, the same extensible attribute may or may not already
exist at the descendant levels. If the extensible attribute exists on a descendant, you can choose to have the
descendant inherit the value from the parent, or retain the original value from the descendant. When the extensible
attribute does not exist on the descendant, you can choose to have the descendant either inherit the extensible
attribute and its value from the parent or not inherit anything from the parent.
When you add a range, host, fixed address or IPv4 reservation to a parent object which has inheritable extensible
attributes, the newly added object can inherit extensible attributes from the parent object. For example, if you create
an IPv4 network with inheritable extensible attributes, and then add a host, the values you specified for the
extensible attributes while creating the network can be inherited by the host.
To assist you in identifying whether an extensible attribute value is inherited or overridden, the appliance displays
the inheritance state of an attribute in the Inheritance State column of an extensible attribute. This column is
displayed only for objects that support inheritance. For information about how to view inheritance states, see
Modifying Inheritable Extensible Attributes on page 426.
Following are the supported inheritance states:

Table 8.2 Inheritance States

Inheritance
State Description

Inherited The extensible attribute inherits its value from the parent. You cannot edit the value of
an attribute when the inheritance state is set to Inherited. You can change the state to
Overridden and then change the value of the attribute or change the state to Not
Inherited to remove the inherited value.
Overridden The extensible attribute overrides the value inherited from the parent. You can change
the state to Inherited and restore the original inherited value or change the state to Not
Inherited and remove the inherited value.
Not Inherited The extensible attribute can inherit its value from the parent, but the attribute does not
exist on the descendant. You can change the state to Inherited and restore the original
inherited value or change the state to Overridden and change the value of the attribute.
Note that when the state of an inheritable extensible attribute is Not Inherited, the
corresponding attribute will not be added as a new extensible attribute for objects that
are currently not inheriting this extensible attribute.
No Parent The inheritance state is set to No Parent when an object has a parent, but the parent
does not have an extensible attribute or the parent’s extensible attribute is set to Not
Inherited.
Disabled Extensible attribute inheritance is not enabled for the attribute.
No Change The extensible attributes of the selected objects do not have the same inheritance state
for all objects. This state allows you to retain the current state on the selected objects.
Note that this state is only seen in the Multi-object Extensible Attributes editor.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 421

Managing Appliance Operations

When you add an inheritable extensible attribute to an object, if there are descendants of this object the Descendant
Actions dialog box is displayed which will provide options for the descendants. Following is a summary of these
options:
• Retain the original value of the attribute for all descendants.
• Inherit the extensible attribute and its value from the parent object.
• Inherit the extensible attribute and its value when it does not exist on descendants.
• If the extensible attribute does not exist on the descendant, do not add it.
• If you are deleting an inherited extensible attribute from a parent object you can retain or remove the extensible
attribute from the object's descendants.
To configure default descendant actions for inheritable extensible attributes:
1. From the Grid tab, select the Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
2. In the Extensible Attribute Inheritance tab, complete the following:
When adding an extensible attribute that already exists on a descendant:
— Keep the descendant’s existing value and change the inheritance state to Override: Select this if you want
to retain the existing extensible attribute values for all direct descendants, irrespective of the values you
define at the parent level. The inheritance state for all direct descendants will be set to Overridden. Note
that this is applicable only when you add a new extensible attribute to the parent object that already exists
on the descendant. If you modify the value of an existing extensible attribute that is already inherited by the
descendant, and select the above option in the Descendant Actions dialog box, then the new value will be
inherited by the descendant, but the inheritance state will remain Inherited. For example, consider a
network 10.0.0.0/16 that has an extensible attribute Site with the value SA (native). When you add another
network 10.0.0.0/24, extensible attribute Site inherits its value, SA, from the parent object. Now, if you add
network 10.0.0.0/8, assign extensible attribute Site and set its value to NY, then when you choose this
option, the value of Site will remain as SA, but the inheritance state will be changed to Overridden for
network 10.0.0.0/16; however, network 10.0.0.0/24 will still have its value as SA for Site with the
inheritance state set to Inherited.
— Inherit the parent’s value and change the inheritance state to Inherit: Select this to inherit the extensible
attribute values from the parent for all descendants. The inheritance state for all descendants will be set to
Inherited.
— Change the inheritance state to Inherit only if the descendant’s value is the same as the parent’s value.
Otherwise, change the state to Override: Select this to set the inheritance state to Inherit if the descendants
have the same extensible attribute value as the parent. Otherwise, retain the original extensible attribute
value on the descendants and change the inheritance state to Overridden.
When adding an extensible attribute that does not exist on a descendant:
— Do not inherit the value from the parent and change the inheritance state to Not Inherited: Select this if the
extensible attributes do not exist on the descendants and you do not want them to inherit the attributes
from the parent. The inheritance state is set to Not inherited.
— Inherit the value from the parent and change the inheritance state to Inherited: Select this if you want all
descendants to inherit extensible attributes from the parent, and the inheritance state for all descendants
will be set to Inherited.
When deleting an extensible attribute:
— Keep the descendant’s value and change the inheritance state to No Parent: Select this if you want to
preserve extensible attributes on all descendants when you delete an inheritable extensible attribute. The
inheritance state for direct descendants will be set to No Parent.
— If the current inheritance state is Inherited, remove the extensible attribute. If the current inheritance state
is Overridden, keep the value and change the inheritance state to No Parent: Select this if you want to
remove the extensible attributes that are inherited by the descendants. If the inheritance state of the
extensible attributes is set to Inherited on the descendant, the attributes will be removed; however, if the
inheritance state is set to Overridden, then the state will be changed to No Parent.
3. Save the configuration.

422 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Extensible Attributes

For more information about how to configure inheritable extensible attributes, see Configuration Examples for
Inheritable Extensible Attributes on page 430.

Admin Permissions and Inheritable Extensible Attributes

Permissions for descendant objects can affect the results of the actions that are chosen in the Descendant Actions
dialog box:
• When you add an extensible attribute to the parent object: The descendants to which you have read-write
permission will behave as expected with any of the chosen options in the Descendant Actions dialog box.
• When you change the extensible attribute value on the parent object: The descendants that have the same
extensible attribute set to Inherited will be automatically changed to the new value, even though you may not
have write permission for those descendants.
• When you select to preserve descendant values while removing an extensible attribute associated with the
parent object, values will be preserved even if you do not have write read-write permission for those
descendants.
• When you select to remove an extensible attribute on descendants when removing a parent's extensible
attribute, an error message will be displayed if you do not have read-write permission to some of the
descendants.

Guidelines for Configuring Inheritable Extensible Attributes

• When you add an inheritable extensible attribute to a parent object, you can choose to have descendants
inherit or override the parent's extensible attribute value. You can also choose that the extensible attribute not
be added to a descendant.
• When you add a new parent with an inheritable extensible attribute, the options for changes to descendants
remain the same as when you add a new inheritable extensible attribute to a parent. For more information, see
Configuring Inheritable Extensible Attributes on page 421.
• When you add a new descendant to the existing parent with inheritable attributes, the descendant inherits all
the extensible attributes. However, you can select if you want to inherit or override the values. If you set the
inheritance state to Not Inherited, then the extensible attribute will not exist on the descendant, but you can
later change the state to Inherited or Overridden. For more information, see Managing Inheritable Extensible
Attributes at the Parent and Descendant Level on page 424.
• When you delete an inheritable extensible attribute associated with the parent, you can either preserve the
extensible attribute values on the descendants or delete the inherited extensible attributes. For information,
see Deleting Inheritable Extensible Attributes Associated with Parent Objects on page 427.
• When you delete a parent object and if there is grandparent, then the extensible attribute will be re-parented
when you choose preserve. The current inheritance state of the attribute will be retained. If you delete a parent
object and if there is no grandparent, then the inheritance state of the extensible attribute is changed to No
Parent when you choose preserve.
• When you split a network, the extensible attribute will be copied to the newly created networks. For inheritable
extensible attributes, the newly created network inherits the extensible attributes and the state is set to
Inherited. For information, see Managing Inheritable Extensible Attributes at the Parent and Descendant Level
on page 424.
• When you join two networks to form a larger network, the Descendant Actions dialog box is displayed with the
following options:
When joining networks, select the action(s) you want to apply to the merged networks:
— Preserve extensible attributes for all descendants of the merged networks and change the inheritance state
to No Parent: Select this if you want to preserve the extensible attributes for all descendants of the merged
networks. The inheritance state of the attributes will be changed to No Parent.
— Remove extensible attributes from descendants of the merged networks: Select this if you want to remove
extensible attributes that are inherited by descendants.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 423

Managing Appliance Operations

Note: The options above apply only to extensible attributes which no longer have a parent, due to the merge. If
the extensible attributes on descendants are also on the resulting merged network, then they will retain
their current state.

• When you add multiple inheritable networks, new networks will automatically inherit all extensible attributes
from the parent.

Managing Inheritable Extensible Attributes at the Parent and Descendant Level

You can define if descendants will inherit values from the parent when a new extensible attribute is added to the
parent. You can also choose to override the values of the extensible attributes on the descendants.
When you delete an existing attribute, you can choose to either preserve the values at the descendant level or delete
the values inherited by the descendants.

Note: The Descendant Actions dialog box is displayed only when an object has descendants and you are modifying
extensible attributes that affects those descendants. However, the dialog box is always displayed when a join
is performed for a network that has inheritable extensible attributes.

The following section describes configuration changes for inheritable extensible attributes:
1. Network Container: From the Dashboards tab, select the Tasks tab -> click Add Networks. Select a network, enter
the required details. You can edit the inheritable extensible attributes that are displayed automatically. If this is
a parent object, then you can add extensible attributes.
IPv4 Network: From the Data Management tab -> select the DHCP tab -> Networks tab. In the Networks section,
select IPv4 Network from the Add drop-down menu. In the Add IPv4 Network wizard, enter the attributes in the
Extensible Attributes tab after specifying the required details.
IPv6 Network: From the Data Management tab -> select the DHCP tab -> Networks tab. In the Networks section,
select IPv6 Network from the Add drop-down menu. In the Add IPv6 Network wizard, enter the attributes in the
Extensible Attributes tab after specifying the required details.
IPv4 Range: From the Data Management tab -> select the DHCP tab -> Networks tab -> Networks tab -> network ->
click addr_range, select Range from the Add drop-down menu. In the Add IPv4 Range wizard, enter the
attributes in the Extensible Attributes tab after specifying the required details.
IPv6 Range: From the Data Management tab -> select the DHCP tab -> Networks tab -> Networks tab -> network ->
click addr_range, select Range from the Add drop-down menu. In the Add IPv6 Range wizard, enter the
attributes in the Extensible Attributes tab after specifying the required details.
2. You can either add new extensible attributes to the parent object or modify original extensible attribute values.
Click on the extensible attribute value displayed in the Value column of the respective attribute to modify the
original value or click the Add icon to add a new attribute.
3. Select a state from the drop-down list displayed in the Inheritance State column. Note that you can only change
the inheritance state of a descendant. You must select Overridden from the drop-down list to enter a new value.
For more information about inheritance states, see Table 8.2 on page 421. When an object has a parent and the
parent does not have the object's inheritable extensible attribute, then the inheritance state of the extensible
attribute is set to No Parent and the state cannot be changed.
4. Select the inheritable extensible attributes for which you want to modify descendant actions: Select this check
box if you would like to apply the actions of the Descendant Actions dialog box for existing extensible attributes.
Before you select this check box, you must select the extensible attributes which will be affected by the actions
of the Descendant Actions dialog box.

Note: This check box is not displayed for hosts, fixed addresses, and reservations since they do not have
descendants.

5. In the Descendant Actions dialog box, select options that will be applied for descendant objects as described in
Configuring Inheritable Extensible Attributes on page 421.

424 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Extensible Attributes

The Descendant Actions dialog box displays all the mentioned options when you perform add and delete
operations simultaneously. Consider an example where you add a new inheritable extensible attribute Site, and
delete an existing inheritable attribute Region from the parent object, and then click Save to save both changes.
In this case, the Descendant Actions dialog box displays all the options.
6. Save the configuration.

Viewing Extensible Attributes

To view the configured extensible attributes, from the Administration tab, select the Extensible Attributes tab. The
panel displays the following information:
• Name: The name of the extensible attribute.
• Type: The type of data defined by the attribute.
• Comment: Comments entered for the extensible attribute.
• Required: Indicates whether users are required to complete this field.
• Restricted to Objects: The object types that are associated with the attribute.
• Inheritance Enabled: Indicates whether inheritance is enabled or not.
You can do the following in this panel:
• Sort the displayed data in ascending or descending order by column.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Group results by extensible attributes. For information, see Grouping Results by Extensible Attributes on page
430.
• Add or delete extensible attributes.
• Print or export the data.

Modifying Extensible Attributes

When you modify an extensible attribute, all objects using the modified attributes are updated. You can perform
inline editing by double-clicking the row of data that you want to modify. The appliance displays the inline editing
editor in the selected row. Click Save after modifying the data. Note that you cannot edit extensible attributes that
have multiple values.
To modify an extensible attribute:
1. In the Administration tab, select the Extensible Attributes tab.
2. Select the attribute and click the Edit icon.
3. In the General tab of the Extensible Attributes editor, you can only change the name of the attribute. You cannot
change the data type. The data type for predefined attributes is string.
4. In the Additional Properties tab, you can modify any of the fields described in step 4 of Adding Extensible
Attributes on page 419.
5. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 425

Managing Appliance Operations

Modifying Inheritable Extensible Attributes

When values are inherited by a descendant, the inheritance state of the inherited extensible attribute is displayed as
Inherited. You can select Overridden and specify a new value or select Inherited to retain the same value as the
parent. If you select Not Inherited, the extensible attribute and its value will not be inherited. The inherited value will
have a strike-through and you cannot edit the value when the state is set to Not Inherited.
In addition to the attribute values, the Value column of an inheritable extensible attribute also displays the name of
the source and the object type of the extensible attribute. For example, a Network Container has a descendant,
Network, which inherits an extensible attribute value from Network Container and Network has a descendant, Fixed
Address that inherits the same extensible attribute value. In this case, Fixed Address shows Network Container as the
source.
The following table displays various inheritance states and corresponding changes to source and object types that
are displayed in the Value column of an extensible attribute.

Inheritance State Source and Object Type in the Value Column

If an extensible attribute is a native Source is not displayed in the Value column. This column will not
attribute (an object which is at the top display the source details, if none of the selected objects support
of the inheritance chain, or does not inheritance.
have ancestors),
If the state of an extensible attribute is then the Source and object is displayed. You cannot change the
set to Inherited, value of the extensible attribute.
If the state of an extensible attribute is then the Source will have a strike-through. You can change the state
set to Overridden or Not Inherited, of such extensible attributes. You cannot change the value of the
extensible attribute when the inheritance state is set to Not
Inherited.

To modify the value and inheritance state of an inheritable extensible attribute:

1. For IPv4 and IPv6 Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks ->
network -> addr_range check box, and then click the Edit icon.
For IPv4 Range, IPv6 Range, Fixed Address, Reservation, and Host: From the Data Management tab -> select the
DHCP tab -> Networks tab -> Networks tab -> network -> click addr_range, click the Edit icon.
2. In the editor, click the Extensible Attributes tab, select the check box of the respective attribute.
3. At the parent level, click on the value you want to change and enter the new value.
At the descendant level, click on the value you want to change and enter the new value. Note that you can
change the value only when the inheritance state is set to Overridden.
4. Select a state from the drop-down list displayed in the Inheritance State column. Note that you can only change
the inheritance state of a descendant. You must select Overridden from the drop-down list to enter a new value.
For more information, see Table 8.2 on page 421.
5. Select the inheritable extensible attributes for which you want to modify descendant actions: Select this check
box if you would like to apply the actions of the Descendant Actions dialog box for existing extensible attributes.
Before you select this check box, select the extensible attributes which will be affected by the actions of the
Descendant Actions dialog box. For more information about the Descendant Actions dialog box, see Managing
Inheritable Extensible Attributes at the Parent and Descendant Level on page 424.
6. Save the configuration.

426 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Extensible Attributes

Deleting Extensible Attributes

When you delete an extensible attribute, the appliance removes the attribute. All the attribute values set on the
selected object types are removed from those objects. Once deleted, the attribute no longer exists in the system.
Deleted attributes are not moved to the Recycle Bin. This operation might take a long time depending on the amount
of data that needs to be deleted.
To delete extensible attributes:
1. In the Administration tab, select the Extensible Attributes tab.
2. Select the attribute and click the Delete icon.
3. When the confirmation dialog box appears, click Yes.

Deleting Inheritable Extensible Attributes Associated with Parent Objects

When you remove an inheritable extensible attribute, which is associated with a parent object, you can choose to
retain the descendant extensible attribute or remove it from all the descendants.
Note that you cannot delete extensible attributes that have the inheritance state set to Overridden, Inherited, and Not
Inherited. You can delete an extensible attribute that is directly assigned to the object and has its inheritance state
set to No Parent or if the inheritance state is Disabled.
To remove an inheritable extensible attribute associated with a parent object:
1. IPv4 and IPv6 Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks ->
network -> addr_range check box, and then click the Edit icon.
For IPv4 Range, IPv6 Range, Fixed Address, Reservation, and Host: From the Data Management tab -> select the
DHCP tab -> Networks tab -> Networks tab -> network -> click addr_range, select the object and click Edit icon.
2. In the editor, click the Extensible Attributes tab, select the attributes and then click the Delete icon.
3. When you click Save and Close, the Descendant Actions dialog box is displayed automatically with the following
options:
Select the action(s) you want to apply to descendant objects that have the following extensible attribute(s):
When deleting an extensible attribute:
— Keep the descendant’s value and change the inheritance state to No Parent: Select this if you want to
preserve extensible attributes for all descendants. The inheritance state of the extensible attribute changes
to No Parent.
— If the current inheritance state is Inherited, remove the extensible attribute. If the current inheritance state
is Overridden, keep the value and change the inheritance state to No Parent: Select this if you want to
remove the extensible attributes that are inherited by the descendants. If the inheritance state of the
extensible attributes is set to Inherited on the descendant, the attributes will be removed; however, if the
inheritance state is set to Overridden, then the state will be changed to No Parent.
4. Click Yes to save the configuration or No to exit.

Note: The deleted extensible attributes will not be moved to the Recycle Bin and you cannot restore extensible
attributes that are deleted.

Using Extensible Attributes

After a superuser admin configures the attributes of an object, they become available in the wizard and editor of the
object. This section describes how users can then add and manage the attributes that were configured.
Grid Manager displays the required extensible attributes in the Extensible Attribute tab. You must enter values for all
required attributes. If an object does not have required attributes, you can add the available optional attributes.
In the Extensible Attribute tab of an object, such as a network or host record, you can do the following:
• Enter values for extensible attributes
• Add attributes

NIOS 7.3 NIOS Administrator Guide (Rev. A) 427

Managing Appliance Operations

• Change the inheritance state of an extensible attribute

• Select if descendants must inherit extensible attribute values from its parent
• Delete optional attributes
To enter values for the extensible attributes of an object:
1. Open the editor of the object. For example, to enter values for the attributes of a network, select it and click its
Extensible Attributes tab.
2. Click the Value column of the attribute. You must enter values for all required attributes.
3. Depending on the required attribute type, either enter or select a value for the attribute from the Value column.
4. Based on whether the attribute is inheritable, the values are displayed in the Inheritance State column. This
value can be set to Inherited, Overridden or Not inherited. If the object is at the top of the inheritance chain
(Network View), then the inheritance state is not displayed. The inheritance state is set to No Parent only if an
object has a parent, but the parent does not have the inherited extensible attribute. This column is not displayed
if all selected objects do not belong to the supported inheritance chain. Example: Zones, DNS View, DNS records,
etc.
To add attributes:
1. Click the Add icon. Grid Manager adds a row to the table with the default attribute displayed.
2. Click the default attribute and expand the list of available attributes.
3. Select an attribute from the drop-down list.
4. Enter or select a value for the attribute from the Value column.
To delete an attribute:
1. Click the check box beside the attribute you want to delete.
2. Click the Delete icon.

Note: You cannot delete an extensible attribute which has its inheritance state set to Inherited, Overridden, and Not
Inherited. You can delete an extensible attribute that is directly assigned to the object and has its inheritance
state set to No Parent or if the inheritance state is Disabled.

To delete all attributes:

1. Click the Attribute Name check box.
2. Click the Delete icon.

Note: You can delete only attributes that are not required. If you have one or more required attributes, you
cannot use the delete all function.

3. Save the configuration and click Restart if it appears at the top of the screen.

Editing Multiple Extensible Attribute Values

You can also manage the extensible attributes of multiple objects at the same time. For example, you can select
several zones, and view and modify their extensible attributes all at once in the Multi-Select Edit Extensible Attributes
editor.
Note that Grid Manager may not apply the changes you made to all the selected objects. It applies the change to
objects that meet the following criteria:
• You have read/write permission to the object.
• The selected object is not locked by another user or does not have a scheduled pending task.
• If the attribute was restricted to certain object types, the object must be one of those types.
To edit multiple extensible attribute values:
1. Select the objects whose extensible attributes you want to modify. You can select specific objects or select all
objects in a dataset, as described in Selecting Objects in Tables on page 69.

428 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Extensible Attributes

2. Expand the Toolbar and click Extensible Attributes.

Grid Manager displays the Multi-Select Edit Extensible Attributes dialog box which lists the extensible attributes
of the selected objects. It displays the following information for each attribute:
— Attribute Name: This field displays the name of the extensible attribute associated with the selected object.
— Value: If the selected objects have the same value for the attribute, Grid Manager displays that value in this
field. If the selected objects have different values for the attribute or if some have values and others do not,
this field displays Multiple Values and the cell is highlighted in gray.
An attribute can have multiple rows if it allows multiple values. Grid Manager displays the values that all
objects have in common, if any. Otherwise, it displays Multiple Values. This column displays the source for
inherited extensible attributes only. Note that when you add new extensible attributes, edit values of
existing extensible attributes or delete an extensible attribute, then the Descendant Actions dialog box is
displayed, even if the objects do not have any descendants. For more information about Source values, see
Modifying Inheritable Extensible Attributes on page 426.
— If you select objects that have the same inherited extensible attributes, but objects have different
parents, then the Source column will display Multiple Ancestors.
— If the inheritance state of an extensible attribute is Not Inherited, then the extensible attribute will not
be added as a new extensible attribute to objects that are currently not inheriting this extensible
attribute.
— Inheritance State: This field displays the inheritance state of an extensible attribute. The column value can
be Inherited, Not Inherited, No Parent, No Change or Overridden. This column is not displayed if all selected
objects do not belong to the supported inheritance chain. Example: Zones, DNS View, DNS records, etc.
If extensible attributes for the selected objects have the same inheritance state, then the respective
inheritance state is displayed in this column. When objects have different inheritance states, this column
displays No Change, so that the current inheritance state is retained on the selected objects. If you then
change the inheritance state of an extensible attribute to a specific state, the corresponding attribute will
be changed to the selected inheritance state on all selected objects where the extensible attribute is
currently inherited. If the object is at the top of the inheritance chain (Network View), then the inheritance
state is not displayed. The inheritance state is set to No Parent only if an object has a parent, but the parent
does not have the inherited extensible attribute. For more information about inheritance states, see
Table 8.2 on page 421.
— Required: This field displays Yes if the attribute is required in at least one object associated with the
attribute. It displays No if the attribute is not required in any of the objects.
3. You can do the following:
— Change the value of an attribute. Depending on the attribute type, select the value and either enter a new
value or select one from the drop-down list.
— Add an attribute to the selected objects. Click the Add icon. In the Attribute Name field of the new row,
select an attribute from the list of available attributes and specify its value. If the attribute that you added
was configured as a required attribute, the Required field displays Yes. Otherwise, it displays No.
— Delete an attribute. You can delete an attribute if it is not required. Select the attribute and click the Delete
icon.
4. Click OK when you are finished modifying the extensible attributes.
Grid Manager applies your changes to the applicable objects. This operation might take a long time, depending on
the amount of data being modified. You can choose to run this operation in the background, as described in About
Tasks on page 81.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 429

Managing Appliance Operations

Grouping Results by Extensible Attributes

You can enable the appliance to group members and services with the same extensible attributes. Grid Manager
displayed group data with the same value for the specified extensible attribute.
To group results by extensible attributes:
1. From the Grid tab, select the Grid Manager tab -> Members tab or Services tab.
From the Data Management tab, select the DHCP or DNS tab -> Members/Servers tab.
2. Complete the following to group members with the same extensible attribute value:
— Group Results: Select this check box to enable the appliance to group members by extensible attributes.
— Group By: Select an extensible attribute by which you want to group members from the drop-down list.
Grid Manager displays data per group of members configured with the same extensible attribute value.
To add additional Group By filter, click the + icon, and then select a value from the drop-down list. You can
apply up to 10 Group By filters. You can also delete a filter by clicking the - icon.

Configuration Examples for Inheritable Extensible Attributes

All examples in this section are based on the inheritance chain Network View -> Network Container -> Network -> Range
-> Host/Fixed Address/Reservation, in which network view is at the top level and host, fixed address and reservation
at the bottom of the inheritance chain.

Example 1
When you add an extensible attribute to the top object, the inheritance state is set to No Parent. For example, if you
add a new inheritable extensible attribute, Building, to a network view, the inheritance state of this extensible
attribute is set to No Parent for the network view.

Example 2
When you add an extensible attribute Site to the parent object Network that has a descendant Range, you can define
Site as inheritable and add it to the Network. The descendant, Range, may or may not have the same extensible
attribute. Infoblox displays a list of options that lets you either inherit the value or retain or override the existing value
of the extensible attribute at the descendant level. Another option is to inherit the value of Site, only if the value for
this attribute in Range is same as that in Network. You can also decide if Range should acquire the same value for
Site, if it is not defined for Range. This change can be inherited by the descendants of Range.
Depending on your configuration, the inheritance state of the extensible attribute can display Inherited, Overridden
or Not Inherited. If the object is at the top of the inheritance chain (Network View), then the inheritance state is not
displayed. The inheritance state is set to No Parent only if an object has a parent, but the parent does not have the
inherited extensible attribute.

Example 3
Examples in this section show different results when you add a new inheritable extensible attribute to an object
located at the top or in the middle of the inheritance chain based on the following:

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/8 Network
Container
10.0.0.0/16 Network Region ABC Native

430 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Examples for Inheritable Extensible Attributes

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.1.0.0/16 Network

Example 3.1: Add an extensible attribute Region with value DEF to 10.0.0.0/8
You select the following options for the existing extensible attribute:
• For descendants that already have this extensible attribute, the existing extensible attribute will always be set
to Inherit.
• For descendants that do not have this extensible attribute, the descendants will inherit this extensible attribute.
Result:

Object Type Extensible Extensible Inheritance

Attribute Attribute Value State
10.0.0.0/8 Network Region DEF Native
Container
10.0.0.0/16 Network Region DEF Inherited from
10.0.0.0/8
10.1.0.0/16 Network Region DEF Inherited from
10.0.0.0/8

Example 3.2: Add an extensible attribute Region with value DEF to 10.0.0.0/8
You select the following options for the existing extensible attribute:
• For descendants that already have this extensible attribute, the existing extensible attribute will always be set
to Override.
• For descendants that do not have this extensible attribute, the descendants will not inherit this extensible
attribute (extensible attribute is set to Do not Inherit).
Result:

Object Type Extensible Extensible Inheritance

Attribute Attribute Value State
10.0.0.0/8 Network Region DEF Native
Container
10.0.0.0/16 Network Region ABC Overridden
10.1.0.0/16 Network Region

Example 3.3: Add an extensible attribute Region with value DEF to 10.0.0.0/8
You select the following options for the existing extensible attributes:
• For descendants that already have this extensible attribute, the existing extensible attribute will always be set
to Inherit.
• For descendants that do not have this extensible attribute, the descendants will not inherit this extensible
attribute (extensible attribute is set to Do not Inherit).
Result:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 431

Managing Appliance Operations

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/8 Network Region DEF Native
Container
10.0.0.0/16 Network Region DEF Inherited,
Source
10.0.0.0/8
10.1.0.0/16 Network Region

Example 4
Examples in this section show different results when you remove an existing inheritable extensible attribute from an
object located at the top or in the middle of the inheritance chain based on the following:

Object Type Extensible Extensible Inheritance

Attribute Attribute Value State
10.0.0.0/8 Network Region DEF Native
Container
10.0.0.0/16 Network Region DEF Inherited from
10.0.0.0/8
10.1.0.0/16 Network Region ABC Overridden

Example 4.1: Remove extensible attribute Region with value DEF from 10.0.0.0/8
You select the following option for the existing extensible attribute:
• Remove extensible attributes with inheritance state set to Inherited. Extensible attributes with the state set to
Overridden are not removed.
Result:

Extensible Extensible Inheritance

Object Type Attribute Attribute Value State
10.0.0.0/8 Network
Container
10.0.0.0/16 Network
10.1.0.0/16 Network Region ABC Overridden

Example 4.2: Remove extensible attribute Region with value DEF from 10.0.0.0/8
You select the following option for the existing extensible attribute:
• Preserve all descendant extensible attributes, whether the state is set to Inherited or Overridden.
Result:

Extensible Extensible Inheritance

Object Type Attribute Attribute Value State
10.0.0.0/8 Network
Container

432 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Examples for Inheritable Extensible Attributes

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/16 Network Region DEF Native
10.1.0.0/16 Network Region ABC Native

Example 5
Examples in this section show different results when you remove parent object based on the following:

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/8 Network Region DEF Native
Container
10.0.0.0/16 Network Region DEF Inherited from
Container 10.0.0.0/8
10.0.0.0/24 Network Region DEF Inherited from
10.0.0.0/8
10.0.1.0/24 Network Region ABC Overridden
10.10.0.0/16 Network Region GHI Overridden
Container
10.10.0.0/24 Network Region GHI Inherited from
10.10.0.0/16
10.10.1.0/24 Network Region JKL Overridden

Example 5.1: Removing object 10.0.0.0/8 from the parent level

You select the following option for the existing extensible attribute:
• Remove extensible attributes with the inheritance state set to Inherited. Extensible attributes with the state set
to Overridden are not removed.
Result:

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/16 Network
Container
10.0.0.0/24 Network
10.0.1.0/24 Network Region ABC Overridden
10.10.0.0/16 Network Region GHI Overridden
Container
10.10.0.0/24 Network Region GHI Inherited from
10.10.0.0/16
10.10.1.0/24 Network Region JKL Overridden

Example 5.2: Removing object 10.0.0.0/8 from the parent level

NIOS 7.3 NIOS Administrator Guide (Rev. A) 433

Managing Appliance Operations

You select the following option for the existing extensible attribute on descendants:
• Preserve all extensible attributes on the descendant.
Result:

Extensible Extensible Inheritance

Object Type Attribute Attribute Value State
10.0.0.0/16 Network Region DEF Native
Container
10.0.0.0/24 Network Region DEF Inherited from
10.0.0.0/16
10.0.1.0/24 Network Region ABC Overridden
10.10.0.0/16 Network Region GHI Native
Container
10.10.0.0/24 Network Region GHI Inherited from
10.10.0.0/16
10.10.1.0/24 Network Region JKL Overridden

Example 5.3: Remove object 10.10.0.0/16 from the parent level

You select the following option for the existing extensible attribute on descendants:
• Remove extensible attributes with the inheritance state set to Inherited. Extensible attributes with the state set
to Overridden are retained.
Result:

Object Type Extensible Extensible Inheritance

Attribute Attribute Value State
10.0.0.0/8 Network Region DEF Native
Container
10.0.0.0/16 Network Region DEF Inherited from
Container 10.0.0.0/8
10.0.0.0/24 Network Region DEF Inherited from
10.0.0.0/8
10.0.1.0/24 Network Region ABC Overridden
10.10.0.0/24 Network Region
10.10.1.0/24 Network Region JKL Overridden

Example 6
Examples in this section show different results after you add an object in the middle of the inheritance chain based
on the following:

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/8 Network Owner Admin Native
Container

434 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Examples for Inheritable Extensible Attributes

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/16 Network Owner Admin Inherited from
Container 10.0.0.0/8
10.0.0.0/24 Network Owner Admin Inherited from
10.0.0.0/8
10.0.1.0/24 Network Owner Joe Overridden
10.10.0.0/24 Network Owner Admin Inherited from
10.0.0.0/8
10.10.1.0/24 Network Owner Annie Overridden

Example 6.1: Adding object 10.10.0.0/16 without extensible attributes

You select the following option for the existing extensible attribute:
• Retain values if the extensible attribute already exists, and inherit the attribute from the parent object if it does
not exist.
Result:

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/8 Network Owner Admin Native
Container
10.0.0.0/16 Network Owner Admin Inherited from
Container 10.0.0.0/8
10.0.0.0/24 Network Owner Admin Inherited from
10.0.0.0/8
10.0.1.0/24 Network Owner Joe Overridden
10.10.0.0/16 Network Owner Admin Inherited from
Container 10.0.0.0/8
10.10.0.0/24 Network Owner Admin Inherited from
10.0.0.0/8
10.10.1.0/24 Network Owner Annie Overridden

Example 7
Examples in this section show different results after you modify inheritable extensible attributes with multiple values
based on the following:

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/8 Network
Container
10.0.0.0/16 Network Region MNO Native
Container
Region PQR Native

NIOS 7.3 NIOS Administrator Guide (Rev. A) 435

Managing Appliance Operations

Example 7.1: Adding extensible attribute Region with value GHI to 10.0.0.0/8
You select the following option for the existing extensible attributes:
• The descendants that already have this extensible attribute will inherit the value from the parent object.
Result: Multiple values will be replaced with the single inherited value.

Extensible Extensible
Object Type Attribute Attribute Value Inheritance State

10.0.0.0/8 Network Region GHI Native

Container
10.0.0.0/16 Network Region GHI Inherited from
Container 10.0.0.0/8

Example 7.2: Adding extensible attribute Region with value GHI to 10.0.0.0/8
You select the following option for the existing extensible attributes:
• The descendants that already have this extensible attribute will override the value.
Result: Extensible attribute values on descendants are retained, but single attribute value will be overridden.

Object Type Extensible Extensible Inheritance

Attribute Attribute Value State
10.0.0.0/8 Network Region GHI Native
Container
10.0.0.0/16 Network Region MNO Overridden
Container
Region PQR Overridden

Example 8
Examples in this section show different results after you modify existing inheritable extensible attribute of an object,
but you do not have required permission to modify some descendants. For information about admin permissions,
see About Administrative Permissions on page 195.

Extensible
Extensible Inheritance
Object Type Attribute Permission
Attribute Value State

10.0.0.0/8 Network Owner Sam Native Write

Container
10.0.0.0/16 Network Owner Sam Inherited from Read
Container 10.0.0.0/8
10.0.0.0/24 Network Owner Sam Inherited from Read
10.0.0.0/8
10.0.1.0/24 Network Owner Bob Overridden Write
10.10.0.0/16 Network Owner John Overridden Read
Container
10.10.0.0/24 Network Owner John Inherited from Read
10.10.0.0/16

436 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Examples for Inheritable Extensible Attributes

Extensible
Extensible Inheritance
Object Type Attribute Permission
Attribute State
Value
10.10.1.0/24 Network Owner Max Overridden Read
10.20.0.0/16 Network Owner Sam Inherited from Write
Container 10.0.0.0/8
10.20.0.0/24 Network Owner Read
10.20.1.0/24 Network Owner Read

Example 8.1: Removing object 10.0.0.0/8

You select the following option for the existing inheritable extensible attribute:
• Retain extensible attribute values on descendants that are inherited from this parent object.
Result:

Extensible
Extensible Inheritance
Object Type Attribute
Attribute
State Permission
Value
10.0.0.0/16 Network Owner Sam Native Read
Container
10.0.0.0/24 Network Owner Sam Native Read
10.0.1.0/24 Network Owner Bob Overridden Write
10.10.0.0/16 Network Owner John Overridden Read
Container
10.10.0.0/24 Network Owner John Inherited from Read
10.10.0.0/16
10.10.1.0/24 Network Owner Max Overridden Read
10.20.0.0/16 Network Owner Sam Native Write
Container
10.20.0.0/24 Network Read
10.20.1.0/24 Network Read

Example 8.2: Removing object 10.0.0.0/8

You select the following option for the existing inheritable extensible attribute:
• Remove extensible attribute values from descendants that are inherited from this parent object.
The appliance displays an error message when you remove an extensible attribute that is associated with a
descendant for which you do not have required permission.
Result:

Extensible
Extensible Inheritance
Object Type Attribute Permission
Attribute State
Value
10.0.0.0/16 Network
Container
10.0.0.0/24 Network

NIOS 7.3 NIOS Administrator Guide (Rev. A) 437

Managing Appliance Operations

Extensible
Extensible Inheritance
Object Type Attribute Permission
Attribute State
Value
10.0.1.0/24 Network Owner Bob Overridden Write
10.10.0.0/16 Network Owner John Overridden Read
Container
10.10.0.0/24 Network Owner John Inherited from Read
10.10.0.0/16
10.10.1.0/24 Network Owner Max Overridden Read
10.20.0.0/16 Network Write
Container
10.20.0.0/24 Network Read
10.20.1.0/24 Network Read

Example 9
Examples in this section show different results after you join multiple networks, based on the following:

Object Type Extensible Extensible Inheritance State

Attribute Attribute Value
10.1.0.0/16 Network Owner John Native
10.1.0.1 Fixed Address Owner John Inherited from
10.1.0.0/16
10.2.0.0/16 Network Owner Sam Native
10.2.0.1 Fixed Address Owner Jane Overridden

Example 9.1: Joining networks 10.0.0.0/8 with 10.1.0.0/16

You select the following option for the existing extensible attribute:
• Join networks 10.0.0.0/8 with 10.1.0.0/16.
Result:

Object Type Extensible Extensible Inheritance

Attribute Attribute Value State
10.0.0.0/8 Network Owner John Native
Container
10.1.0.1 Fixed Address Owner John Inherited from
10.0.0.0/8
10.2.0.1 Fixed Address Owner Jane Overridden

Example 9.2: Joining networks 10.0.0.0/8 with 10.2.0.0/16

You select the following option for the existing extensible attribute:
• Join networks 10.0.0.0/8 with 10.2.0.0/16.

438 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Security Operations

Extensible Extensible Inheritance

Object Type
Attribute Attribute Value State
10.0.0.0/8 Network Owner Sam Native
Container
10.1.0.1 Fixed Address Owner Sam Inherited from
10.0.0.0/8
10.2.0.1 Fixed Address Owner Jane Overridden

Managing Security Operations

The Grid provides certain security-related features. The following sections describe the different security-related
features that you can set. For information about how to configure these features,

Enabling Support Access

Infoblox Technical Support might need access to your NIOS appliance to troubleshoot problems. This function
enables an SSH (Secure Shell) daemon that only Infoblox Technical Support can access. If you have any questions,
contact Infoblox Technical Support at [email protected]. By default, this option is disabled.

Restricting Remote Console Access

You can restrict admins from accessing the Infoblox CLI from a remote location using an SSH (Secure Shell) v2 client.
When you select this only admins who have access rights will be able to access the Infoblox CLI using an SSH (Secure
Shell) v2 client. By default, this option is disabled.

Enabling Remote Console Access

This function makes it possible for a superuser admin to access the Infoblox CLI from a remote location using an SSH
(Secure Shell) v2 client. The management system must have an SSH v2 client to use this function. After opening a
remote console connection using an SSH client, log in using a superuser name and password. By default, this option
is disabled. Note that only superusers can log in to the appliance through a console connection.

Permanently Disabling Remote Console and Support Access

You can permanently disable remote console (Secure Shell v2) access for appliance administration and for Infoblox
Technical Support to perform remote troubleshooting. Disabling this type of access might be required in a
high-security environment.

WARNING: After permanently disabling remote console and support access, you cannot re-enable them! Not
even resetting an appliance to its factory default settings can re-enable them.

Restricting GUI/API Access

You can specify the IP addresses from which administrators are allowed to access the NIOS appliance. When the NIOS
appliance receives a connection request, it tries to match the source IP address in the request with IP addresses in
the list. If there is at least one item in the HTTP Access Control list and the source IP address in the request does not
match it, the NIOS appliance ignores the request.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 439

Managing Appliance Operations

Caution: If you specify an address or network other than the one from which you are currently accessing the
appliance, when you save your configuration, you will lose your administrative session and be unable to
reconnect. If you have enabled the Enable GUI/API Access via both MGMT and LAN1/VIP feature and
configured ACLs to control access to the GUI and API, then the same set of ACLs are applicable on both the
interfaces (LAN1 and MGMT port). For information, see Enabling GUI and API Access on the MGMT and
LAN1/VIP Ports on page 444 and Configuring Security Features on page 440.

Enabling HTTP Redirection

You can enable the NIOS appliance to redirect administrative connection requests using HTTP to the secure HTTPS
protocol. When you disable redirection, the NIOS appliance ignores any administrative connection requests not using
HTTPS. By default, the NIOS appliance does not redirect HTTP connection requests to HTTPS. When you change this
setting, the application restarts and your management session terminates.

Modifying the Session Timeout Setting

You can set the length of idle time before an administrative session to the Infoblox GUI times out. The default timeout
value is 600 seconds (10 minutes).
If a user does not interact with the application for the specified time, the appliance displays a message that a timeout
has occurred. Click OK to restart the GUI session.

Note: If you change the session timeout value, the new setting takes effect only after you log out and log back in.

Disabling the LCD Input Buttons

By default, the LCD input function is enabled, which allows you to use the LCD buttons on the front panel of a NIOS
appliance to change the IPv4 address settings of the LAN port. You can disable this function if the appliance is in a
location where you cannot restrict access exclusively to NIOS appliance administrators and you do not want anyone
to be able to make changes through the LCD.

Configuring Security Features

You can manage only certain features at the member level. To configure security features for the Grid or an individual
member:
1. Grid: From the Grid tab, select the Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then
click the Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the Security tab, complete the following:
— Session Timeout(s): This field is in the Grid Properties editor only. Enter a number between 60 and
31536000 seconds (one minute – one year) in the Session Timeout field. The default session timeout is
600 seconds (10 minutes).
— Minimum Password Length: This field is in the Grid Properties editor only. Specify the minimum number of
characters allowed for an admin password.
— Redirect HTTP to HTTPS: This field is in the Grid Properties editor only. Select this option to have the
appliance redirect HTTP connection requests to HTTPS.
— Restrict GUI/API Access: To control access to the GUI and API, select one of the following. You can restrict
access using a named ACL or define individual ACEs. For information about named ACLs, see Configuring
Access Control on page 398.
— Allow Any: Select this to allow any clients to access the GUI and API. This is selected by default.

440 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Security Operations

— Named ACL: Select this and click Select Named ACL to select a named ACL that contains only IPv4 and
IPv6 addresses and networks. GUI and API access restriction does not support TSIG key based ACEs.
When you select this, the appliance allows GUI and API access for all ACEs in the named ACL. You can
click Clear to remove the selected named ACL.
— Set of ACEs: Select this to configure individual access control entries (ACEs). Click the Add icon and
select one of the following from the drop-down list. Depending on the item you select, Grid Manager
either adds a row for the selected item or expands the panel so you can specify additional information
about the item you are adding.
• IPv4 Address and IPv6 Address: Select this to add an IPv4 address or an IPv6 address. Click the
Value field and enter the IP address. The appliance allows this client to access the GUI and API and
restricts others.
• IPv4 Network and IPv6 Network: Select this to add an IPv4 network or IPv6 network. Click the Value
field and enter the network. The appliance allows this network to access the GUI and API and
restricts others.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
— Access Restrictions Apply to Remote Console: Select this to restrict admins from accessing the Infoblox CLI
from a remote location using SSH (Secure Shell) v2 client.
— Enable Remote Console Access: Select this option to enable superuser admins to access the Infoblox CLI
from a remote location using SSH (Secure Shell) v2 clients. You can set this at the Grid and member levels.
— Enable Support Access: Select this check box to enable an SSH (Secure Shell) daemon that only Infoblox
Technical Support can access. You can set this at the Grid and member levels.
— Restrict Remote Console and Support Access to the MGMT Port: This field is in the Grid Member Properties
editor only. Select this check box to restrict SSH (Secure Shell) v2 access to the MGMT port only. This
restricts Infoblox Technical Support and remote console connections—both of which use SSH v2—to just
the MGMT port. For an HA pair, you can make an SSH v2 connection to the MGMT port on both the active
and passive nodes.
Clear the check box to allow SSH v2 access to both the MGMT and LAN ports.
— Permanently Disable Remote Console and Support Access: This field is in the Grid Properties editor only.
Select this option to permanently disable remote console (Secure Shell v2) access for appliance
administration and for Infoblox Technical Support.
— Enable LCD Input: Select this check box to allow use of the LCD buttons on the front panel of a NIOS
appliance to change the IP address settings of the LAN port. Clear this check box to disable this function.
You can set this at the Grid and member levels.
3. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 441

Managing Appliance Operations

Configuring Proxy Servers

If your network environment does not allow direct HTTP or HTTPS communication with the Internet through a firewall
from a secure location in which the Grid Master or standalone appliance resides, you can configure your appliance to
use a proxy server so you can receive automatic updates, such as threat protection rulesets and threat analytics
bundles, through this connection. You can also configure a proxy server to perform AWS related communication, such
as using a proxy server as the AWS API Proxy, performing vDiscovery on AWS endpoints, and pulling DNS data from
Amazon Route 53. For information about AWS deployments, refer to the Installation Guide for vNIOS for AWS. For
information about vDiscovery, see Configuring vDiscovery Jobs on page 630.

Note: Note that configured proxy settings are for the entire Grid. You cannot configure proxy settings for individual
members.

Depending on the updates you want to download, you may need to install the respective licenses in your Grid. For
example, to download threat protection ruleset updates, the Grid must have the Threat Protection Update license
installed. To download threat analytics bundles, you must install the Threat Analytics license. When you configure
your appliance to obtain periodic ruleset updates, all updates go through the MGMT port on the Grid Master by
default. You can, however, delegate this function to a Grid member using a different interface such as LAN1 or LAN2.
For information about how to delegate updates to a Grid member and configure the interface, see Configuring
Members and Interfaces for Automatic Updates on page 443.
To configure proxy settings for the Grid:
1. From the Grid tab, select the Grid Manager tab, and then click Edit -> Grid Properties from the Toolbar.
2. In the Grid Properties editor, select the Proxy Settings tab -> Basic tab, and complete the following:
— Use Proxy Server: When you select this check box, the appliance uses the connection that has been
established with the proxy server to establish connection with endpoints or download automatic updates,
such as threat protection rulesets and threat analytics bundles. This setting applies to the entire Grid.
When you clear this check box, the appliance does not use the proxy server; however, the configuration will
be not be affected.
— Name or IP Address and Port: Enter the name or IP address and port number of the proxy server you plan to
use for this connection.
— HTTPS Proxy Content Inspection: From the drop-down list, select one of the following methods the proxy
server uses to inspect packet content. Note that this section does not apply to AWS deployments.
— None: Select this to use HTTP for the connection. This method does not allow certificate authentication
for the proxy server.
— Allow Deep Packet Inspection: This option is not supported for AWS deployments. To eliminate
man-in-the-middle attacks, select this to allow deep pack inspection and information extraction for
non-compliant protocol, intrusions, or other criteria that determine whether the packets should be
routed to an alternate destination. When you select this, you must click Proxy Server Certificate and
navigate to the proxy server certificate to upload it to the Grid, or you must ensure that a trusted chain
has been established before the proxy server can perform deep packet inspection. When you have
uploaded a certificate, the appliance displays Loaded.
• Enable Strict Host Name Checking: This option is enabled only when you select Allow Deep Packet
Inspection. As part of the SSL handshake process, the appliance verifies that the CN (Common
Name) of the public certificate of the proxy server exactly matches the host name of the proxy
server.
Credentials for Proxy Server (if configured at proxy server)
— Use username and password to connect to proxy server if configured: If you have configured user
credentials on the proxy server, enter the Username and Password here. This is optional.

442 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Ethernet Ports

Configuring Members and Interfaces for Automatic Updates

To delegate automatic updates to a Grid member or change the interface for downloads, complete the following:
1. From the Grid tab, select the Grid Manager tab, and then click Edit -> Grid Properties from the Toolbar.
2. In the Grid Properties editor, select the Proxy Settings tab -> Basic tab, and complete the following:
— In the Members table, click the Add icon and select Add Member. In the Member Selector, select the
member to which you want to delegate the automatic update function. The appliance adds the Grid
member to the table. You can add up to five members for automatic updates. When you add multiple
members, you can place the selected members in the order you prefer using the arrows next to the table. If
for any reasons the first member is unable to receive updates, the appliance goes down the list in the order
the members are placed until the next reachable member receives the updates.
— Click the Interface column, and from the drop-down list select the interface (Any, LAN2, MGMT or VIP) you
want the corresponding member to use for automatic updates. Ensure that the selected interface is
configured properly on the member. The default is Any, which maps to the LAN1 interface for all appliance
models, except for the PT models. For all PT appliances, Any maps to the MGMT interface. You can select
MGMT or Any for threat protection members. Note that VLANs are not supported.
You can click the Test connectivity to all members icon to ensure that the connectivity between the ruleset
download web site and all Grid members is properly established using the selected interface. The appliance
displays a message indicating the connectivity status in the feedback panel.
The table displays the following:
• Name: Displays the member name. For the Grid Master, this field displays Grid Master.
• Interface: Displays the selected interface that is used for automatic updates.

Note: The appliance generates an SNMP trap if any of the configured Grid members failed to receive updates.

Configuring Ethernet Ports

Depending on your deployment and configuration choices, the Ethernet ports on the NIOS appliance perform
different functions. The Ethernet ports that handle traffic on the NIOS appliance are as follows:
• LAN1 port – A 10/100/1000-Mbps gigabit Ethernet port that connects the appliance to the network. This is the
default port for single independent appliances, single Grid members, and passive nodes in HA pairs. You must
use the LAN1 port to set up the appliance initially. It handles traffic for all management services if you do not
enable the MGMT and LAN2 ports. The passive node in an HA pair uses this port to synchronize the database
with the active node.
• LAN2 port – A 10/100/1000-Mbps gigabit Ethernet port that connects the appliance to the network. The LAN2
port is not enabled by default. You can enable the LAN2 port and define its use through the GUI after the initial
setup. By default, the appliance uses the LAN1 port (and HA port when deployed in an HA pair). To enable and
configure the LAN2 port, you must have read/write permission to the Grid member on which you want to enable
the port. The LAN2 port is available on the TE-810, TE-820, TE-1410, TE-1420, TE-2210, TE-2220, and IB-4010
appliances. For information about how to use the LAN2 port, see Using the LAN2 Port on page 457.
• HA port – A 10/100/1000-Mbps gigabit Ethernet port through which the active node in an HA (high availability)
pair connects to the network using a VIP (virtual IP) address. HA pair nodes also use their HA ports for VRRP
(Virtual Router Redundancy Protocol) advertisements.
• MGMT port – A 10/100/1000-Mbps gigabit Ethernet port that you can use for appliance management or DNS
service. You can enable the MGMT port and define its use through the GUI after the initial setup. If the MGMT
port is enabled, the NIOS appliance uses it for management services (see Table 8.5 on page 450 for specific
types).

NIOS 7.3 NIOS Administrator Guide (Rev. A) 443

Managing Appliance Operations

You can do the following on some of the Ethernet ports, depending on your network requirements and configurations:
• Assign VLANs (Virtual LANs) to the LAN1 and LAN2 ports so that NIOS can provide DNS service to different
subnetworks on the same interface. For more information about VLANs, see About Virtual LANs.
• Implement DiffServ (Differentiated Services) on the appliance by configuring the DSCP (Differentiated Services
Code Point) value. For more information about DiffServ and DSCP, see Implementing Quality of Service Using
DSCP on page 447.

Enabling GUI and API Access on the MGMT and LAN1/VIP Ports
You can access the Infoblox GUI and API through the MGMT and LAN1 or VIP interfaces simultaneously. To do so, you
must first configure the MGMT port on the appliance, and then enable the Enable GUI/API Access via both MGMT and
LAN1/VIP feature. For information about the MGMT port, see Using the MGMT Port on page 461. When you enable
this feature, you can use the MGMT and LAN1ports for standalone appliances and MGMT and VIP ports for an HA pair.
This feature is disabled for all new installations and upgrades.

Note: When the Threat Protection service is running on the Advanced Standalone Appliance, then the GUI and API
access is allowed only on the MGMT port.

To enable GUI and API access on the MGMT and LAN1/VIP ports:
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and select Grid Properties -> Edit.
3. In the Grid Properties editor, select the General tab -> click the Advanced tab (or click Toggle Advanced Mode) and
complete the following:
— Enable GUI/API Access via both MGMT and LAN1/VIP: Select this check box to allow access to the Infoblox
GUI and API using both the MGMT and LAN1 ports for standalone appliances and allow both the MGMT and
VIP ports for an HA pair. This feature is valid only if you have enabled the MGMT port. For information about
enabling the MGMT port, see Appliance Management on page 462.
4. Click Save to save the changes.

About Virtual LANs

You can assign VLANs (Virtual Local Area Networks) to the LAN1, LAN2, and VIP (for HA pairs) interfaces so the
appliance can provide DNS service to different subnetworks on the same interface. You can also configure VLANs
interfaces on supported Network Insight appliances and use them exclusively for discovery purposes. VLANs are
independent logical networks that are mutually isolated on the interface so that IP packets can pass between them
through one or more switches or routers. You can assign VLANs to provide segmentation services to address issues
such as scalability, security, and network management. For example, you can partition your network into segments
such as DHCP address allocation, DNS service, guest network, and DMZ (demilitarized zone) to achieve a higher level
of security and to increase performance by limiting broadcast domains. You can also add quality of service schemes
to optimize your network traffic on the VLAN trunk links by configuring the DSCP (Differentiated Services Code Point)
value for the corresponding physical and virtual interfaces. For information about DSCP, see Implementing Quality of
Service Using DSCP on page 447.

Note: When you configure VLANs on the following Network Insight appliances: ND-1400, ND-2200, ND-4000,
ND-VM-1400 and ND-VM-2200, the VLAN interfaces are used exclusively for discovery. You cannot bind other
services on these VLAN interfaces of the supported Network Insight appliances. For more information about
Network Insight, see About Network Insight on page 656.

444 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Ethernet Ports

VLAN Tagging
When your VLANs span across multiple networks, VLAN tagging is required. This enables the NIOS appliance to
connect to different networks using the same port. VLAN tagging involves adding a VLAN tag or ID to the header of an
IP packet so the appliance can identify the VLAN to which the packet belongs. In addition, switches use the VLAN tag
to determine the port to which it should send a broadcast packet. The appliance uses the IEEE 802.1Q networking
standard to support VLANs and VLAN tagging. On the appliance, you can configure VLANs as tagged networks by
adding VLAN tags to them. You can create up to 10 IPv4 and IPv6 addresses per interface and configure a VLAN ID
from one to 4094. You can also configure an address, gateway, and a netmask for VLAN. Any IPv4 or IPv6 address with
a VLAN ID is considered as a tagged network. For HA pairs, the appliance supports only one VLAN interface for VRRP
over an IPv4 or IPv6. It supports one untagged IPv4 and IPv6 address for each interface and considers this as the
primary IP address for the network. For an HA pair, if you have multiple VLANs assigned to a VIP interface, then a
network failure in any one of the VLAN interface does not trigger a failover of the active member.
Untagged networks are those without VLAN tags assigned to them. When you set up a VLAN as either a tagged or
untagged network, ensure that you properly configure the corresponding switch for the VLAN to function properly.

Note: A tagged VLAN interface receives only those packets that belongs to the tagged network, but an untagged
VLAN interface receives all the packets belonging to the tagged and untagged networks of the interface.

VLANs and VLAN tagging are supported on both IPv4 and IPv6 transports. This feature is currently supported on the
following Infoblox appliances: Trinzic 1410, Trinzic 1420, Trinzic 2210, Trinzic 2220, Infoblox-4010,
Infoblox-4030-Rev1, Infoblox-4030-Rev2, Infoblox-4030-10G, PT-1400, PT-2200, PT-4000, and PT-4000-10GE. VLAN
tagging is not supported on TE-100, TE-810, and TE-820. For more information about VLAN support for an
Infoblox-4030 appliance, refer to the DNS Cache Acceleration Application Guide. For information about these
appliances, refer to the respective installation guides on the Infoblox Support web site at
http://www.infoblox.com/support.
Currently, only the DNS service can listen on specific VLAN interfaces. The DHCP service listens only on the primary
VLAN interface (tagged or untagged). However, if the primary VLAN interface is untagged, DHCP will serve all VLANs
on that interface because an untagged primary VLAN receives all broadcast packets. You can also specify VLANs as
the source port for sending DNS queries and notify messages. For information about how to configure these, see
Specifying Port Settings for DNS on page 760.
Additional VLAN support is available exclusively for discovery on the following Network Insight appliances: ND-1400,
ND-2200, ND-4000, ND-VM-1400 and ND-VM-2200. Binding other services on the VLAN interfaces of the Network
Insight appliances is not supported.

Note: When you join an appliance that supports VLANs to a Grid that does not support VLANs or revert the appliance
to a NIOS version that does not support VLANs, the appliance will become unreachable after joining the Grid
or being reverted. You must remove VLAN tagging from the corresponding switch in order to reach the
downgraded appliance.

Consider the following guidelines when tagging VLANs on the LAN1 and LAN2 ports:
• You can assign VLAN addresses to an interface and add VLAN tags to them. However, you must designate one of
the tagged VLANs as a primary address.
• If the primary IPv4 address is tagged with a VLAN ID, all other addresses on the same interface must be tagged
with a VLAN ID as well.
• You can use the same VLAN ID to tag only one IPv4 and one IPv6 address on the same interface. You cannot use
the same VLAN ID to tag multiple IPv4 and IPv6 addresses on the same interface.
• You can assign one untagged IPv4 and one untagged IPv6 address to the same interface. These addresses are
designated as the primary address for the interface.
• For IPv6, you must have a primary IPv6 address (either tagged or untagged) before you can add other tagged
IPv6 addresses on the same interface.
• If you have multiple VLANs assigned to the LAN1 interface and the primary VLAN is untagged, DHCP listens on
all VLAN interfaces and thus DHCP lease requests will succeed for the additional VLANs assigned to the LAN1
interface, but the request will actually be handled by the primary untagged VLAN interface.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 445

Managing Appliance Operations

• You can set up the system to define only tagged networks:

— When the VLAN tag is not set, the appliance considers the network as an untagged network.
— You can specify a single untagged IPv4 and IPv6 network per interface.
— The primary network can be tagged or untagged but you must tag the additional VLANs.

Configuring VLANs
When you first set up a NIOS appliance, you can assign VLANs through the Grid Setup Wizard. For more information,
see Using the Setup Wizard on page 294. After the initial setup, you can assign VLANs to the LAN1 or LAN2 ports in
the Required Ports and Addresses table, as described in Modifying Ethernet Port Settings on page 456.
On a Grid member, you can assign up to 10 VLANS for each protocol (IPv4 or IPv6) on the LAN1 and LAN2 ports. You
can assign up to 10 IPv4 VLAN addresses and 10 IPv6 VLAN addresses for each interface. You can configure only IPv4
VLAN addresses for an IPv4 Grid member and only IPv6 VLAN addresses for an IPv6 Grid member, but for a dual mode
Grid member you can configure both IPv4 and IPv6 VLAN addresses.
To assign additional VLANs to the LAN1 or LAN2 port, complete the following:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.
2. Select the Network -> Basic tab in the Grid Member Properties editor.
3. In the Additional Ports and Addresses table, click the Add icon and select either MGMT (IPv4), MGMT (IPv6), LAN2
(IPv4), LAN2 (IPv6), Additional Address (loopback) (IPv4), Additional Address (loopback) (IPv6), LAN1
(VLAN)(IPv4), LAN1 (VLAN)(IPv6), LAN2 (VLAN)(IPv4) or LAN2 (VLAN)(IPv6) from the drop-down list. You can add
up to 10 IPv4 and 10 IPv6 VLANs for each interface. Note that you can configure only IPv4 VLAN addresses for an
IPv4 Grid member and only IPv6 VLAN addresses for an IPv6 Grid member, but for a dual mode Grid member you
can configure both IPv4 and IPv6 VLAN addresses.
— MGMT (IPv4): Select this to configure IPv4 address for MGMT port. Note that the Infoblox-4030 appliance
supports a /32 configuration for IPv4 on MGMT and supports multi-interface only when both LAN1 and
MGMT are on the same subnet.
— MGMT (IPv6): Select this to configure IPv6 address for MGMT port. Note that Infoblox-4030 appliance
supports a /128 prefix configuration for IPv6 on MGMT and supports multi-interface only when both LAN1
and MGMT are on the same subnet.
— LAN2 (IPv4): Select this to configure IPv4 address for the LAN2 port for DHCP or DNS. Note that
Infoblox-4030 appliance supports a /32 configuration for IPv4 on LAN2 and supports multi-interface only
when both LAN1 and LAN2 are on the same subnet. This is not applicable to Trinzic 100 appliance.
— LAN2 (IPv6): Select this to configure IPv6 address for the LAN2 port for DHCP or DNS. Note that
Infoblox-4030 appliance supports a /128 prefix configuration for IPv6 on LAN2 and supports
multi-interface only when both LAN1 and LAN2 are on the same subnet. This is not applicable to Trinzic 100
appliance.
— Additional Address (loopback) (IPv4): Select this to add a non-anycast IPv4 address to the loopback
interface. Note that you can configure this for IPv4 and dual mode Grid member.
— Additional Address (loopback) (IPv6): Select this to add a non-anycast IPv6 address to the loopback
interface. Note that you can configure this for IPv6 and dual mode Grid member.
— LAN1 (VLAN) (IPv4): Select this to add a VLAN to the LAN1 interface. You can add up to 10 IPv4 VLAN
addresses. Note that you can configure this for IPv4 and dual mode Grid member. This is supported on
Trinzic 2210, Trinzic 2220, Infoblox-1410, Infoblox-4010, Infoblox-4030-Rev1, Infoblox-4030-Rev2,
Infoblox-4030-10G, PT-1400, PT-2200, PT-4000, and PT-4000-10GE appliances. VLAN tagging is not
supported on TE-100, TE-810, TE-820, and vNIOS virtual appliances.
— LAN1 (VLAN) (IPv6): Select this to add a VLAN to the LAN1 interface. You can add up to 10 IPv4 and 10 IPv6
VLAN addresses. Note that you can configure this for IPv6 and dual mode Grid member. This is supported
on Trinzic 2210, Trinzic 2220, Infoblox-1410, Infoblox-4010, Infoblox-4030-Rev1, Infoblox-4030-Rev2,
Infoblox-4030-10G, PT-1400, PT-2200, PT-4000, and PT-4000-10GE appliances.

446 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Ethernet Ports

— LAN2 (VLAN) (IPv4): Select this to add a VLAN to the LAN2 interface. You can add up to 10 IPv4 VLAN
addresses. Note that you can configure this for IPv4 and dual mode Grid member. This is supported on
Trinzic 2210, Trinzic 2220, Infoblox-1410, Infoblox-4010, Infoblox-4030-Rev1, Infoblox-4030-Rev2,
Infoblox-4030-10G, PT-1400, PT-2200, PT-4000, and PT-4000-10GE appliances.
— LAN2 (VLAN) (IPv6): Select this to add a VLAN to the LAN2 interface. You can add up to 10 IPv6 VLAN
addresses. Note that you can configure this for IPv6 and dual mode Grid member. This is supported on
Trinzic 2210, Trinzic 2220, Infoblox-1410, Infoblox-4010, Infoblox-4030-Rev1, Infoblox-4030-Rev2,
Infoblox-4030-10G, PT-1400, PT-2200, PT-4000, and PT-4000-10GE appliances.
4. Enter the following:
— Interface: Displays the name of the VLAN interface. This can be LAN1 (VLAN)(IPv4), LAN1 (VLAN)(IPv6),
LAN2 (VLAN)(IPv4), or LAN2 (VLAN)(IPv6) depending on your selection. You cannot modify this.
— Address: Type the IP address for the VLAN port.
— Subnet Mask (IPv4) or Prefix Length (IPv6): For IPv4 address, specify an appropriate subnet mask and for
IPv6 address, specify the prefix length. The prefix length ranges from 2 to 127, with common-sense values
ranging from /48 to /127 due to the larger number of bits in the IPv6 address.
— Gateway: Type the IPv4 or IPv6 default gateway address for the VLAN port depending on the type of
interface. For IPv6 interface, you can also type Automatic to enable the appliance to acquire the IPv6
address of the default gateway and the link MTU from router advertisements.
You can now define a link-local address as the default IPv6 gateway and isolate the LAN segment so the
local router can provide global addressing and access to the network and Internet. This is supported for
both LAN1 and LAN2 interfaces as well as LAN1 and LAN2 in the failover mode.
— VLAN Tag: Enter the VLAN tag or ID. You can enter a number from 1 to 4094. Ensure that you configure the
corresponding switch accordingly. For information about VLANs, see About Virtual LANs on page 444.
— Port Settings: For IPv4 only. From the drop-down list, choose the connection speed that you want the port to
use. You can also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or
Half for data transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to
negotiate the optimum port connection type (full or half duplex) and speed with the connecting switch
automatically. This is the default setting. You cannot configure port settings for vNIOS appliances.
— DSCP Value: Displays the Grid DSCP value, if configured. To modify, click Override and enter the DSCP value.
You can enter a value from 0 to 63. For information about DSCP, see Implementing Quality of Service Using
DSCP on page 447.
5. Save the configuration and click Restart if it appears at the top of the screen.

Implementing Quality of Service Using DSCP

You can implement DiffServ (Differentiated Services) on the appliance by configuring the DSCP (Differentiated
Services Code Point) value. DiffServ is a scalable and class-based mechanism that provides relative priorities to the
type of services on your network. It can provide low latency for critical network traffic while providing simple
best-effort service for non-critical services. The Infoblox DSCP implementation fully conforms to RFC 2475. For more
information about DiffServ, refer to RFC 2475, An Architecture for Differentiated Services.
In IPv4 and IPv6 headers, DiffServ uses the DS (Differentiated Services) field for packet classification purposes. The
DS field defines the layout of the ToS (Type of Services) octet in IPv4 and the Traffic Class octet in IPv6. The first six
bits of the DS field are used as the DSCP value, which determines the PHBs (per-hope behaviors) on DiffServ
compliant nodes and enables priorities of services to be assigned to network traffic. For more information about the
DS field, refer to RFC 2474, Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers.
When you configure the DSCP value for DiffServ, the appliance sets priorities for all outgoing IP traffic. It implements
QoS (quality of service) rules so you can effectively classify and manage your critical network traffic. To ensure that
core network services, such as DNS services, continue to operate in the event of network traffic congestion, you can
set the DSCP value for the entire Grid and override it at the member level. Note that on an appliance, all outgoing IP
traffic on all interfaces uses the same DSCP value.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 447

Managing Appliance Operations

DSCP is supported on both IPv4 and IPv6 transports and the DSCP value for both IPv4 and IPv6 transports must be
the same. This feature is currently supported on the following Infoblox appliances: Trinzic 2210, Trinzic 2220,
Infoblox-4010, Infoblox-4030, Infoblox-4030-10GE, PT-1400, PT-2200, PT-4000, and PT-4000-10GE. For information
about these appliances, refer to the respective installation guides on the Infoblox Support web site at
http://www.infoblox.com/support.

Note: You can set the DSCP value of the primary LAN using the set network CLI command. For information about
the CLI command, refer to the Infoblox CLI Guide. DSCP values for all other interfaces and VLANs must be set
through Grid Manager.

Configuring the DSCP Value

The DSCP value is set to zero (lowest priority) by default. You can change this value for the Grid and override the value
at the member level. When you configure the DSCP value at the Grid or member level, all outgoing IP traffic on all
interfaces uses the same value. Valid DSCP values are from 0 to 63. You can also set the DSCP value using the Infoblox
CLI. For more information, refer to the Infoblox CLI Guide.
To configure the DSCP value for the Grid:
1. From the Grid tab -> Grid Manager tab, click Grid Properties -> Edit from the toolbar.
2. In the General -> Advanced tab of the Grid Properties editor, complete the following:
— DSCP Value: Enter a value from 0 to 63. The default is 0 and it represents the lowest priority.
3. Save the configuration.
To override the DSCP value for a member:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.
2. In the Network tab -> Basic tab of the Grid Member Properties editor, complete the following:
— DSCP Value: Click Override, and then enter a value from 0 to 63. The default is 0 and it represents the
lowest priority.
3. Save the configuration.
You can override the Grid and member DSCP value at the interface level. For more information, see the following:
• For the LAN1 port, see Modifying Ethernet Port Settings on page 456.
• For the LAN2 port, see Configuring the LAN2 Port on page 459.
• For the MGMT port, see Using the MGMT Port on page 461.

Ethernet Port Usage

This section provides tables that detail the port usage and source and destination ports for different services,
depending on your Grid configuration.
Table 8.3 displays the type of traffic per port for both Grid and independent deployments. For a more detailed list of
the different types of traffic, see Table 8.5 on page 450.

Table 8.3 Appliance Roles and Configuration, Communication Types, and Port Usage

Database Core Network Management GUI

Appliance Role HA Pair HA Status MGMT Port Synchronization Services Services Access

HA Grid Master Yes Active Disabled VIP on HA VIP on HA LAN1 VIP on HA

HA Grid Master Yes Passive Disabled LAN1 – LAN1 –

Single Grid Master No – Disabled LAN1 LAN1 LAN1 LAN1

HA Grid Member Yes Active Disabled LAN1 VIP on HA LAN1 –

448 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Ethernet Ports

Database Core Network Management GUI

Appliance Role HA Pair HA Status MGMT Port Synchronization Services Services Access

HA Grid Member Yes Passive Disabled LAN1 – LAN1 –

Single Grid Member No – Disabled LAN1 LAN1 LAN1 –

Independent HA Pair Yes Active Disabled VIP on HA VIP on HA LAN1 VIP on HA

Independent HA Pair Yes Passive Disabled LAN1 – LAN1 –

Single Independent No – Disabled – LAN1 LAN1 LAN1

HA Grid Master Yes Active Enabled VIP on HA VIP on HA MGMT MGMT

HA Grid Master Yes Passive Enabled LAN1 – MGMT –

Single Grid Master No – Enabled LAN1 LAN1 or MGMT MGMT MGMT

HA Grid Member Yes Active Enabled LAN1 or MGMT VIP on HA MGMT –

HA Grid Member Yes Passive Enabled LAN1 or MGMT – MGMT –

Single Grid Member No – Enabled LAN1 or MGMT LAN1 or MGMT MGMT –

Independent HA Pair Yes Active Enabled VIP on HA VIP on HA MGMT MGMT

Independent HA Pair Yes Passive Enabled LAN1 – MGMT –

Single Independent No – Enabled – LAN1 or MGMT MGMT MGMT

Reporting Member No – Enabled LAN1 or MGMT LAN1 or MGMT MGMT MGMT

Table 8.4 Appliance Roles and Configuration, Communication Types, and Port Usage for Appliances with LAN2 Ports

Core
HA Database Management GUI
Appliance Role MGMT Port LAN2 Port Network
Status Synchronization Services Access
Services

HA Grid Master Active Disabled Enabled VIP on HA VIP on HA LAN1 or LAN2 VIP on HA

HA Grid Master Passive Disabled Enabled LAN1 – LAN1 or LAN2 –

Single Grid Master – Disabled Enabled LAN1 LAN1 and/or LAN1 or LAN2 LAN1
LAN2
HA Grid Member Active Disabled Enabled LAN1 VIP on HA LAN1 or LAN2 –

HA Grid Member Passive Disabled Enabled LAN1 – LAN1 or LAN2 –

Single Grid Member – Disabled Enabled LAN1 LAN1 and/or LAN1 or LAN2 –
LAN2

Independent HA Pair Active Disabled Enabled VIP on HA VIP on HA LAN1 or LAN2 VIP on HA

Independent HA Pair Passive Disabled Enabled LAN1 – LAN1 or LAN2 –

Single Independent – Disabled Enabled – LAN1 and/or LAN1 or LAN2 LAN1

LAN2

HA Grid Master Active Enabled Enabled VIP on HA VIP on HA MGMT MGMT

HA Grid Master Passive Enabled Enabled LAN1 – MGMT –

Single Grid Master – Enabled Enabled LAN1 LAN1, LAN2 MGMT MGMT
and/or
MGMT

HA Grid Member Active Enabled Enabled LAN1 or MGMT VIP on HA MGMT –

NIOS 7.3 NIOS Administrator Guide (Rev. A) 449

Managing Appliance Operations

Core
HA Database Management GUI
Appliance Role MGMT Port LAN2 Port Network
Status Synchronization Services Access
Services

HA Grid Member Passive Enabled Enabled LAN1 or MGMT – MGMT –

Single Grid Member – Enabled Enabled LAN1 or MGMT LAN1, LAN2 MGMT –
and/or
MGMT

Independent HA Pair Active Enabled Enabled VIP on HA VIP on HA MGMT MGMT

Independent HA Pair Passive Enabled Enabled LAN1 – MGMT –

Single Independent – Enabled Enabled – LAN1, LAN2 MGMT MGMT

and/or
MGMT

Reporting Member – Enabled Enabled LAN1 or MGMT LAN1, LAN2, MGMT MGMT
and/or
MGMT

To see the service port numbers and the source and destination locations for traffic that can go to and from a NIOS
appliance, see Table 8.5. This information is particularly useful for firewall administrators so that they can set policies
to allow traffic to pass through the firewall as required.

Note: The colors in both tables represent a particular type of traffic and correlate with each other.

Table 8.5 Sources and Destinations for Services

SRC DST
Service SRC IP DST IP Proto Port Port Notes

Key LAN1 or MGMT VIP on HA Grid Master, 17 UDP 2114 2114 Initial key exchange for
Exchange on all Grid or LAN1 on single Grid establishing VPN
(Member members Master tunnels
Connection) (including Grid  Required for Grid
Master and Grid 
Master 
Candidate) 
 VIP on HA Grid Master
VIP on HA Grid Candidate, or LAN1 on
Master single Grid Master
Candidate, or Candidate
LAN1 on single
Grid Master
Candidate

450 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Ethernet Ports

SRC DST
Service SRC IP DST IP Proto Notes
Port Port
Key VIP on HA Grid LAN1 or MGMT on all 17 UDP 2114 2114
Exchange Master, or LAN1 Grid members
(Grid on single Grid (including Grid Master
Master Master and Grid Master
Candidate  Candidate)
Promotion) 

VIP on HA Grid
Master
Candidate or
LAN1 on Single
Grid Master
Candidate
VPN LAN1 or MGMT VIP on HA Grid Master, 17 UDP 1194 or 1194 or Default VPN port 1194
on Grid or LAN1 on single Grid 5002, 5002, for Grids with new
member Master or 1024 or 1024 DNSone 3.2
VIP on HA Grid Master -> -> installations and 5002
Candidate, or LAN1 on 63999 63999 for Grids upgraded to
single Grid Master DNSone 3.2; the port
Candidate number is configurable
Required for Grid
Network LAN1 or LAN2 LAN1 or LAN2 on UDP 1194 1194 All default VPN tunnels
Insight VPN on Probes Consolidator for Network Insight
Discovery LAN1 or LAN2 UDP 161 SNMP
on Probes
Discovery LAN1 or LAN2 UDP 260 SNMP - Needed for full
on Probes discovery of some older
Check Point models
Discovery LAN1 or LAN2 ICMP n/a Ping Sweep
on Probes
Discovery LAN1 or LAN2 UDP, 53 DNS
on Probes TCP
Discovery LAN1 or LAN2 ICMP Path Collection, for IPv4
on Probes addresses
Discovery LAN1 or LAN2 UDP 33434 Path Collection.
on Probes +1 per Standard traceroute,
probe for IPv6 addresses
packet
Discovery LAN1 or LAN2 ICMP, Port scan - all
on Probes UDP, configured by user
TCP
Discovery LAN1 or LAN2 UDP 137 NetBIOS
on Probes
Discovery LAN1 or LAN2 UDP 40125 NMAP, UDP Ping, and
on Probes credential checking

NIOS 7.3 NIOS Administrator Guide (Rev. A) 451

Managing Appliance Operations

SRC DST
Service SRC IP DST IP Proto Notes
Port Port
DHCP Client LAN1, LAN2, VIP, or 17 UDP 68 67 Required for IPv4 DHCP
broadcast on NIOS service
appliance
DHCP LAN1, LAN2 or Client 17 UDP 67 68 Required for IPv4 DHCP
VIP on NIOS service
appliance
DHCP Client LAN1, LAN2, VIP, or 17 UDP 546 547 Required for IPv6 DHCP
broadcast on NIOS service
appliance
DHCP LAN1, LAN2 or Client 17 UDP 547 546 Required for IPv6 DHCP
VIP on NIOS service
appliance
DHCP LAN1, LAN2 or LAN1, LAN2 or VIP on 6 TCP 1024 -> 519, or Required for DHCP
Failover VIP on Infoblox Infoblox DHCP failover 65535 647 failover
DHCP failover peer
peer
DHCP VIP on HA Grid LAN1, LAN2 or VIP on 6 TCP 1024 -> 7911 Informs functioning
Failover Master or LAN1 Grid member in a DHCP 65535 Grid member in a DHCP
or LAN2 on failover pair failover pair that its
single master partner is down
Required for DHCP
failover
DDNS LAN1, LAN2, or LAN1, LAN2, or VIP 17 UDP 1024 -> 53 Required for DHCP to
Updates VIP 65535 send DNS dynamic
updates
DNS LAN1, LAN2, LAN1, LAN2, VIP, or 6 TCP 53, or 53 For DNS zone transfers,
Transfers VIP, or MGMT, or MGMT 1024 -> large client queries,
client 65535 and for Grid members
to communicate with
external name servers
Required for DNS
DNS Client LAN1, LAN2, VIP, or 17 UDP 53, or 53 For DNS queries
Queries broadcast on NIOS 1024 -> Required for DNS
appliance 65535
DNS Client LAN1, LAN2, VIP, or 6 TCP 53, or 53 For DNS queries
Queries broadcast on NIOS 1024 -> Required for DNS
appliance 65535
NTP NTP client LAN1, LAN2, VIP, or 17 UDP 1024 -> 123 Required if the NIOS
MGMT 65535 appliance is an NTP
server

452 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Ethernet Ports

SRC DST
Service SRC IP DST IP Proto Notes
Port Port
NTP NTP client LAN1, LAN2, VIP, or 17 UDP 1024 -> 123 Required if the NIOS
MGMT 65535 appliance is an NTP
server. On an HA
member, the NTP
service runs on the
active node. If there is
an HA failover, the NTP
service is automatically
launched after the
passive node becomes
active and the NTP
traffic uses the LAN2,
VIP, or MGMT port on
one of the nodes from
an HA pair, instead of
the LAN1 port. During
another HA failover, the
currently passive node
becomes active again
and the NTP traffic uses
the LAN1 port, and the
NTP is back in
synchronization.
RADIUS NAS (network LAN1 or VIP 17 UDP 1024 – 1812 For proxying RADIUS
Authenti- access server) 65535 Authentication-Reques
cation ts. The default
destination port
number is 1812, and
can be changed to
1024 – 63997. When
configuring an HA pair,
ensure that you
provision both LAN IP
addresses on the
RADIUS server.
RADIUS NAS (network LAN1 or VIP 17 UDP 1024 – 1813 For proxying RADIUS
Accounting access server) 65535 Accounting-Requests.
The default destination
port number is 1813,
and can be changed to
1024 – 63998.
RADIUS LAN1 or VIP RADIUS home server 17 UDP 1814 1024 -> Required to proxy
Proxy 63997 requests from RADIUS
(auth), clients to servers. The
or 1024 default source port
-> number is 1814, and
63998 although it is not
(acct) configurable, it is
always two greater than
the port number for
RADIUS authentication.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 453

Managing Appliance Operations

SRC DST
Service SRC IP DST IP Proto Notes
Port Port
ICMP Dst VIP, LAN1, LAN1, LAN2, or 1 ICMP – – Required to respond to
Port LAN2, or MGMT, UNIX-based client Type 3 the UNIX-based
Unreach- or UNIX-based traceroute tool to
able client determine if a
destination has been
reached
ICMP Echo VIP, LAN1, VIP, LAN1, LAN2, or 1 ICMP – – Required for response
Reply LAN2, or MGMT, MGMT, or client Type 0 from ICMP echo request
or client (ping)
ICMP Echo VIP, LAN1, VIP, LAN1, LAN2, or 1 ICMP – – Required to send pings
Request LAN2, or MGMT, MGMT, or client Type 8 and respond to the
or client Windows-
based traceroute tool
ICMP TTL Gateway device Windows client 1 ICMP – – Gateway sends an ICMP
Exceeded (router or Type 11 TTL exceeded message
firewall) to a Windows client,
which then records
router hops along a
data path
NTP LAN1 on active NTP server 17 UDP 1024 -> 123 Required to
node of Grid 65535 synchronize Grid, TSIG
Master or LAN1 authentication, and
of independent DHCP failover
appliance Optional for
synchronizing logs
among multiple
appliances
SMTP LAN1, LAN2, or Mail server 6 TCP 1024 -> 25 Required if SMTP alerts
VIP 65535 are enabled
SNMP NMS (network VIP, LAN1, LAN2, or 17 UDP 1024 -> 161 Required for SNMP
management MGMT 65535 management
system) server
SNMP Traps MGMT or LAN1 NMS server 17 UDP 1024 -> 162 Required for SNMP trap
on Grid Master 65535 management.
or HA pair, or Uses MGMT (when
LAN1 on enabled) or LAN1 on
independent Grid Master or HA pair,
appliance or LAN1 on
independent appliance
for the source address,
depending on the
destination IP address.

454 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Ethernet Ports

SRC DST
Service SRC IP DST IP Proto Notes
Port Port
SSHv2 Client LAN1, LAN2, VIP, or 6 TCP 1024 -> 22 Administrators can
MGMT on NIOS 65535 make an SSHv2
appliance connection to the
LAN1, LAN2, VIP, or
MGMT port
Optional for
management
Syslog LAN1, LAN2, or syslog server 17 UDP 1024 -> 514 Required for remote
MGMT of NIOS 65535 syslog logging
appliance
Traceroute LAN1, LAN2, or VIP, LAN1, LAN2, or 17 UDP 1024 -> 33000 NIOS appliance
UNIX-based MGMT, or client 65535 -> responds with ICMP
appliance 65535 type code 3 (port
unreachable)
TFTP Data LAN1 or MGMT TFTP server 17 UDP 1024 -> 69, For contacting a TFTP
65535 then server during database
1024 -> and configuration
63999 backup and restore
operations
VRRP HA IP on the Multicast address 112 802 For periodic
active node of 224.0.0.18 VRRP announcements of the
HA pair availability of the HA
node that is linked to
the VIP. The nodes in
the HA pair must be in
the same subnet.
HTTP Management VIP, LAN1, or MGMT 6 TCP 1024 -> 80 Required if the
System 65535 HTTP-redirect option is
set on the Grid
properties security
page
HTTPS/ Management VIP, LAN1, or MGMT 6 TCP 1024 -> 443 Required for
SSL System 65535 administration through
the GUI
Reporting Reporting LAN1, LAN2, or MGMT 6 TCP 1024 - 9997 Required for the
Forwarders on the indexer 65535 reporting service.
Communication is
single directional from
forwarders to the
indexer. For example, a
forwarder detects
events and forwards
them to the indexer.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 455

Managing Appliance Operations

SRC DST
Service SRC IP DST IP Proto Notes
Port Port
Threat VIP on HA Grid N/A  HTTPS N/A 443 For threat protection
Protection Master or (using FQDN = rule updates.
MGMT on single https://ts.infoblox.com)
appliance (with
threat
protection
service
running)
Reporting MGMT (with Access HTTPS N/A 443 Required to access
and Threat threat www.threatstop.com www.threatstop.com to
Protection protection (64.87.26.148) display threat details
service when generating
running) reports and to export
searches.

Modifying Ethernet Port Settings

By default, the NIOS appliance automatically negotiates the optimal connection speed and transmission type (full or
half duplex) on the physical links between the 10/100Base-T and 10/100/1000Base-T ports on the NIOS appliance
and the Ethernet ports on a connecting switch. It is usually unnecessary to change the default auto-negotiation
setting; however, you can manually configure connection settings for a port if necessary.
Occasionally, for example, even though both the NIOS appliance and the connecting switch support 1000-Mbps
(megabits per second) full-duplex connections, they might fail to auto-negotiate that speed and type, and instead
connect at lower speeds of either 100 or 10 Mbps using potentially mismatched full- and half-duplex transmissions.
If this occurs, first determine if there is a firmware upgrade available for the switch. If so, apply the firmware upgrade
and test the connection. If that does not resolve the issue, manually set the ports on the NIOS appliance and on the
switch to make 1000-Mbps full-duplex connections.
To change Ethernet port settings:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.

Note: You must enable the MGMT port before modifying its port settings. See Using the MGMT Port on page 461.

2. In the Network tab of the Grid Member Properties editor, the Required Ports and Addresses table lists the network
settings that were configured. This table lists the network settings of LAN1(IPv4) interface for an IPv4 member
and LAN1(IPv6) interface for an IPv6 member. For a dual mode Grid member, this table lists the settings for both
LAN1(IPv4) and LAN1(IPv6) interfaces. Complete the following to modify port settings:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Click the field and modify the IP address for the LAN1 port, which must be in a different subnet
from that of the LAN2 and HA ports.
— Subnet Mask (IPv4) or Prefix Length (IPv6): For IPv4 address, click the field and specify an appropriate
subnet mask and for IPv6 address, specify the prefix length.
— Gateway: Click the field and modify the default gateway for the LAN1 port.
— VLAN Tag: Click the field and enter the VLAN tag ID if the port is configured for VLANs. You can enter a
number from 1 to 4095. For information about VLAN, see About Virtual LANs on page 444.

456 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using the LAN2 Port

— Port Settings: From the drop-down list, choose the connection speed that you want the port to use. You can
also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or Half for data
transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to negotiate the
optimum port connection type (full or half duplex) and speed with the connecting switch automatically. This
is the default setting. You cannot configure port settings for vNIOS appliances.
— DSCP Value: Displays the Grid DSCP value. To modify, click Override and enter the DSCP value. You can
enter a value from 0 to 63. For information about DSCP, see Implementing Quality of Service Using DSCP on
page 447.
3. Save the configuration and click Restart if it appears at the top of the screen.

Note: The port settings on the connecting switch must be identical to those you set on the NIOS appliance.

Using the LAN2 Port

Note: This feature is not supported on vNIOS Grid members for Riverbed.

The LAN2 port is a 10/100/1000Base-T Ethernet connector on the front panel of the TE-810, TE-820, TE-1410,
TE-1420, TE-2210, TE-2220, and IB-4010 appliances. By default, the LAN2 port is disabled and the appliance uses
the LAN1 port (and HA port when deployed in an HA pair). Before you can enable and configure the LAN2 port on a
Grid member, you must first configure the member and join it to the Grid. You must also have read/write permission
to the Grid member on which you want to enable the port. When you enable the LAN2 port and SNMP, the appliance
sends traps from this port for LAN2 related events.
You can configure the LAN2 port in different ways. You can enable the port redundancy or port failover feature, which
groups the LAN1 and LAN2 ports into one logical interface. The LAN1/LAN2 grouping can be activated for both IPv4
and IPv6. Alternatively, you can configure the LAN2 port on a different IP network than LAN1, and enable the LAN2
port to provide DNS and DHCP services. For information about these features, see the following sections:
• For information about the LAN2 failover feature, see About Port Redundancy on page 457.
• For information about configuring the LAN2 port, see Configuring the LAN2 Port on page 459.
• For information about enabling the LAN2 port to provide DHCP services, see Enabling DHCP on LAN2 on page
459.
• For information about enabling the LAN2 port to provide DNS services, see Enabling DNS on LAN2 on page 460.
Note that you cannot use the LAN2 port to access the GUI and the API, or to connect to the Grid. This can impact the
ability of other appliances, such as the Network Automation and PortIQ appliances, to communicate with the Grid
Master.
Any IPv6 services enabled for the LAN2 port also require provisioning of an IP address on the LAN2 port.

About Port Redundancy

You can configure the LAN2 or LAN2 (VLAN) port to provide redundancy and additional fault tolerance in your network.
Port redundancy is transparently supported for both IPv4 and IPv6. When you enable port redundancy, the LAN1 or
LAN1 (VLAN) and LAN2 or LAN2 (VLAN) ports are grouped into one logical interface. They share one IP address and
appear as one interface to the network. Then, if a link to one of the ports fails or is disabled, the appliance fails over
to the other port, avoiding a service disruption.
You can connect the LAN1 or LAN1 (VLAN) and LAN2 or LAN2 (VLAN) ports to the same switch or to different switches,
but they must be on the same VLAN. One port is active and the other port is idle at all times. In case of failure in the
LAN1 or LAN1 (VLAN) port, the LAN2 or LAN2 (VLAN) port becomes active and once the LAN1 or LAN1 (VLAN) port is
active again, the LAN2 or LAN2 (VLAN) port becomes passive.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 457

Managing Appliance Operations

Note: When configuring port redundancy, the speed of the interfaces is not taken into consideration when selecting
the active interface.

The LAN1 or LAN1 (VLAN) and LAN2 or LAN2 (VLAN) ports share the IP address of the LAN1 or LAN1 (VLAN) port; the
port that is currently active owns the IP address. When you enable services on the appliance, such as DNS and DHCP,
clients send their service requests to the LAN1 or LAN1 (VLAN) port IP address and receive replies from it as well. The
port supports the services and features supported on the LAN1 or LAN1 (VLAN) port as listed in Table 8.4 and
Table 8.5. You cannot enable the port redundancy feature if the LAN2 or LAN2 (VLAN) port is serving DNS or DHCP.
For example, you can use the MGMT port for Grid communications, as shown in Figure 8.6, and the LAN1 and LAN2
ports are connected to the same switch. The LAN1 and LAN2 port share the IP address of the LAN1 port, which is
1.1.1.5. In the illustration, LAN1 is the active port.
You can also have the MGMT port disabled and configure LAN1 and LAN2 for port redundancy. You can enable port
redundancy on single or HA independent appliances and Grid members.

Figure 8.6 Using the LAN2 Failover Feature

Grid Master

LAN1
10.1.1.5

Private Network
10.1.1.0/24
for Grid Communications
and Appliance Management
The LAN1 and LAN2 ports share the LAN1
IP address. Only 1 port is active at anytime.
MGMT
10.1.1.20 Failover may be active for either IPv4 or IPv6
addresses.

LAN1
LAN1
1.1.1.5
LAN2

Public Network
1.1.1.0/24
Clients send service requests DNS and DHCP Services
and replies to the LAN1 IP
address.

Before you enable port redundancy, ensure that both LAN1 and LAN2 are enabled. To enable port redundancy:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.
2. In the Network -> Basic tab of the Grid Member Properties editor, select the Enable port redundancy on LAN/LAN2
check box.
3. Save the configuration and click Restart if it appears at the top of the screen.
The Detailed Status panel displays the status of both the LAN1 and LAN2 ports. In an HA pair, both nodes
display the port information when port redundancy is enabled.

458 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using the LAN2 Port

Configuring the LAN2 Port

Before you enable the LAN2 port to provide DHCP and DNS services, you must specify its IP address and other
properties. You can configure both IPv4 and IPv6 addresses for the LAN2 port of an IPv4, IPv6 and dual mode (IPv4
and IPv6) Grid member.
To configure the LAN2 port:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.
2. In the Network -> Basic tab of the Grid Member Properties editor, click the Add icon of the Additional Ports and
Addresses table and select LAN2(IPv4) or LAN2(IPv6) from the drop-down list. Enter the following:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Type the IP address for the LAN2 port, which must be in a different subnet from that of the LAN1
and HA ports.
— Subnet Mask (IPv4) or Prefix Length (IPv6): Specify an appropriate subnet mask for IPv4 address and prefix
length for IPv6 address.
— Gateway: Type the default gateway for the LAN2 port.
— VLAN Tag: Enter the VLAN tag ID if the port is configured for VLANs. You can enter a number from 1 to 4095.
For information about VLAN, see About Virtual LANs on page 444.
— Port Settings: From the drop-down list, choose the connection speed that you want the port to use. You can
also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or Half for data
transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to negotiate the
optimum port connection type (full or half duplex) and speed with the connecting switch automatically. This
is the default setting. You cannot configure port settings for vNIOS appliances.
— DSCP Value: Displays the Grid DSCP value. To modify, click Override and then enter the DSCP value. You can
enter a value from 0 to 63. For information about DSCP, see Implementing Quality of Service Using DSCP on
page 447.
— LAN2 Virtual Router ID (if HA): If the appliance is in an HA pair, enter a VRID number.
3. Save the configuration and click Restart if it appears at the top of the screen.
The Detailed Status panel displays the status of the LAN2 port. In an HA pair, only the active node displays the
LAN2 information.

Enabling DHCP on LAN2

You can configure an appliance to provide DHCP service through the LAN1 port, LAN2 port, or both the LAN1 and LAN2
ports. Note that when you enable both ports, they must be connected to different subnets. You can also start and
stop DHCP service for IPv4 or IPv6 on the LAN1 or LAN2 port after you have enabled the service.
After you configure the LAN2 port, you can enable DHCP services on the LAN2 port as follows:
1. From the Data Management tab, select the DHCP tab -> Members tab -> Grid_member check box, and then click
the Edit icon.
2. If you are running DHCP for IPv4: In the General -> Basic tab of the Member DHCP Configuration editor, select the
IPv4 check box for LAN2 under DHCP Interfaces.
If you are running DHCP for IPv6: In the General -> Basic tab of the Member DHCP Configuration editor, select the
IPv6 check box for LAN2 under DHCP Interfaces. (An IPv6 address must also be provisioned for the port.)
You can run either or both protocols for DHCP depending on your network deployment.
3. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 459

Managing Appliance Operations

Enabling DNS on LAN2

If you enable DNS on an appliance, it always serves DNS on the LAN1 port. Optionally, you can configure the
appliance to provide DNS services through the LAN2 port as well. For example, the appliance can provide DNS
services through the LAN1 port for internal clients on a private network, and DNS services through the LAN2 port for
external clients on a public network.
After you configure the LAN2 port, you can enable DNS services on the LAN2 port as follows:
1. From the Data Management tab, select the DNS tab -> Members tab -> Grid_member check box, and then click the
Edit icon.
2. In the General -> Basic tab of the Member DNS Configuration editor, do the following:
If you are running DNS for IPv4: In the General -> Basic tab of the Member DHCP Configuration editor, select the
IPv4 check box for LAN2 under DNS Interfaces.
If you are running DNS for IPv6: In the General -> Basic tab of the Member DHCP Configuration editor, select the
IPv6 check box for LAN2 under DNS Interfaces. (An IPv6 address must also be provisioned for the port.)
You can run either or both protocols for DNS depending on your network deployment.
— Automatically create glue A and PTR records for LAN2’s address: The NIOS appliance can automatically
generate A (address) and PTR records for a primary name server whose host name belongs to the name
space of the zone. Select this check box to enable the appliance to automatically generate an A and PTR
record.
— Automatically create IPv6 glue AAAA and PTR records for LAN2’s address: automatically generate AAAA and
PTR records for the LAN2 IPv6 address. A glue record is the IP address of a name server held at the domain
name registry. They are needed to set a domain’s name server to a host name within the domain. Example:
to set the name servers of ns1.corp100.com and ns2.corp100.com, provide the glue records, which are in
effect the IP addresses, for ns1.corp100.com and ns2.corp100.com, within specific DNS record types.
Without the glue records, DNS requests never resolve to the correct IP address because the domain registry
does not associate the IP with the correct records.
3. In the General -> Advanced tab (click Toggle Advanced Mode if necessary), select one of the following from the
Send queries from and the Send notify messages and zone transfer request from drop-down lists:
— VIP: The appliance uses the IP address of the HA port as the source for queries, notifies, and zone transfer
requests.
— MGMT: The appliance uses the IP address of the MGMT port as the source for queries, notifies, and zone
transfer requests.
— LAN2: The appliance uses the IP address of the LAN2 port as the source for queries, notifies, and zone
transfer requests.
— Any: The appliance chooses which port to use as the source for queries, notifies, and zone transfer
requests.
The Send queries from drop-down list also includes loopback IP addresses that you configured. You can select a
loopback address as the source for queries.
4. Save the configuration and click Restart if it appears at the top of the screen.
5. Click Restart to restart services.

460 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using the MGMT Port

Using the MGMT Port

Note: This feature is not supported on vNIOS Grid members for Riverbed.

The MGMT (Management) port is a 10/100/1000Base-T Ethernet connector on the front panel of the TE-810, TE-820,
TE-1410, TE-1420, TE-2210, TE-2220, and IB-4010 appliances. It allows you to isolate the following types of traffic
from other types of traffic on the LAN and HA ports:
• Appliance Management on page 462
• Grid Communications on page 463
• DNS Services on page 465
For information about what types of traffic qualify as appliance management, Grid communications, and DNS
services, see Table 8.5 on page 450.

Note: The MGMT port currently does not support DHCP, NAT, or TFTP. IPv6 addressing may be applied to the MGMT
port.

Some NIOS appliance deployment scenarios support more than one concurrent use of the MGMT port. The following
table depicts MGMT port uses for various appliance configurations.

Table 8.6 Supported MGMT Port Uses for Various appliance Configurations

Appliance  Appliance Grid DNS

Configuration Management Communications Services
Single Independent Appliance  Not Applicable 
Independent HA Pair  Not Applicable 
Grid Master   
Grid Master Candidate   
HA Grid Member *  
Single Grid Member *  
* Although you manage all Grid members through the Grid Master, if you enable the MGMT port on common Grid
members, they can send syslog events, SNMP traps, and e-mail notifications, and receive SSH connections on that
port.
Infoblox does not support MGMT port usage for some appliance configurations (indicated by the symbol  in
Table 8.6) because it cannot provide redundancy through the use of a VIP. A Grid Master that is an HA pair needs the
redundancy that a VIP interface on the HA port provides for Grid communications. Similarly, DNS servers in an HA pair
need that redundancy to answer DNS queries. Because the MGMT port does not support a VIP and thus cannot
provide redundancy, Grid Masters (and potential Grid Masters) do not support Grid communications on the MGMT
port.
In addition, NIOS appliances in an HA pair support DNS services on the active node only (indicated by the symbol 
in Table 8.6). Only the active node can respond to queries that it receives. If a DNS client sends a query to the MGMT
port of the node that happens to be the passive node, the query can eventually time out and fail.
The MGMT port is not enabled by default. By default, a NIOS appliance uses the LAN port (and HA port when deployed
in an HA pair). You must log in using a superuser account to enable and configure the MGMT port. You can configure
both IPv4 address and IPv6 address for the MGMT port of a Grid member. You can enable the MGMT port through the
Infoblox GUI, as explained in the following sections.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 461

Managing Appliance Operations

Appliance Management
You can restrict administrative access to a NIOS appliance by connecting the MGMT port to a subnet containing only
management systems. This approach ensures that only appliances on that subnet can access the Infoblox GUI and
receive appliance management communications such as syslog events, SNMP traps, and e-mail notifications from
the appliance.
If you are the only administrator, you can connect your management system directly to the MGMT port. If there are
several administrators, you can define a small subnet—such as 10.1.1.0/29, which provides six host IP addresses
(10.1.1.1–10.1.1.6) plus the network address 10.1.1.0 and the broadcast address 10.1.1.7—and connect to the
NIOS appliance through a dedicated switch (which is not connected to the rest of the network). Figure 8.7 shows how
an independent appliance separates appliance management traffic from network protocol services. Note that the
LAN port is on a different subnet from the MGMT port.

Figure 8.7 Appliance Management from One or More Management Systems

The NIOS appliance serves A single management system connects

DNS and DHCP to the public directly to the MGMT port of the NIOS
network through the LAN port. appliance through an Ethernet cable.

LAN MGMT
Public Network 1.1.1.5 10.1.1.1
1.1.1.0/24 Private Network
DNS and DHCP Services 10.1.1.0/30
Ethernet Appliance Management
Cable
NIOS
appliance-1
DNS and DHCP Clients

LAN
1.1.1.6 MGMT
10.1.1.1
Several management systems connect
to the MGMT port of the NIOS
appliance through a dedicated switch.
Infoblox
Appliance -2
Note: 
Because the two private networks are Private Network
Ethernet
used solely for appliance management 10.1.1.0/29
Cable
and are completely isolated from the rest Appliance Management
of the network—and therefore from each
other—their address space can overlap Dedicated
without causing any routing issues Switch

Management Systems
10.1.1.2 - 10.1.1.5

Similarly, you can restrict management access to a Grid Master to only those appliances connected to the MGMT ports
of the active and passive nodes of the Grid Master.
To enable the MGMT port on an independent appliance or Grid Master for appliance management and then cable the
MGMT port directly to your management system or to a network forwarding appliance such as a switch or router:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.
2. In the Network -> Basic tab of the Grid Member Properties editor, add the MGMT port to the Additional Ports and
Addresses table as follows:

462 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using the MGMT Port

3. Click the Add icon and select MGMT (IPv4) to configure an IPv4 address or select MGMT (IPv6) to configure an
IPv6 address for the MGMT port. You can configure both IPv4 and IPv6 addresses for the MGMT port.
Grid Manager adds a row for the MGMT port. For an HA pair, it adds two rows, one for each node.
4. Enter the following in the row of the MGMT port for a single Grid Master or independent appliance, and in the rows
of the two nodes for an HA Grid Master or independent HA pair:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Type the IP address for the MGMT port, which must be in a different subnet from that of the LAN
and HA ports.
— Subnet Mask (IPv4) or Prefix Length (IPv6): For IPv4 address, specify an appropriate subnet mask for the
number of management systems that you want to access the appliance through the MGMT port. For IPv6
address, specify the prefix length.
— Gateway: Type the default gateway for the MGMT port. If you need to define any static routes for traffic
originating from the MGMT port—such as SNMP traps, syslog events, and email notifications—destined for
remote subnets beyond the immediate subnet, specify the IP address of this gateway in the route.
— Port Settings: Choose the connection speed that you want the port to use. You can also choose the duplex
setting. Choose Full for concurrent bidirectional data transmission or Half for data transmission in one
direction at a time. Select Automatic to instruct the NIOS appliance to negotiate the optimum port
connection type (full or half duplex) and speed with the connecting switch automatically. This is the default
setting. You cannot configure port settings for vNIOS appliances.
— DSCP Value: Displays the Grid DSCP value. To modify, click Override and then enter the DSCP value. You can
enter a value from 0 to 63. For information about DSCP, see Implementing Quality of Service Using DSCP on
page 447.
5. In the Network -> Advanced tab, make sure that the Enable VPN on MGMT Port check box is not selected.
6. Save the configuration and click Restart if it appears at the top of the screen.
7. Log out of Grid Manager.
8. Cable the MGMT port to your management system or to a switch or router to which your management system can
also connect.
9. If your management system is in a subnet from which it cannot reach the MGMT port, move it to a subnet from
which it can.
The Infoblox Grid Manager GUI is now accessible through the MGMT port on the NIOS appliance from your
management system.
10. Open an Internet browser window and enter the IP address of the MGMT port as follows: https://<IP address of
MGMT port>.
11. Log in to Grid Manager.
12. Check the Detailed Status panel of the Grid member to make sure the status icons are green.

Grid Communications
You can isolate all Grid communications to a dedicated subnet as follows:
• For Grid communications from the Grid Master, which can be an HA pair or a single appliance, the master uses
either the VIP interface on the HA port of its active node (HA master) or its LAN port (single master). Neither a
single nor HA Grid Master can use its MGMT port for Grid communications. (This restriction applies equally to
Master Candidates.)
• Common Grid members connect to the Grid Master through their MGMT port.
This ensures that all database synchronization and Grid maintenance operations are inaccessible from other network
elements while the common Grid members provide network protocol services on their LAN ports.
Figure 8.8 shows how Grid members communicate to the master over a dedicated subnet.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 463

Managing Appliance Operations

Figure 8.8 Grid Communications

HA Grid Master Master Candidate

The private network The Grid Master and
(10.1.1.0/24) is reserved for Master Candidate
Grid communications HA HA connect to the private
between the Grid Master network using a VIP
and all Grid members, and on their HA ports.
for appliance management HA HA
between the management
system and the Grid Master. VIP VIP
10.1.1.5 10.1.1.10

Private Network
10.1.1.0/24
for Grid Communications
and appliance Management

Management MGMT
MGMT MGMT
System 10.1.1.21
10.1.1.15 10.1.1.20
10.1.1.30 Active Node
Passive
Node The common Grid
Single Member HA Member
members connect to the
private network through
HA
their MGMT ports*.
HA They connect to the
public network through
their LAN and HA ports
LAN VIP (using a VIP).
1.1.1.6 Public Network 1.1.1.7
1.1.1.0/24
DNS and DHCP Services
The common Grid
members use the public
network (1.1.1.0/24) for
DNS and DHCP services.

DNS and DHCP Clients

* Only the active node of an HA member connects to the Grid Master. The
passive node communicates just with the active node. If there is an HA failover,
the newly promoted active node must first join the Grid before continuing Grid
communications with the Grid Master on behalf of the HA member.

Enabling Grid Communications over the MGMT Port for Existing Grid Members
To enable the MGMT port for Grid communications on an existing single or HA Grid member:
1. Log in to the Grid Master with a superuser account.
2. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.

Note: You must enable the MGMT port before modifying its port settings. See Using the MGMT Port on page 461.

3. In the Network -> Basic tab of the Grid Member Properties editor, add the MGMT port to the Additional Ports and
Addresses table as follows:
4. Click the Add icon and select MGMT (IPv4) to configure an IPv4 address or select MGMT (IPv6) to configure an
IPv6 address for the MGMT port. You can configure both IPv4 address and IPv6 address for the MGMT port.

464 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using the MGMT Port

Grid Manager adds a row for the MGMT port. For an HA pair, it adds two rows, one for each node.
5. Enter the following in the row of the MGMT port for a single Grid Master or independent appliance, and in the rows
of the two nodes for an HA Grid Master or independent HA pair:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Type the IP address for the MGMT port, which must be in a different subnet from that of the LAN
and HA ports.
— Subnet Mask (IPv4) or Prefix Length (IPv6): For IPv4 address, specify an appropriate subnet mask for the
number of management systems that you want to access the appliance through the MGMT port. For IPv6
address, specify the prefix length.
— Gateway: Type the default gateway for the MGMT port. If you need to define any static routes for traffic
originating from the MGMT port—such as SNMP traps, syslog events, and email notifications—destined for
remote subnets beyond the immediate subnet, specify the IP address of this gateway in the route.
— Port Settings: Choose the connection speed that you want the port to use. You can also choose the duplex
setting. Choose Full for concurrent bidirectional data transmission or Half for data transmission in one
direction at a time. Select Automatic to instruct the NIOS appliance to negotiate the optimum port
connection type (full or half duplex) and speed with the connecting switch automatically. This is the default
setting. You cannot configure port settings for vNIOS appliances.
— DSCP Value: Displays the Grid DSCP value. To modify, click Override and enter the DSCP value. You can
enter a value from 0 to 63. For information about DSCP, see Implementing Quality of Service Using DSCP on
page 447.
6. In the Network -> Advanced tab, select the Enable VPN on MGMT Port check box.
7. In the Security tab, do the following:
— Restrict Remote Console and Support Access to MGMT Port: Select this check box to restrict SSH (Secure
Shell) v2 access to the MGMT port only. This restricts Infoblox Technical Support and remote console
connections—both of which use SSH v2—to just the MGMT port. For an HA pair, you can make an SSH v2
connection to the MGMT port on both the active and passive nodes.
Clear the check box to allow SSH v2 access to both the MGMT and LAN ports. For an HA pair, you can make
an SSH v2 connection to the MGMT and LAN ports on both the active and passive nodes.
8. Save the configuration and click Restart if it appears at the top of the screen.
The master communicates the new port settings to the member, which immediately begins using them. The
member stops using its LAN port for Grid communications and begins using the MGMT port.
9. To confirm that the member still has Grid connectivity, check that the status icons for that member are green on
the Detailed Status and Grid panels.

DNS Services
You can configure a single independent appliance or single Grid member to provide DNS services through the MGMT
port in addition to the LAN port. For example, the appliance can provide DNS services through the MGMT port for
internal clients on a private network, and DNS services through the LAN port for external clients on a public network.
While providing DNS services on the MGMT port, you can still use that port simultaneously for appliance
management. Figure 8.9 shows a management system communicating with a single independent appliance through
its MGMT port while the appliance also provides DNS services on that port to a private network. Additionally, the
appliance provides DNS services to an external network through its LAN port.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 465

Managing Appliance Operations

Figure 8.9 DNS Services on the LAN and MGMT Ports, and appliance Management on the MGMT Port

External
Network
External DNS Client External DNS Clients

External DNS services go LAN

through the LAN port. Port
Single 
Independent
Appliance
Appliance management and MGMT
internal DNS services go Port
through the MGMT port.

Management System Internal Internal DNS Clients

Network

Like a single independent appliance, a single Grid member can also support concurrent DNS traffic on its MGMT and
LAN ports. However, because you manage all Grid members through the Grid Master, a Grid member only uses an
enabled MGMT port to send SNMP traps, syslog events, and email notifications, and to receive SSH connections.
In addition, the active node of an HA pair can provide DNS services through its MGMT port. To use this feature, you
must enable DNS services on the MGMT ports of both nodes in the HA pair and specify the MGMT port IP addresses
of both nodes on the DNS client as well, in case there is a failover and the passive node becomes active. Note that
only the active node can respond to queries that it receives. If a DNS client sends a query to the MGMT port of the
node that happens to be the passive node, the query can eventually time out and fail.
To enable DNS services on the MGMT port of an appliance:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.

Note: You must enable the MGMT port before modifying its port settings. See Using the MGMT Port on page 461.

2. In the Network -> Basic tab of the Grid Member Properties editor, add the MGMT port to the Additional Ports and
Addresses table as follows:
3. Click the Add icon and select MGMT (IPv4) to configure an IPv4 address or select MGMT (IPv6) to configure an
IPv6 address for the MGMT port. You can configure both IPv4 and IPv6 address for the MGMT port.
Grid Manager adds a row for the MGMT port. For an HA pair, it adds two rows, one for each node.
4. Enter the following in the row of the MGMT port for a single Grid Master or independent appliance, and in the rows
of the two nodes for an HA Grid Master or independent HA pair:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: Type the IP address for the MGMT port, which must be in a different subnet from that of the LAN
and HA ports.
— Subnet Mask (IPv4) or Prefix Length (IPv6): For IPv4 address, specify an appropriate subnet mask for the
number of management systems that you want to access the appliance through the MGMT port. For IPv6
address, specify the prefix length.

466 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Lights Out Management

— Gateway: Type the default gateway for the MGMT port. If you need to define any static routes for traffic
originating from the MGMT port—such as SNMP traps, syslog events, and email notifications—destined for
remote subnets beyond the immediate subnet, specify the IP address of this gateway in the route.
— Port Settings: Choose the connection speed that you want the port to use. You can also choose the duplex
setting. Choose Full for concurrent bidirectional data transmission or Half for data transmission in one
direction at a time. Select Automatic to instruct the NIOS appliance to negotiate the optimum port
connection type (full or half duplex) and speed with the connecting switch automatically. This is the default
setting. You cannot configure port settings for vNIOS appliances.
— DSCP Value: Displays the Grid DSCP value. To modify, click Override and enter the DSCP value. You can
enter a value from 0 to 63. For information about DSCP, see Implementing Quality of Service Using DSCP on
page 447.
5. Click Save & Close to save your settings for the MGMT port.
6. From the Data Management tab, select the DNS tab -> -> Members tab -> Grid_member check box, and then click
the Edit icon.
7. In the General -> Basic tab of the Member DNS Properties editor, do the following:
— If you are running DNS service for IPv4, select the IPv4 check box for MGMT under DNS Interfaces.
— If you are running DNS service for IPv6, select the IPv6 check box for MGMT under DNS Interfaces.
8. In the General -> Advanced tab, select one of the following from the Send queries from and the Send notify
messages and zone transfer requests from drop-down lists:
— VIP: The appliance uses the IP address of the HA port as the source for queries, notifies, and zone
transfer requests.
— MGMT: The appliance uses the IP address of the MGMT port as the source for queries, notifies, and
zone transfer requests.
— LAN2: The appliance uses the IP address of the LAN2 port as the source for queries, notifies, and zone
transfer requests.
— Any: The appliance chooses which port to use as the source for queries, notifies, and zone transfer
requests.
The Send queries from drop-down list also includes loopback IP addresses that you configured. You can select a
loopback address as the source for queries.
9. Save the configuration and click Restart if it appears at the top of the screen.
To see that the appliance now also serves DNS on the MGMT port:
1. From the Data Management tab, select the DNS tab -> -> Members tab -> Grid_member check box.
2. Expand the Toolbar and click View -> View DNS Configuration.
3. Check that the IP address of the MGMT port appears in the address match list in the listen-on substatement.

About Lights Out Management

Infoblox LOM (Lights Out Management) is an implementation of the remote management and monitoring of Infoblox
appliances that are LOM ready, such as the Trinzic 1410 and 2010 appliances.
The LOM feature is useful when you want to monitor your platforms remotely or consolidate your data centers. When
you monitor your systems remotely, you can avoid issues such as overheating of a problematic system by remotely
powering down the system. To conserve energy, you can also power up and down any systems based on service
requirements.
You can enable LOM for the entire Grid and override the Grid settings for specific members. You can also configure
LOM on independent appliances and HA pairs.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 467

Managing Appliance Operations

Note: You can configure LOM only on appliances that support LOM. This port automatically negotiates a speed of 100
Mbps. Devices connected to the LOM port should be configured to auto-negotiate and not have a fixed speed
of 1000 Mbps.

LOM is disabled by default. Before you can configure LOM and remotely manage the appliance, ensure that the IPMI
(Intelligent Platform Management Interface) port on your appliance is properly connected to the network. By default,
IPMI uses UDP port 623. You can then enable LOM and add LOM users through the Infoblox GUI. When you add LOM
users, you can assign them specific roles so they can perform only certain functions. When you add a LOM user, you
can configure the user to be an “operator” or a “user” depending on the functions you want the user to perform. An
operator can access an appliance remotely and perform the following functions:
• Access the serial console
• Reset the appliance
• Power up and down the appliance
• Monitor system status, such as CPU usage and system temperature
A user role can only monitor system status. Users with this role cannot perform any other functions remotely.
After you set up and configure your appliance, perform the following tasks through Grid Manager to enable LOM and
set up LOM users:
1. Enable LOM for the Grid or members that support IPMI, as described in Enabling LOM on page 468.
2. Add LOM users based on your organizational needs, as described in Adding LOM User Accounts on page 469.
3. Configure the IPMI network interface on the appliance, as described in Configuring the IPMI Network Interface on
page 469.
4. After you have configured LOM and set up the IPMI interface, install a utility such as IPMItool on your Linux
management system. For information about IPMItool, visit the IPMItool web site at
http://ipmitool.sourceforge.net. For the most commonly used commands and examples, see IPMI Commands
and Examples on page 470.
You can also do the following from Grid Manager after you configure LOM:
• Enable and disable LOM for the Grid or members, as described in Enabling LOM on page 468.
• Modify LOM settings, as described in Modifying LOM Settings on page 470.
• View LOM users, as described in Modifying LOM Settings on page 470.

Enabling LOM
Before you can add LOM users and manage Infoblox appliances remotely, you must enable LOM. When LOM is
configured for the entire Grid, all members inherit the Grid settings. You can also override the Grid settings for specific
members. For an HA pair, you can configure LOM on the node that supports IPMI.
To enable and disable LOM:
1. Grid: From the Grid tab, select the Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
Independent appliance: From the System tab, select the System Manager tab, expand the Toolbar and click
System Properties -> Edit.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then
click the Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the LOM tab, complete the following:
— Enable Lights Out Management: LOM is disabled by default. Select this check box to enable LOM. When
LOM is enabled or disabled for the Grid, all members inherit the same setting.
3. Save the configuration.

468 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Lights Out Management

Adding LOM User Accounts

You can add up to eight LOM user accounts. Admins must use the configured user name and password to remotely
log in to the appliance.
Note that when you add LOM user accounts at the Grid level, all members inherit them. You can configure user
accounts specific to a member by overriding the Grid accounts. When you click Override to modify the inherited Grid
accounts, the appliance creates copies of the Grid level user accounts and saves them at the member level. These
are new accounts at the member level and do not affect the Grid accounts or any accounts configured on other Grid
members. You can also reset member accounts to the Grid accounts by clicking Inherit. When you do that however,
all changes you previously made to the member accounts are lost.
To add a LOM user account:
1. Grid: From the Grid tab, select the Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
Independent appliance: From the System tab, select the System Manager tab, expand the Toolbar and click
System Properties -> Edit.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then
click the Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the LOM tab, complete the following:
— User Accounts: Click the Add icon and complete the following:
— Name: Enter the name of the LOM user account.
— Password: Enter the password for the LOM user account.
— Confirm Password: Enter the password again.
— Role: From the drop-down list, select the role for the LOM user account. Operator allows users to
perform all supported LOM related functions. User allows admins to only monitor system sensors such
as temperature and CPU usage.
— Disable: Select this to deactivate the user account but keep a user profile.
— Click Add to add the new user account.
3. Save the configuration.

Configuring the IPMI Network Interface

You must configure the IPMI network interface before you can access the appliance remotely. To configure the IPMI
network interface:
1. Independent appliance: From the System tab, select the System Manager tab, expand the Toolbar and click
System Properties -> Edit.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then
click the Edit icon.
2. In the LOM tab, complete the following in the Network Configuration table:
— Address: Enter the IPMI interface address here.
— Subnet Mask: Enter the subnet mask for the IPMI interface.
— Gateway: Enter the gateway address for the IPMI interface.
3. Save the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 469

Managing Appliance Operations

Modifying LOM Settings

To modify LOM settings:
1. Grid: From the Grid tab, select the Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
Independent appliance: From the System tab, select the System Manager tab, expand the Toolbar and click
System Properties -> Edit.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then
click the Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. Modify the following:
— Enable Lights Out Management: LOM is disabled by default. Select this check box to enable LOM. When you
enable or disable this for the Grid, all members inherit the same setting.
— Network Configuration: Click the fields in the table to modify the IPv4 address, subnet mask, and gateway
address for the IPMI interface. For an HA pair, the appliance displays information only for the nodes that
support IPMI. Enter the information for the following fields: Address, Subnet Mask, and Gateway. The Node
and LAN Address fields are read-only, and you cannot modify them. The LAN address is the IPMI interface
address.
— User Accounts: Click the Add icon to add new LOM users. You can also select an existing LOM user and click
the Edit icon to modify the user settings, as described in Adding LOM User Accounts.
3. Save the configuration.

Viewing LOM Users

To view information about LOM users:
1. Grid: From the Grid tab, select the Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
Independent appliance: From the System tab, select the System Manager tab, expand the Toolbar and click
System Properties -> Edit.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then
click the Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the LOM tab, Grid Manager displays the following information for each LOM user:
— Name: The name of the LOM user.
— Role: The user role to which the LOM user was assigned. This can be Operator or User.
— Disabled: Indicates whether the LOM user account is disabled or not. When a LOM user account is disabled,
the user cannot access the appliance remotely.

IPMI Commands and Examples

This section describes some of the most commonly used IPMITool commands and examples. For more information
about the IPMI commands and usage, visit the IPMItool web site at http://ipmitool.sourceforge.net.
To use IPMI commands, complete the following:
1. Ensure that you have properly enabled and configured LOM and the IPMI network interface.
2. Install IPMITool on a Linux management system. For information, visit the IPMItool web site at
http://ipmitool.sourceforge.net.
3. Access IMPITool and enter an IPMI command to perform a specific task.
The appliance displays the corresponding output.
Following are some of the most commonly used IPMI commands and their sample outputs. Note that command
outputs vary by appliances. The following sample commands were performed on a Trinzic 1410 appliance. All
sample commands in this section use the following syntax:

470 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Lights Out Management

ipmitool -H <LOMIPAddress> -U username -P password -L [OPERATOR/USER] -I lanplus

<supported commands>

Command to be Used with Caution

power reset variant

Caution: Using this command has the same effect as pulling the power cord off the appliance.

Checking Power Status with User Role

Command:
ipmitool -H 10.37.2.70 -U user -P infoblox -L USER -I lanplus power status
Command output:
Chassis Power is on

Checking Various Sensors [Temperature, Voltage, FANS, Physical Security, Power supply, OEM]
with User Role
Command:
ipmitool -H 10.37.2.70 -U user -P infoblox -L USER -I lanplus sensor
Command output:
System Temp | 23.000 | degrees C | ok | -9.000 | -7.000 | -5.000 | 75.000 | 77.000 |
79.000
CPU Temp | 0x0 | discrete | 0x0000| na | na | na | na | na | na
FAN 1 | 10390.000 | RPM | ok | 215.000 | 400.000 | 585.000 | 29260.000 | 29815.000 |
30370.000
FAN 2 | na | RPM | na | na | na | na | na | na | na
FAN 3 | 9835.000 | RPM | ok | 215.000 | 400.000 | 585.000 | 29260.000 | 29815.000 |
30370.000
FAN 4 | 11870.000 | RPM | ok | 215.000 | 400.000 | 585.000 | 29260.000 | 29815.000 |
30370.000
FAN 5 | 10390.000 | RPM | ok | 215.000 | 400.000 | 585.000 | 29260.000 | 29815.000 |
30370.000
CPU Vcore | 0.832 | Volts | ok | 0.640 | 0.664 | 0.688 | 1.344 | 1.408 | 1.472
+3.3VCC | 3.264 | Volts | ok | 2.816 | 2.880 | 2.944 | 3.584 | 3.648 | 3.712
+12 V | 11.978 | Volts | ok | 10.494 | 10.600 | 10.706 | 13.091 | 13.197 | 13.303
CPU DIMM | 1.528 | Volts | ok | 1.152 | 1.216 | 1.280 | 1.760 | 1.776 | 1.792
+5 V | 5.088 | Volts | ok | 4.096 | 4.320 | 4.576 | 5.344 | 5.600 | 5.632
-12 V | -12.486 | Volts | ok | -13.844 | -13.650 | -13.456 | -10.934 | -10.740 | -10.546
VBAT | 3.120 | Volts | ok | 2.816 | 2.880 | 2.944 | 3.584 | 3.648 | 3.712
+3.3VSB | 3.264 | Volts | ok | 2.816 | 2.880 | 2.944 | 3.584 | 3.648 | 3.712
AVCC | 3.264 | Volts | ok | 2.816 | 2.880 | 2.944 | 3.584 | 3.648 | 3.712
Chassis Intru | 0x0 | discrete | 0x0000| na | na | na | na | na | na
PS Status | 0x1 | discrete | 0x01ff| na | na | na | na | na | na

Printing System Event Log with User Role

Command:
ipmitool -H 10.37.2.70 -U user -P infoblox -L USER -I lanplus sel list
Command output: The appliance displays all event log entries (if any)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 471

Managing Appliance Operations

Getting FRU Information with User Role

Command:
ipmitool -H 10.37.2.70 -U user -P infoblox -L USER -I lanplus fru
Command output:
FRU Device Description : Builtin FRU Device (ID 0)
Board Mfg Date : Sun Dec 31 15:00:00 1995
Board Mfg : Supermicro
Board Serial :
Product Serial :

Powering Off the Appliance with Operator Role

Command:
ipmitool -H 10.37.2.70 -U operator -P infoblox -L OPERATOR -I lanplus power off
Command output:
Chassis Power Control: Down/Off

Powering On the Appliance with Operator Role

Command:
ipmitool -H 10.37.2.70 -U operator -P infoblox -L OPERATOR -I lanplus power on
Command output:
Chassis Power Control: Up/On

Activating the Serial Console Port using Operator role

Command:
ipmitool -H 10.37.2.70 -U operator -P infoblox -L OPERATOR -I lanplus sol activate
Command output:
[SOL Session operational. Use ~? for help]
login: admin
password:
Infoblox NIOS Release 6.4.0-163715 (64bit)
Copyright (c) 1999-2012 Infoblox Inc. All Rights Reserved.
type 'help' for more information
Infoblox >

Setting Static Routes

When you put the NIOS appliance on a segment of the network where there is a single path to and from it, a single
default route is sufficient. For example, in Figure 8.10 on page 473, the appliance is in the DMZ behind a firewall and
connects to the rest of the network through the DMZ interface on the firewall. For example, when hosts send DNS
queries from the Internet and the internal network to the appliance and when the appliance replies to those hosts,
the firewall takes care of all the routing.

Note: This feature is not supported on vNIOS Grid members for Riverbed.

472 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Setting Static Routes

Figure 8.10 Single Default Route

Internet
The default route points all traffic from the LAN or LAN1
1.2.2.1 port on the NIOS appliance to the DMZ interface
(1.2.2.1) on the firewall.

DMZ

Default route:
LAN Network: 0.0.0.0
Port Netmask: 0.0.0.0
Gateway: 1.2.2.1

Firewall NIOS appliance

The appliance responds to all queries from the

Internet and internal network by sending its
responses to the DMZ interface (1.2.2.1) on 
the firewall.
Internal Network
The appliance only needs a single default route 
to the firewall. The firewall then routes the 
traffic where it needs to go.

When the NIOS appliance is on a segment of the network where there are multiple gateways through which traffic to
and from the appliance can flow, a single default route is insufficient. For an example, see Figure 8.11.

Figure 8.11 Erroneously Routed DNS Replies

Internet

Firewall-1 1.2.2.1 The default route points all traffic from the NIOS
appliance to the DMZ interface (1.2.2.1) on
firewall-1.

DMZ
NIOS appliance
Default route:
Network: 0.0.0.0
Switch Netmask: 0.0.0.0
Gateway: 1.2.2.1

1.2.2.2
Firewall-2 DNS queries from the Internet reach the
appliance through firewall-1, and the
appliance sends its replies back through
firewall-1.
DNS queries from the internal network reach
Internal Network the appliance through firewall-2, but because
10.1.1.0/24 there is only one default route, the appliance
erroneously sends DNS replies to the DMZ
interface (1.2.2.1) on firewall-1.

To resolve the problem illustrated in Figure 8.11 on page 473, add a second route pointing traffic destined for
10.1.1.0/24 to use the gateway with IP address 1.2.2.2 on firewall-2. This is shown in Figure 8.12.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 473

Managing Appliance Operations

Figure 8.12 Properly Routed DNS Replies

Internet

The default route on the NIOS appliance

points traffic destined for the Internet to the
1.2.2.1 DMZ interface (1.2.2.1) on firewall-1.
Firewall-1

DMZ
1.2.2.0/24 Default route:
NIOS appliance Network: 0.0.0.0
Netmask: 0.0.0.0
Gateway: 1.2.2.1
Switch
Route to:
Network: 10.1.1.0
Netmask: 255.255.255.0
1.2.2.2
Gateway: 1.2.2.2
Firewall-2

A second route on the appliance points

traffic destined for 10.1.1.0/24 to the DMZ
Internal Network interface (1.2.2.2) on firewall-2.
10.1.1.0/24

Whenever you want the NIOS appliance to send traffic through a gateway other than the default gateway, you need
to define a separate route. Then, when the appliance performs a route lookup, it chooses the route that most
completely matches the destination IP address in the packet header.
When you enable the MGMT port, the gateway you reference in a static route determines which port the NIOS
appliance uses when directing traffic to a specified destination.
• If a route definition references a gateway that is in the same subnet as the IP and VIP addresses of the LAN (or
LAN1) and HA ports, the NIOS appliance uses the LAN (or LAN1) or HA port when directing traffic to that
gateway.
• If a route definition references a gateway that is in the same subnet as the MGMT port, the NIOS appliance uses
the MGMT port when directing traffic to that gateway.

474 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Setting Static Routes

Figure 8.13 Static Routes for the LAN and MGMT Ports

Internet

LAN Gateway
(Firewall-1) LAN Port MGMT Port 10.1.2.1 10.1.3.1 Administrators
1.2.2.1 1.2.2.5 10.1.2.5
NIOS MGMT
DMZ appliance Gateway Subnet
1.2.2.0/24 Subnet 10.1.3.0/24
10.1.2.0/24
Switch
Switch
1.2.2.2
LAN Gateway
(Firewall-2) 10.1.1.1 Two static routes direct traffic from the NIOS appliance:
• From the LAN port (eth1, 1.2.2.5) through the gateway at 1.2.2.2
to the 10.1.1.0/24 subnet.
From the MGMT port (eth0, 10.1.2.5) through the gateway at
Internal Network 10.1.2.1 to the 10.1.3.0/24 subnet.
10.1.1.0/24

Route Tables on the NIOS appliance

From LAN: Note: There is a route table for each port

1.2.2.0/24 dev eth1 scope link as well as a comprehensive route table.
10.1.1.0/24 via 1.2.2.2 dev eth1 For an HA pair, the LAN port route table
default via 1.2.2.1 dev eth1 is duplicated for the HA port.
From MGMT: In this illustration, the static routes are
10.1.2.0/24 dev eth0 scope link shown in green.
10.1.3.0/24 via 10.1.2.1 dev eth0
default via 10.1.2.1 dev eth0
From all:
10.1.1.0/24 via 1.2.2.2 dev eth1
10.1.3.0/24 via 10.1.2.1 dev eth0
1.2.2.0/24 dev eth1 proto kernel scope link src 1.2.2.5
10.1.2.0/24 dev eth0 proto kernel scope link src 10.1.2.5
default via 1.2.2.1 dev eth1

The need for routes can apply to any type of traffic that originates from the appliance, such as DNS replies, DHCP
messages, SNMP traps, ICMP echo replies, Infoblox GUI management, and Grid communications.
To set a static route, do the following:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.
2. In the Network -> Advanced tab of the Grid Member Properties editor, click the Add icon for the IPv4 Static Routes
table, and then enter the following:
— Network Address: Type the address and netmask of the remote network to which the NIOS appliance routes
traffic.
— Gateway Address: Type the IP address of the gateway on the local subnet through which the NIOS appliance
directs traffic to reach the remote network. The gateway address must meet the following requirements:
— It must belong to a working gateway router or gateway switch.
— It must be in the same subnet as the NIOS appliance.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 475

Managing Appliance Operations

Note: Consult your network administrator before specifying the gateway address for a static route on the
appliance. Specifying an invalid gateway address can cause problems, such as packets being dropped or
sent to an incorrect address.

3. Save the configuration and click Restart if it appears at the top of the screen.

Defining IPv6 Static Routes

Principles and applications related to IPv4 static routing in this section apply equally to IPv6. In Figure 8.14, a NIOS
appliance supports both IPv4 and IPv6 on its LAN1 port. IPv6 is routed to the internal network while the default IPv4
route remains to the outbound 10.2.2.1 address.
You can use prefix notation to enter an IPv6 network address; the full 128-bit gateway value must be entered. To set
an IPv6 static route, do the following:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.
2. In the Network -> Advanced tab of the Grid Member Properties editor, click the Add icon for the IPv6 Static Routes
table, and then enter the following:
— Network Address: Type the prefix and prefix length of the remote network to which the NIOS appliance
routes traffic. As an example: 2001:DB8::256:/64. The double colon is required at the end of the prefix.
NIOS performs validity checks on the address while it is being entered.
— Gateway Address: Type the IP address of the gateway on the local subnet through which the NIOS appliance
directs traffic to reach the remote network. As an example: 2001:DB8::256:ABCD:EF12:1234:1. The
gateway address must meet the following requirements:
— It must belong to a working gateway router or gateway switch.
— It must be in the same subnet as one of the interfaces of the NIOS appliance.
— The gateway address cannot be the same value as that for the VIP.

Note: Consult your network administrator before specifying the gateway address for a static route on the
appliance. Specifying an invalid gateway address can cause problems, such as packets being dropped or
sent to an incorrect address.

3. Save the configuration and click Restart if it appears at the top of the screen.

476 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Enabling DNS Resolution

Figure 8.14 Static Routes for IPv6 Traffic

Internet

The default route on the NIOS

appliance points traffic destined
Firewall-1 10.2.2.1/24 for the Internet to the DMZ
interface (10.2.2.1) on Firewall-1.
DMZ
10.2.2.0/24 Default route:
NIOS Appliance Network 0.0.0.0
Gateway 0.0.0.0
Gateway 10.2.2.1

Switch Route to:

Network: 2001:DB8:0:256
Netmask: /64
ABCD:EF12:1234:1 Gateway: 2001:DB8::256:ABCD:EF12:1234:1
Firewall-2

A second route on the appliance

points traffic destined for the internal
IPv6 network 2001:DB8:0:256/64,
Internal IPv6 network to the DMZ interface (2001:DB8::256:
2001:DB8:0:256/64 ABCD:EF12:1234:1) on Firewall-2.

IPv6 static route

IPv4 static route

Enabling DNS Resolution

You can specify a network server to perform domain name queries and specify up to two name servers for resolving
a DNS name. You can specify the IP address of a preferred name server and that of an alternate name server, plus use
a search list for performing partial name resolution.
To enable DNS resolution for a Grid or for an independent appliance or HA pair:
1. Grid: From the Grid tab, select the Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then
click the Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the Grid Properties or Member Properties editor, select the DNS Resolver tab, and then enter the following:
— Enable DNS Resolver: Select the check box to enable the NIOS appliance to send DNS queries to the
preferred or alternate name servers whose IP addresses you specify in the following fields.
Click the Add icon and enter the IP addresses (IPv4 or IPv6) of the servers to which the appliance sends
queries. The appliance attempts to send queries to the servers in the order they are listed if it does not
receive a response from a listed name server. To move a server up or down on the list, select it and drag it to
its new location or click the up and down arrows.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 477

Managing Appliance Operations

— Search List: You can define a group of domain names that the NIOS appliance can add to partial queries
that do not specify a domain name. For example, if you define a RADIUS authentication home server as
“as1”, and you list "corp100.com" and "hq.corp100.com" in the domain group list, then the NIOS
appliance sends a query for "as1.corp100.com" and another query for "as1.hq.corp100.com" to the
preferred or alternate name server. To specify domain names containing IDNs, manually convert it into
punycode and specify domain names in punycode.
To add a domain name, click the Add icon and type a domain name in the Search List field. To remove a
domain name from the group, select it, and then click Delete.
3. Save the configuration and click Restart if it appears at the top of the screen.

Managing Licenses
You must install valid licenses for services and features to function properly on your NIOS and vNIOS virtual
appliances.
Licenses are classified by types, as described in License Types. You can choose to obtain licenses for the desired
features and services and install them as static or dynamic licenses depending on your network and business
requirements.
Static licenses are mapped to the hardware ID for each individual NIOS or vNIOS appliance. For more information
about how to obtain and install static licenses, see Managing Static Licenses on page 478.
In an environment, such as a CMP (Cloud Management Platform), where you need to spin up multiple remote vNIOS
appliances at different times based on business requirements, you can consider installing dynamic licenses.
Dynamic licenses are mapped to the Grid Master and stored in a license pool. For more information about dynamic
licenses and how to use them to pre-provision vNIOS appliances, see Managing Dynamic Licenses on page 481 and
About Elastic Scaling on page 486.

License Types
There are three types of licenses. You can obtain these licenses from your Infoblox representative.
• Maintenance licenses – NIOS and Enterprise (formerly Grid) are maintenance licenses. The duration of
maintenance licenses are one, two, or three years.
• Service licenses – These are permanent licenses for NIOS services such as DNS, DHCP, and Cloud Network
Automation. Note that some of these services are disabled by default. Once you have obtained licenses for
these services, follow the instructions provided in this guide to start the services after you have completed the
configuration.
• Temporary licenses – You can enable one of several sets of temporary service licenses through the CLI
command set temp_license . Temporary licenses provide licensed features and functionality for the interim,
while you wait for your permanent licenses to arrive.
Before a maintenance license or a temporary license expires, an expiration warning appears during the GUI login
process. The warning reappears during each login until you renew the license. To renew a license, contact Infoblox
Technical Support.

Managing Static Licenses

Static licenses are individual licenses that are tied to specific hardware IDs, and they cannot be transferred among
appliances. Static licenses come pre-installed on physical NIOS appliances according to the software packages you
order at the time of purchase. You can also obtain static licenses for your vNIOS virtual appliances. For information
about how to obtain static licenses, see Obtaining Static Licenses on page 479. For information about how to add
static licenses, see Adding Permanent Licenses on page 482.
After you install static licenses on the Grid, you can view their status in Grid Manager, as described in Viewing
Licenses on page 483.

478 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Licenses

Obtaining Static Licenses

When you receive a new license key for a static license, it is in CSV (comma separated values) format with the
following information: serial number, hardware ID, license type, end date, and license string.
For a static license, you can either upload the license file to the appliance or copy the information and paste it in the
text field of the Licenses tab -> Active tab of the Infoblox GUI. You must copy the entire string—serial number, hardware
ID, license type, end date, and license string—and save it to the text field. For more information, see Adding
Permanent Licenses on page 482.
To obtain permanent static licenses from Infoblox:
1. After you have set up or pre-provisioned a physical appliance or vNIOS virtual appliance, either log in to the NIOS
CLI or open a terminal session for the VM and open the NIOS command line.
2. Run the command show hwid. Following is an example:
nios-vm-ib-1420-gm > show hwid
Hardware ID: 564d41e13a1cc55affb9bad4e3b5c48a
Copy and paste the Hardware ID value for convenience.
You can also run a show license command to obtain the same information:
nios-vm-ib-1420-gm > show license
Version : 6.11.0-248090
Hardware ID : 564d41e13a1cc55affb9bad4e3b5c48a

Note: Make a note of the hardware IDs that you obtain during this procedure. Each of these unique Hardware ID
values can be associated with a Registration Number from your Contract Notification email. If a license key
is installed for the current VM, that key value also appears in the output for the show license command.

3. Go to https://support.infoblox.com/app/licenses (you have to log in with your support account) and click the
Licenses menu. On the Licenses page, open Submit a license key registration form.
4. Enter or copy and paste the serial number and hardware ID value for a physical appliance. For a vNIOS appliance,
use the hardware ID for both the Serial Number and Hardware ID fields—they are synonymous.
5. Under the Service and Maintenance categories, select the check boxes for all options for which you have
purchased service licenses and/or maintenance licenses.
6. Enter any Comments if needed.
7. Click Submit to submit the request for your license keys.
Repeat this procedure for all NIOS and vNIOS appliances in your contract.
Infoblox Technical Support normally processes license key requests on the same day they are received; however,
allow 24-48 hours for processing. When you receive the license keys, install the licenses as described in Adding
Permanent Licenses on page 482.

Note: Each VM Registration Number should have a Hardware ID associated with it. As you install and spin up each
virtual machine, establish written records for each Hardware ID with the VM Registration Numbers in a
one-to-one ratio. These value pairs are necessary should you need to contact Infoblox Technical Support.

Obtaining License Keys for Existing Appliances

If you are unsure of the license entitlements for one or more of your NOIS and vNIOS appliances, or want to obtain a
new listing of your license keys for any reason, do the following:
1. Go to https://support.infoblox.com/app/licenses (you have to log in with your support account) and click the
Licenses menu. On the Licenses page, open Download License Key(s) for one appliance.
This feature recognizes that any vNIOS appliance is likely to have multiple feature licenses, all of which are tied
to a specific Hardware ID.
2. Enter the Hardware ID number in the Enter one number: field. Following is an example:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 479

Managing Appliance Operations

Note that serial numbers and Hardware IDs are the same value.
3. Select how your license key will be provided:
• Display to Screen
• Send File
• .CSV
The Display to Screen and Send File options allow for direct copying and pasting. Using a .CSV file enables you
to use the convenient Upload License File feature for your appliance in NIOS. For more information, see Adding
Permanent Licenses on page 482.
4. After making your selection, click Generate Keys at the bottom of the panel. Following is an example:

5. After you receive your key values, you can save them for your records. To install a specific license or licenses, see
Adding Permanent Licenses on page 482.

Downloading License Keys for Multiple Appliances

The Infoblox Technical Support site provides a method for downloading the license keys for multiple VM instances,
based on the purchased feature licenses for your products.
1. Obtain the Hardware ID values. Do this in the order shown from top to bottom of your Contract Notification email.
As an alternative, you may use the VM Registration Numbers in your Contract Notification email, also separated
by commas.
2. Go to https://support.infoblox.com/app/licenses (you have to log in with your support account) and click the
Licenses menu. On the Licenses page, open Download License Key(s) for multiple appliances.

480 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Licenses

3. Enter (or copy and paste) each of the Hardware ID values or VM Registration Numbers into the entry field, each
in its own row, with a comma at the end of the value. Do not press Return between each value. An example, using
VM Registration Numbers:

4. Click Generate Keys at the bottom of the panel (you may need to scroll down to see it).
The list of keys may be quite substantial. The list shows the license entitlements and registration keys for all
vNIOS VMs that are purchased and listed with Infoblox Technical Support.
5. After you receive your key values, you can save them for your records. To install a specific license or licenses, see
Adding Permanent Licenses on page 482.

Managing Dynamic Licenses

Dynamic licenses are multiple licenses you obtain for vNIOS virtual appliances—you cannot use dynamic licenses for
physical appliances. You can install dynamic licenses in advance for different services and features and deploy them
on-demand based on your business needs. The appliance stores these licenses in their respective license pools and
allocate them when you deploy vNIOS virtual appliances. When you remove a vNIOS appliance from your Grid, the
applicable licenses are automatically released back to the license pool. The appliance adjusts the total number of
licenses accordingly. You can use dynamic licenses to automatically pre-provision and deploy vNIOS appliances. For
more information about this feature, see About Elastic Scaling on page 486.

Note: You must install both the Enterprise (formerly Grid) and vNIOS licenses on a vNIOS appliance for it to join the
Grid. You can add other licenses such as DNS, DHCP, or Cloud Platform depending on how you deploy your
vNIOS virtual appliances.

Obtaining Dynamic Licenses

When you purchase licenses for specific features and services, you may deploy the licenses as dynamic licenses.
License information is stored in a license file with the following information for each license: LSN-P (License Serial
Number - Proxy), LK-P (License Key Proxy, LSN (License Serial Number) and LK (License Key). License keys are
generated based on the LPC_UID (License Pool Container Unique ID) of the Grid Master. You must first obtain the
LPC_UID from the Grid Master and then contact Infoblox Technical Support to obtain dynamic licenses.
Infoblox stores information related to dynamic licenses in a license file. When you install dynamic licenses, you must
upload the entire license file to the Grid Master, as described in Adding Permanent Licenses on page 482.
To obtain dynamic licenses:
1. Log in to Grid Manager and obtain the LPC_ID from the Grid Master, as follows:
a. From the Grid tab, select the Licenses tab -> Pool tab, and then click Export All Licenses from the Toolbar.
b. Save the CSV file.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 481

Managing Appliance Operations

c. Open the CSV file. The LPC_UID is displayed in the SIGNATURE row. Copy this ID. You will need this ID when
contacting Infoblox Technical Support.

Note: You can also use the show license_pool_container CLI command to display the LPC_UID.

2. Contact Infoblox Technical Support or your Infoblox representative to obtain the dynamic licenses.

Manually Allocating Dynamic Licenses

To allocate a particular feature license to a vNIOS member:
1. From the Grid tab, select the Licenses tab -> Pool tab.
2. Select the feature license and click the Action icon (shown as a gear in each row for the table) next to the
license, and then select Allocate from the list.
3. In the Allocate Pool Licenses dialog, click Select Member Node.
4. From the Member Selector, click the FQDN of the vNIOS member on which you want to install the feature license.
The appliance displays the member in the To this member: field.
5. Click Allocate to install this license on the selected member or click Cancel to cancel this action.
NIOS allocates the license and adjusts the numbers in the Assigned and Available fields in the Pool tab.

Manually Deallocating Dynamic Licenses

To deallocate a particular feature license from a vNIOS member:
1. From the Grid tab, select the Licenses tab -> Active tab.
2. Select the license and click the Action icon (shown as a gear in each row for the table) next to the license,
and then select Deallocate from the list.
3. In the Deallocate Pool Licenses dialog, select the license(s) you want to deallocate from the Pool Licenses table.
4. Click Deallocate to remove the license(s) from the member(s) or click Cancel to cancel this action.
NIOS deallocates the license from the respective members and adjusts the numbers in the Assigned and
Available fields in the Pool tab.

Manually Revoking Dynamic Licenses

To remove a particular feature license from the pool:
1. From the Grid tab, select the Licenses tab -> Pool tab.
2. Select the feature license and click the Action icon (shown as a gear in each row for the table) next to the
license, and then select Revoke from the list.
3. In the Remove Licenses dialog, click the Number field and enter the number of licenses you want to remove for
the selected license type.
4. Click Remove Licenses to remove the license(s) or click Cancel to cancel this action.
NIOS removes the license(s) and adjusts the numbers in the Assigned and Available fields in the Pool tab.

Adding Permanent Licenses

To add permanent static or dynamic licenses:
1. From the Grid tab, select the Licenses tab -> Active tab or Pool tab and click the Add icon.
2. Do one of the following:
— Upload License File: You must use this method to upload dynamic licenses to the license pool. Click Select
File and navigate to the license file.

482 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Licenses

— Paste License(s): Paste the license key in this text field. You must paste the entire string in CSV format:
serial number, hardware ID, license type, end date, and license string. If you are pasting multiple licenses,
start each string on a new line.
3. Click Save License(s).
The appliance validates the license and adds it to the table. Close the browser window and log in to the Infoblox
GUI. If you are activating licenses for an HA pair, you must follow this procedure for both nodes.

Note: To transfer licenses between vNIOS on VMware appliances, refer to the Infoblox Installation Guide for vNIOS
Software on VMware.

Adding Temporary Licenses

You can use the CLI command set temp_license to generate and install temporary licenses. This can provide
licensed features and functionality for the interim, while you wait for your permanent license to arrive.
To generate a temporary license:
1. Log in to the NIOS appliance through a remote console window. For more information on how to open a remote
console window, refer to the Infoblox CLI Guide.
2. At the Infoblox command prompt, enter set temp_license. The appliance lists the available licenses, and you
select those you need.
3. Enter the number of the licenses you want to install.
4. Confirm the selection when prompted, and the following message appears:
Temporary license is installed.

Viewing Licenses
If the appliance is part of a Grid, you must log in to the Grid Master to view license information from Grid Manager. If
the appliance is an independent appliance, log in to System Manager on the appliance. If you have transferred
licenses from one vNIOS appliance to another, you can view information about the new and replaced licenses.
Grid Manager displays licenses in the Grid tab -> Licenses tab. You can view license information for all static and
dynamic licenses, including temporary licenses, in the Active tab, and a summary of dynamic licenses in the Pool tab.
For more information, see Viewing Active Licenses.

Viewing Active Licenses

To view information about active licenses, including static and dynamic licenses that are currently assigned or
allocated to NIOS and vNIOS appliances:
1. Log in to Grid Manager on the Grid Master or System Manager on an independent appliance.
2. Select the Grid or System tab -> Licenses tab -> Active tab. The appliance displays the following information:
— Type of License: The license category. This can be Static or Dynamic. Static licenses are individual licenses
you obtain and are currently assigned to specific appliances. These licenses are tied to specific hardware
IDs and you cannot deallocate them. Dynamic licenses are pooled licenses that support the Elastic Scaling
feature, which enables central tracking, granting, and management of NIOS feature licenses for vNIOS
entities in the Grid. You can manually allocate and deallocate dynamic licenses. For information about
Elastic Scaling, see About Elastic Scaling on page 486.
— Feature: Indicates the features for which the license was installed. For example, if the license was installed
for DNS service, this shows DNS.
— Name: The FQDN of the appliance.
— HA: Indicates whether the appliance is an HA pair.
— IPv4 Address: The IPv4 address of the appliance, if applicable.
— IPv6 Address: The IPv6 address of the appliance, if applicable.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 483

Managing Appliance Operations

— Hardware ID: The unique hardware ID of the appliance. The ID is highlighted in red if the license on the
appliance was removed.
— Serial Number: The serial number of the appliance.
— Type Context: Depending on the license type, this field displays the attribute (such as Model) that the
license controls. This field is blank if the license does not control any attribute type. This field can display
one of the following:
— Leases: Indicates that this DHCP license supports a specific number of DHCP leases. The number of
leases supported is displayed in the Type Details field.
— Model: Indicates that this vNIOS license supports a specific vNIOS virtual appliance model. The model
supported is displayed in the Type Details field.
— Tier: Indicates various levels of performance limits on the DNS cache acceleration license of the
Infoblox-4030 appliance. This is only applicable to the Infoblox-4030 appliance.
— Type Details: Information about the attribute type that the license monitors. This field can display the
following information for each attribute:
— Leases: The number of DHCP leases that the DHCP license supports.
— Model: The model of the vNIOS virtual appliance, such as IB-VM-1410 or IB-VM-800.
— Tier: The performance limit value of an Infoblox-4030 appliance with DNS Cache Acceleration, such as
Tier-1 for full capacity (up to 1M qps), Tier-2 for high (up to 600K qps), Tier-3 for base (up to 300K qps)
performance limits, and Tier-4 (up to 150K qps). This is only applicable to the Infoblox-4030 appliance.
— Expiration: The expiration date of the license.
— Replaced Hardware ID: The hardware ID of the appliance whose license was removed.

Viewing Dynamic Licenses

You can install dynamic licenses on the Grid Master for future vNIOS appliance deployments. When you install
dynamic licenses, the Grid Master store them in a license pool. You can view these licenses and evaluate license
usage for vNIOS virtual appliances.
To view dynamic licenses in the pool and their usage information:
1. Log in to Grid Manager on the Grid Master.
2. Select the Grid tab -> Licenses tab -> Pool tab. The appliance displays the following information:
— Feature: The feature for which you have obtained the license.
— Installed: The number of licenses that have been installed for the specified feature.
— Assigned: The number of licenses currently allocated to vNIOS virtual appliances.
— Available: The number of licenses that are currently available for the specified feature.
— License Model: For vNIOS license only. Indicates the model type of the vNIOS virtual appliance. Note that
the vNIOS license you install on the vNIOS appliance must match the appliance model. You can use vNIOS
license that has a higher capacity on a vNIOS appliance that has a smaller capacity, but not vice versa. For
example, you can install a CP-V1400 license on a CP-V800 or CP-V1400 appliance, but not on a CP-V2200.
— Limit Context: Depending on the license type, this field displays the attribute (such as Model) that the
license controls. This field is blank if the license does not control any attribute type. This field can display
one of the following:
— Leases: Indicates that this DHCP license supports a specific number of DHCP leases. The number of
leases supported is displayed in the Type Details field.
— Model: Indicates that this vNIOS license supports a specific vNIOS virtual appliance model. The model
supported is displayed in the Type Details field.
— Tier: Indicates various levels of performance limits on the DNS cache acceleration license of the
Infoblox-4030 appliance. This is only applicable to the Infoblox-4030 appliance.
— Limit Value: Information about the attribute type that the license monitors. This field can display the
following information for each attribute:
— Leases: The number of DHCP leases that the DHCP license supports.

484 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Licenses

— Model: The model of the vNIOS virtual appliance, such as IB-VM-1410 or IB-VM-800.
— Tier: The performance limit value of an Infoblox-4030 appliance with DNS Cache Acceleration, such as
Tier-1 for full capacity (up to 1M qps), Tier-2 for high (up to 600K qps), and Tier-3 for base (up to 300K
qps) performance limits. This is only applicable to the Infoblox-4030 appliance.
To search for specific licenses in the Active and Pool tabs, you can use filters and the Go to function (the Go to function
is not supported in the Pool tab) to narrow down the list. With the autocomplete feature, you can just enter the first
few characters of an object name in the Go to field and select the object from the possible matches. You can also
create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.

Backing Up Licenses
You can back up all the static licenses and dynamic licenses in the license pool container, in case you need to
re-install them at a later time. Infoblox recommends backing up the licenses before removing any of them.

Note: Dynamic licenses are not exported to this file. Dynamic licenses are automatically released and returned to the
license pool on the Grid Master when a member leaves the Grid. Unallocated dynamic Licenses are available
for allocations.

When you back up the licenses, Grid Manager creates a CSV file that lists the following information for each license:
serial number, hardware ID, license type, end date, license string.
To back up licenses:
1. From the Grid tab, select the Licenses tab.
2. Click Export All Licenses from the toolbar. Grid Manager generates a CSV file that contains all the licenses.
Depending on the browser you use, you can then open the file or save it to a specified location.

Removing Licenses
You can remove licenses and reset a NIOS appliance to its factory default settings. For example, if you have a NIOS
appliance running the DNSone package with the Grid upgrade, but you want to use it as an independent appliance,
you can remove the Grid license. Infoblox recommends that you back up licenses before removing them, in case you
decide to re-install them at a future time.

Note: Exercise caution when removing licenses; you may render an appliance unusable by removing the wrong
license. Other feature sets may be affected once you remove a license; for example, removing licensing for DNS
and DHCP services will also disable task packs in the NIOS Dashboards –> Tasks page.

To remove an active license:

1. From the Grid tab, select the Licenses tab -> Active tab.
2. Select the license and click the Delete icon.
Check the license that you are about to remove. Note that removing the wrong license can render an appliance
unusable.
3. Click Yes when the confirmation dialog appears.
4. Close the browser window and log in to the Infoblox GUI.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 485

Managing Appliance Operations

About Elastic Scaling

Elastic Scaling provides the capability to automatically pre-provision and deploy vNIOS appliances on-demand for
IPAM (IP Address Management), DNS, and/or DHCP. Compared to standard appliance deployment and licensing
management, you now have the flexibility to purchase multiple service and feature licenses and install them as
dynamic licenses for future vNIOS or cloud deployments based on your evolving business needs and deploy them as
needed. When you remove a vNIOS or cloud appliance from the Grid, the dynamic licenses on the appliance are
automatically released and returned to the license pool on the Grid Master for reuse at a later time. Elastic scaling
includes a full set of APIs for pre-provisioning, deployment, and de-provisioning vNIOS appliances, making it simple
to add or remove DNS or DHCP capacity on-demand to meet changing infrastructure requirements, which is critical
for realizing the benefits of dynamic Cloud environments. For information about the Infoblox cloud solution, see
Deploying Cloud Network Automation on page 361.
You can purchase licenses of any type, such as vNIOS, DNS, DHCP, Enterprise (formerly Grid) and Cloud Platform,
deploy them as dynamic licenses on the Grid Master , and allocate them to vNIOS virtual appliances manually or
automatically through Elastic Scaling.
All dynamic licenses are tied to a specific Grid Master. You must first obtain the LPC_UID (License Pool Container
Unique ID) of the Grid Master before obtaining the licenses from Infoblox Technical Support. For more information,
see Obtaining Dynamic Licenses on page 481.
When you use Elastic Scaling to pre-provision and launch vNIOS appliances, licenses are automatically installed on
the newly spun-up appliances during the process as long as you have the correct vNIOS licenses in the license pools
for the vNIOS models you plan to deploy. For example, you can install a CP-V1400 license on a CP-V1400 or CP-V800,
but you cannot do so on a CP-V2200. If there are no licenses available in the pool for the specified appliance models,
the Grid Master notifies you with an error message (for Cloud Platform Appliances, the API calls fail). Note that you
cannot add a vNIOS Grid member when no dynamic licenses are available. When you spin down vNIOS appliances,
its assigned licenses are released and returned to the NIOS license pool.
The Grid Master keeps track of dynamic licenses that are allocated to vNIOS members and adjusts the total number
of available dynamic licenses for each feature and service. You can view the total number of dynamic licenses
installed for each feature and service, the number of active and available licenses, their usage, and other related
information in the Grid tab -> Licenses tab -> Pool tab of Grid Manager. For information about how to view dynamic
licenses, see Viewing Dynamic Licenses on page 484.
You can also manually allocate and deallocate dynamic licenses as your business requirements evolve. For more
information, see Managing the Order of Match Lists on page 489 and Manually Deallocating Dynamic Licenses on
page 482.

Using Elastic Scaling to Pre-provision and Launch vNIOS Members

You can use Elastic Scaling to deploy on-demand vNIOS virtual members in a Grid and in your cloud environment and
pre-provision them to manage networks and zones. For information about how to utilize Elastic Scaling to provision
Cloud Platform Appliances and join them to the Grid using cloud API calls, see Sample Cloud API Requests for Elastic
Scaling on page 375.
Complete the following tasks to pre-provision and launch vNIOS appliances:
1. Obtain dynamic licenses and install them on the Grid Master, as described in Obtaining Dynamic Licenses
on page 481. You can also use a temporary license to spin up a Grid Master VM.
2. Create an offline Grid member or HA pair, as described in Adding a Single Member on page 297 or Adding
an HA Member on page 300.
3. Pre-provision the offline Grid member you just created, as described in Configuring Pre-Provisioned
Members on page 310. Note that there are a few guidelines that you might want to review before
pre-provisioning your Grid member. For more information, see Guidelines for Pre-provisioning Offline Grid
Members on page 309.

486 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Elastic Scaling

Note: You must include the Grid and vNIOS provisional licenses for pre-provisioned vNIOS members in order to
join them to the Grid.

4. Generate a token for the Grid member, as described in Generating Tokens for Grid Members on page 487.

Note: For HA pairs, the appliance generates two tokens—one for each node of the HA pair.

5. Use cloud API calls to add network views, networks, or zones and then delegate the objects to the offline
Grid member. For information about sample cloud API requests, see Sample Cloud API Requests for Elastic
Scaling on page 375.
6. Use API requests to join the Grid member to the Grid. For sample API requests, see Sample Cloud API
Requests for Elastic Scaling on page 375. If for any reasons the automated process of Elastic Scaling fails
or if you are unable to send API calls, you can use CLI commands to join the Grid member to the Grid as a
workaround. For more information, see Using CLI Commands to Join Grid Members on page 488.
7. Verify the Grid member has successfully joined the Grid, as described in Viewing Status on page 1326.
8. Verify the dynamic licenses have been allocated correctly by viewing the license usage, as described
inViewing Dynamic Licenses on page 484

Generating Tokens for Grid Members

Before you can automatically allocate dynamic licenses to a pre-provisioned member, you must request a one-time
token from the Grid Master. This token allows the member to register and authenticate itself to the Grid Master before
a specified date and time (the default is 60 minutes from the time you generate the token). When the token is not
used after the expiration date and time, it becomes invalid and you must generate another token for the member. You
can configure the token usage timeout so the appliance can send syslog messages to alert you about the unused
token. For information about how to set the token usage timeout value, see Configuring Token Usage Timeout.
Using a one-time token eliminates the need for the Grid Master credentials to be exposed to other Grid members and
the CMP (Cloud Management Platform) in the case of cloud implementation. Note that only superusers can generate
and view the token for a pre-provisioned Grid member.

Note: You can use API calls as part of the automated deployment process to generate a token for the vNIOS Grid
member before joining it to the Grid. For information about sample API requests you can use to generate a
token, see Sample Cloud API Requests for Elastic Scaling on page 375. As a workaround, you can also
generate a token through Grid Manager.

To generate a token through Grid Manager, complete the following:

1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Click the Action icon (shown as a gear in each row for the table) next to the vNIOS member and select
Generate Token from the list.
3. In the Your Permission Token dialog, the appliance displays the token and the Expiration Date of the token. You
must generate a new token for the member if the token is not used before the expiration date.

Note: Copy this token and paste it at the CLI when you use the set token on command to set the token and
generate the token file.

Configuring Token Usage Timeout

You can configure the appliance to send syslog messages to alert you about an unused token that has been
generated for a pre-provisioned member. Depending on the timeout interval you configure, the appliance sends a
syslog message for each timeout interval until the token expires.
To configure the token usage timeout value:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 487

Managing Appliance Operations

1. From the Grid tab -> Grid Manager tab, click Grid Properties -> Edit from the toolbar.
2. In the Grid Properties editor, select the General tab -> Basic tab and complete the following:
— Token usage timeout: Enter the time interval (in minutes) for which the appliance sends a syslog message
to alert you about the unused permission token for a pre-provisioned member. For example, if you enter 5
here, the appliance sends a syslog message every five minutes. The default is 10.
3. Save the configuration.

Using CLI Commands to Join Grid Members

Note: If for any reasons the automated process of Elastic Scaling does not function properly, you can use CLI
commands to join Grid members to the Grid as a workaround.

When using Elastic Scaling, ensure that you have generated a token for the member, as described in Generating
Tokens for Grid Members on page 487 before joining the member to the Grid.
To join the vNIOS member to the Grid:
1. Access the Infoblox CLI using an SSHv2 connection through an SSHv2 client. You can also access the CLI by
connecting a serial cable directly from the console port of a management system to the console port on the
appliance, and then using a terminal emulation program such as Hilgraeve Hyperterminal® (provided with
Windows® operating systems) and launch a session. The connection settings are:
• Bits per second: 9600
• Stop bits: 1
• Data bits: 8
• Flow control: Xon/Xoff
• Parity: None
2. Log in using the default user name and password admin and infoblox. User names and passwords are
case-sensitive.
3. To change the network settings from the default, enter the set network command. Then enter information as
prompted to change the IP address, netmask, and gateway for the LAN1 port.
Infoblox > set network
NOTICE: All HA configuration is performed from the GUI. This interface is used only to
configure a standalone node or to join a grid.
Enter IPv4 address [Default: n.n.n.41]: <Enter the LAN1 port IP address>
Enter netmask: [Default: 255.255.255.0]: <Enter the LAN1 port netmask>
Enter gateway address [Default: n.n.n.1]: <Enter the gateway IP address>
NOTICE: Additional IPv6 interface can be configured only via GUI.
Become grid member? (y or n): n

Note: You must enter n to use Elastic Scaling. If you enter y, the member becomes a Grid member and you will
not be able to set token and join the pre-provisioned member to the Grid.

4. Use the set token on command to set the member token, the Grid Master IP address and certificate to the token
file. Following is an example:
Infoblox > set token on
Enter GM-IP [Current: not defined]: <Enter the Grid Master IP address>
Enter Token [Current: not defined]: Copy token from the Your Permission Token dialog in
Grid Manager.
New Token Settings:
GM-IP: 1.1.1.1
Token: b25lLnZpcnR1YWxfbm9kZSQx
Is this correct? (y or n): y

488 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing the Order of Match Lists

Do you want to download the certificate form GM and validate (y or n): y

Is this correct and valid (y or n): y
Are you sure to apply and save settings to file?: y
The token and certificate are saved.
5. To verify the token:
Infoblox > show token
The CLI displays the current token setting and certification information. Verify this information.

Note: If there is incorrect information, use set token off to remove the token file.

6. Use the set token join command to register the Grid member and get licenses from the license pool before
joining the member to the Grid. Once the member joins the Grid, the token become invalid—you can use the
token only once.
Infoblox > set token join
Are you sure to start Member registration Client? (y or no): y
Starting Member registration Client...
Connecting...

Note: For HA pairs, repeat the CLI commands on both nodes.

Managing the Order of Match Lists

When you configure certain DNS and DHCP functions, you can create match lists that the appliance uses to filter
specific IP addresses for specific operations. For example, you can create a DNS blackhole list for including and
excluding DNS traffic to certain IP addresses, configure a list of IP addresses for allowing and denying DDNS updates,
or define a Match Destinations list that identifies destination addresses and TSIG keys that are allowed access to a
DNS view.
The appliance matches rules in these lists from top to bottom. Rules at the top always take precedence over those at
the bottom. Therefore, ensure that you put the most specific rules at the top of the list, and then put the more general
rules at the bottom. For example, when you add network 10.10.0.0/24 to a DNS blackhole list, all 256 IP addresses
in the network are put on the blackhole list. To allow DNS traffic to the specific IP addresses 10.10.0.55 and
10.10.0.88, you must add these two addresses at the top of the blackhole list before the network address
10.10.0.0/24, and then set their permissions to “Exclude.” The same applies when you set up the list of clients for
DDNS updates. If you want to deny DDNS updates from a specific client (10.0.0.99) and allow DDNS updates from all
other clients in the 10.0.0.0/24 network, you must put 10.0.0.99 at the top of the list and configure the appliance to
deny DDNS updates from this client. You then add network 10.0.0.0/24 for allowing DDNS updates from all other
clients at the bottom of the list.

Managing NIOS Appliances

To reboot and shut down a NIOS appliance, you can use Grid Manager or the Infoblox CLI. To reset a NIOS appliance,
you must use the Infoblox CLI. You can also restart a Grid member or restart a GUI session through Grid Manager. You
can also force an HA failover using the GUI.

Restarting a Grid Member

You can restart a single Grid member or an HA pair on the NIOS appliance. When you restart a Grid member, the
appliance logs the task in the audit log.
To restart a single Grid member:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 489

Managing Appliance Operations

1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box.
2. Expand the Toolbar and click Control -> Restart.
3. In the Restart Product on Member dialog box, click OK to restart the Grid member.

Rebooting a NIOS Appliance

You can reboot a single NIOS appliance, a single node in an HA pair, or both nodes in an HA pair.
To reboot a single NIOS appliance or one or both nodes in an HA pair:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box.
2. Expand the Toolbar and click Control -> Reboot.
— For an HA pair, choose whether to boot one node (and which one) or both nodes, and then click OK.
Depending on the browser you use, Grid Manager may display a dialog box that indicates the system is unavailable
during a restart or reboot.
To reboot a single NIOS appliance using the CLI:
1. Log in to the Infoblox CLI using a superuser account for the NIOS appliance that you intend to reboot.
2. Enter the following CLI command: reboot

Shutting Down a NIOS Appliance

Under normal circumstances, you do not need to turn off or shut down a NIOS appliance. It is designed to operate
continuously. However, if you want to turn off a NIOS appliance, use the GUI or the CLI to shut down the appliance,
instead of just turning off the power switch.

Note: If there is a disruption in power when the NIOS appliance is operating, the NIOS appliance automatically
reboots itself when power is restored.

To shut down a NIOS appliance:

1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box.
2. Expand the Toolbar and click Control -> Shutdown.
— For an HA pair, choose whether to shut down one node (and which one) or both nodes, and then click OK.
The NIOS appliance shuts down. The fans might continue to operate until the appliance cools down.
To shut down a NIOS appliance using the CLI:
1. Log in to the Infoblox CLI using a superuser account.
2. Enter the following CLI command: shutdown

Forcing an HA Failover
If you want to change which node in an HA pair is active and which is passive, you can force a failover to occur. Within
five seconds after initiating a failover, the previously passive node becomes active and assumes ownership of the
VIP address. Note that a forced failover causes a temporary service disruption. To proceed with the forced failover,
click OK. The appliance logs this task in the audit log.
To restart a single Grid member:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box.

Note: The Grid member that you select must be an HA pair.

2. Expand the Toolbar and click Control -> Force HA Failover.

3. In the For HA Failover dialog box, click OK to change the node in an HA pair.

490 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing NIOS Appliances

Restarting GUI Sessions

You can restart a GUI session through Grid Manager. When you restart GUI on a specific member, the appliance logs
off all other GUI sessions that are currently running even though they are opened in different browsers or another
system. The appliance logs this task in the audit log.
To restart GUI sessions on a Grid member:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box.
2. Expand the Toolbar and click Control -> Restart GUI.
3. In the Restart GUI dialog box, click OK to restart the NIOS appliance.

Resetting a NIOS Appliance

There are three ways to reset a NIOS appliance:
• Resetting the Database on page 491
• Resetting a NIOS Appliance to Factory Settings on page 491
• Resetting the NIOS Appliance to Factory Settings and Removing Licenses on page 492
You can perform these functions only through the CLI.

Resetting the Database

You can reset the database if you lose the administrator account and password or if you want to clear the database
but preserve the log files to diagnose a problem. This function removes the configuration files, and the DNS and DHCP
data from the appliance database. During this procedure, you are given the option to preserve the network settings
of the appliance, which are the IP address and subnet mask, the IP address of the gateway, the host name, and the
remote access setting.
To reset the database:
1. Log in to the Infoblox CLI using a superuser account.
2. Enter the following CLI command: reset database
The appliance then displays a message similar to the following:
The following network settings can be restored after reset:
IP Address: 10.1.1.10
Subnet Mask: 255.255.255.0
Gateway: 10.1.1.1
Host Name: ns1.corp100.com
Remote Console Access: true
The entire database will be erased.
Do you wish to preserve basic network settings? (y or n)
3. Press the Y key to preserve the network settings or the N key to return the network settings to their default values
(192.168.1.2, 255.255.255.0, 192.168.1.1).

Resetting a NIOS Appliance to Factory Settings

You can reset a NIOS appliance to its original factory settings. This removes the database, network settings, logs, and
configuration files. Then, it reboots with its factory settings, which are the default user name and password, and
default network settings. When you perform this procedure, the appliance does not give you the option to preserve
your network settings.

Note: If you have previously imported HTTPS certificates, the appliance regenerates the certificates and replaces
them.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 491

Managing Appliance Operations

To reset the NIOS appliance to its factory settings:

1. Log in to the Infoblox CLI using a superuser account.
2. Enter the following CLI command: reset all

Resetting the NIOS Appliance to Factory Settings and Removing Licenses

You can also reset a NIOS appliance to its original factory settings and remove all the licenses installed on the
appliance. This removes the database, network settings, logs, configuration files, and licenses. The appliance then
reboots with its factory settings, which are the default user name and password, and default network settings.

Note: If you have previously imported HTTPS certificates, the NIOS appliance regenerates the certificates and
replaces them.

To reset the NIOS appliance to its factory settings and remove all its licenses:
1. Log in to the Infoblox CLI using a superuser account.
2. Enter the following CLI command: reset all licenses.

Managing the Disk Subsystem on the Infoblox-4010

Among its many features, the Infoblox-4010 use a RAID (Redundant Array of Independent Disks) 10 array to provide
the optimum mix of high database performance and redundant data storage with recovery features in the event of
disk failures. The disk array is completely self managed. There are no maintenance or special procedures required to
service the disk subsystem.

Caution: Never remove more than one disk at a time from the array. Removing two or more disks at once can cause
an array failure and result in an unrecoverable condition. You should replace only one disk at a time, using
a replacement disk from Infoblox. For information, see Replacing a Failed Disk Drive on page 494.

About RAID 10
RAID 10 (or sometimes called RAID 1+0) uses a minimum of four disk drives to create a RAID 0 array from two RAID 1
arrays, as shown inFigure 8.15. It uses mirroring and striping to form a stripe of mirrored subsets. This means that
the array combines—or stripes—multiple disk drives, creating a single logical volume (RAID 0). RAID 10 combines the
high performance of RAID 0 and the high fault tolerance of RAID 1. Striping disk drives improves database write
performance over a single disk drive for large databases. The disks are also mirrored (RAID 1), so that each disk in
the logical volume is fully redundant.

492 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing the Disk Subsystem on the Infoblox-4010

Figure 8.15 RAID 10 Array Configuration

RAID 0

RAID 1 RAID 1

Disk 1 Disk 1 Disk 2 Disk 2

Primary Backup Primary Backup

When evaluating a fault on the Infoblox-4010, it is best to think of the disk subsystem as a single, integrated unit with
four components, rather than four independent disk drives. For information, see Evaluating the Status of the Disk
Subsystem on page 493.

Evaluating the Status of the Disk Subsystem

You can monitor the disk subsystem through the Infoblox Grid Manager GUI, the scrolling front panel LCD display, and
four front panel LEDs next to the disk drives. In addition, you can monitor the disk status by using the CLI command
show hardware_status. The following example displays the status of an Infoblox-4010 using the command:
Infoblox > show hardware_status
POWER: Power OK
Fan1: 7258 RPM
Fan2: 6887 RPM
Fan3: 7258 RPM
CPU1_TEMP: +20.0 C
CPU2_TEMP: +24.0 C
SYS_TEMP: +35 C

RAID_ARRAY: OPTIMAL
RAID_BATTERY: OK READY Yes 103 HOURS
The Detailed Status panel provides a detailed status report on the appliance and service operations. To see a detailed
status report:
• From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box -> Detailed Status icon
in the table toolbar.
After displaying the Detailed Status panel, you can view the status of the selected Grid member. For more information
on the Detailed Status panel, see Viewing Status on page 1326.
The RAID icons indicate the status of the RAID array on the Infoblox-4010.

Icon Color Meaning

Green The RAID array is in an optimal state.

Yellow A new disk was inserted and the RAID array is rebuilding.

Red The RAID array is degraded. At least one disk is not functioning properly. The GUI lists the disks
that are online. Replace only the disks that are offline.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 493

Managing Appliance Operations

The appliance also displays the type of each disk. In the event of a disk failure, you must replace the failed disk with
one that is qualified and shipped from Infoblox and has the same disk type as the rest of the disks in the array.
Infoblox-4010 uses only the IB-Type 3 disk type. All disk drives in the array must have the same disk type for the array
to function properly. You can have either IB-Type 1, IB-Type 2, or IB-Type-3, but you cannot mix both in the array. When
you have a mismatched disk in the array, you must promptly replace the disk with a replacement disk from Infoblox
to avoid operational issues.

Disk Drive Front Panel LEDs

The disk drives of the Infoblox-4010 are located on the appliance front panel. To the right of each drive, two LEDs
display connection and activity status. Table 8.7 lists the disk drive LED combinations and the states they represent.

Table 8.7 Infoblox-4010 Disk Drive LED Combinations

Online/Activity Fault/UID LED (Amber/Blue) Description

LED (Green)
On, off, or blinking Alternating amber and blue The drive has failed, or it has received a predictive failure
alert; it also has been selected by a management
application.
On, off, or blinking Steadily blue The drive is operating normally.
On Amber, blinking regularly The drive has received a predictive failure alert. Replace the
(1 Hz) drive as soon as possible.

On Off The drive is online but it is not currently active.

Blinking regularly Off Do not remove the drive. The drive is rebuilding. Removing
(1Hz) the drive may terminate the current operation and cause
data loss.
Blinking Amber, blinking regularly The drive is active, but it has received a predictive failure
irregularly (1 Hz) alert. Replace the drive as soon as possible.

Blinking Off The drive is active and operating normally.

irregularly
Off Steadily amber A critical fault condition has been identified for this drive,
and the controller has placed it offline. Replace the drive as
soon as possible.
Off Amber, blinking regularly The drive has received a predictive failure alert. Replace the
(1 Hz) drive as soon as possible.

Off Off The drive is offline, a spare, or not configured as part of an

array.

Replacing a Failed Disk Drive

The Infoblox-4010 is designed to provide continuous operation in the event of a failed disk. Replace an original RAID
disk only when there is a disk failure. Hot-swapping a disk drive is a simple process that does not require issuing
commands or a GUI operation.
When you replace a failed disk, you must replace it with an Infoblox supplied disk. To ensure that you receive the
correct replacement disk, report the disk type or part number of the failed disk. The appliance displays the disk type
in the Detailed Status panel, and the Infoblox part number is printed on the disk. Installing disks that are not qualified
and shipped from Infoblox could cause failures in the appliance.

494 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing the Disk Subsystem on the Infoblox-4010

To replace a disk drive, follow this procedure:

1. Identify and verify the failed drive via the Grid Manager, front panel LCD, or CLI.
2. Make sure you have identified the correct drive.

Note: Do not remove a correctly functioning drive.

3. Push in the latch for the drive and pull the release lever out towards you.
4. When the drive disengages, wait about 30 seconds for the disk to completely stop spinning.
5. Slide it out of the slot.
Replacement drives are shipped as a complete unit, ready to insert into the appliance. There is no preparation
required. To install a replacement drive, follow this procedure:
1. Insert the replacement drive into the drive bay slot.
2. Gently slide the drive into place. When you feel the release lever engage, continue applying gentle pressure to
the drive while pushing the release lever towards the appliance.
3. The release lever locks into place and the LED next to the disk drive lights up. Note that if the alarm buzzer is
sounding, it automatically turns off about 20 seconds after the drive is inserted.
4. The disk drive automatically goes into rebuild mode.

Disk Array Guidelines

Infoblox has designed the disk array to be completely self managed. There are no maintenance procedures required
for a normally functioning disk array. Mishandling the disk array can cause an unrecoverable error and result in a
failed appliance. Infoblox highly recommends that you observe the following guidelines:
• Remove only one disk at a time. Do not remove two or more disks from the appliance at the same time.
Removing two or more disks at the same time might result in an appliance failure and require an RMA of the
appliance. This rule applies to both powered and powered down appliances.
• If the status of the array is degraded, remove the failed or failing disk drive only. Do not remove an optimally
functioning drive.
• If your acceptance procedure requires a test of the RAID hot swap feature, remove only one disk drive at a time.
You can remove a second disk only after you replace the first disk and the array completes its rebuilding
process.
• Do not remove a disk drive if the array is rebuilding. This could result in an appliance failure. Verify the status of
the array before removing a disk drive.
• Use the following procedure to remove a spinning disk:
1. Unlatch and pull the disk about two cm (one inch) to disengage contact.
2. Wait about 30 seconds for the disk to completely stop spinning.
3. Remove the disk and handle it with care. Do not drop the disk or ship it loosely in a carton.
• You can hot swap a drive while the appliance remains in production.
• There are some conditions that may require powering down the appliance to replace a failed unit. This normally
happens if the RAID controller detects an error that could damage the array. If you insert a replacement drive
into a live array and the controller doesn’t recognize the drive, power down the appliance.
• If you inadvertently remove the wrong disk drive, do not immediately remove the disk drive that you originally
intended to remove. Verify the status of the array and replace the disk drive that you removed earlier before
removing another drive. Removing a second drive could render the appliance inoperable.
• Older appliances have an audio alarm buzzer that sounds if a drive fails. The alarm automatically stops about
20 seconds after a functional disk has been inserted into the array.
• All disks in the RAID array should have the same disk type for the array to function properly.
• In the unlikely event that two disk drives fail simultaneously and the appliance is still operational, remove and
replace the failed disk drives one at a time.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 495

Managing Appliance Operations

• Rebuild time depends on a number of factors, such as the system load and Grid replication activities. On very
busy appliances (over 90% utilization), the disk rebuild process can take as long as 40 hours. On a Grid Master
serving a very large Grid, expect the rebuild process to take at least 24 hours.
• Replace a failed or mismatched disk only with a replacement disk shipped from Infoblox. When you request a
replacement disk, report the disk type displayed in the Detailed Status panel of the GUI or the Infoblox part
number on the disk.

Restarting Services
Whenever you make a change such as adding a zone or a network, Grid Manager notifies you that a service restart is
required. There are several ways to restart services on the affected Grid members.
You can restart services at the Grid or member level, or you can restart services by groups, as described in:
• Restarting Grid Services on page 496
• Restarting Member Services on page 497
• Restarting Services by Groups on page 498
You can configure the services restart settings such as restart timeout or delay as described in Configuring Restart
Settings on page 501.

Note: When you make configuration changes for DNS or DHCP and the service is enabled on at least one Grid
member, Grid Manager suggests a restart even if the service is disabled on the member affected by the
change.

User Permissions for Restarting Services

The following rules apply to superusers and limited-access users:
• You can cancel a schedule task that you create to restart a service. A superuser can cancel any scheduled restart
task.
• Only superusers and administrators with read/write permission to all Grid members can schedule a Grid restart
task.
• When a superuser schedules a Grid restart task, a limited-access user cannot schedule a member-level restart
task.
• Limited-access users cannot cancel a superuser’s scheduled tasks.
• Limited-access users cannot create or modify a scheduled restart task for a Grid member if a scheduled restart
task for the member (created by another user) already exists.
The system writes every scheduled change action to the audit log as follows:
USER logon_id action service restart schedule 'schedule' on Grid (or member) Grid name
or member node id
For example:
USER jdoe insert service restart schedule '02/20/2007 01:30:00' on Grid Infoblox
USER jdoe deleted service restart schedule '02/22/2007 01:30:00' on node id 3
For more information on the audit log, see Using the Audit Log on page 1344.

Restarting Grid Services

Only superusers and administrators with read/write permission to all Grid members can schedule a Grid restart task.
You can restart services at the Grid level either simultaneously or sequentially, and can also specify the restart time.
If you schedule the restart at a specific date and time, the system schedules the restart at the specified time on each
Grid member.

496 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Restarting Services

To restart services at the Grid level:

1. From the Data Management tab, select the DHCP, DNS, or Grid tab, or select the Administration tab, and then
click Restart Services from the Toolbar.
The Restart Grid Services dialog appears.
2. You can specify whether the member restarts services when necessary or you can force it to restart services.
Select one of the following in the Restart Grid Services section:
— If needed: Select this to restart all active DNS and DHCP services if there are any changes requiring a service
restart.
— Force service restart: Select this to force a service restart even if it is not needed. A forced restart may be
delayed if there are pending restarts for the same service.
3. Select one of the following in the Restart Method section:
— Restart All Restart Groups: Restarts the services in the affected Grid members in the order defined for
restart groups. For information, see Restarting Grid Services on page 496.
— Simultaneously for all members: Restarts the services on all of the members in a Grid at the same time.
— Sequentially for all members: Restarts the services on each Grid member one after one.
Affected Members and Services: Click the Poll Members icon to display the affected members and services
when the system restarts. Grid Manager displays the member names and one of the following for each service:
— YES: The service is active and the system will restart the service upon execution of this task.
— NO: The service will not restart unless the Force service restart option is selected.
— DISABLED: The service is currently disabled.
4. To schedule a service restart task, click the Schedule icon at the top of the wizard. In the Schedule Change panel,
complete the following:
— Now: Restarts services upon clicking Restart.
— Later: Enter the following information to schedule all Grid members to restart services at a certain date and
time:
— Date: Enter a date in YYYY-MM-DD (year-month-day) format. The appliance displays today’s date. You
can also click the calendar icon to select a date from the calendar widget.
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. When you enter the
time in a 24-hour format such as 23:00, Grid Manager displays 11:00:00 PM. You can also select a time
from the drop-down list by clicking the time icon.
— Time Zone: Select a time zone for the scheduled date and time from the drop-down list. This field
displays the time zone of the browser that the admin uses to log in to Grid Manager.
5. Click Restart to restart services immediately or click Schedule Restart to create a scheduled restart task.

Note: When you restart services at the Grid level, the services are restarted only on those members for which you
have permissions.

Restarting Member Services

The member restart time always supersedes the Grid restart time. If the member restart time is later than the Grid
restart time, then the member restarts services at its scheduled time. If the member restart time is before the Grid
restart time, then the member restarts services at its scheduled restart time, and again during the Grid restart time.
To restart member services:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box.
or
From the Grid tab, select the Grid Manager tab, and then select a member check box.
2. Click Restart Services from the Toolbar.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 497

Managing Appliance Operations

3. You can specify whether the member should restart services when necessary or you can force it to restart
services. Select one of the following in the Restart Member Services section:
— If needed: Select this to restart all active DNS and DHCP services, if there are any changes requiring a
service restart.
— Force service restart: Select this to force a service restart even if it is not needed. A forced restart may be
delayed if there are pending restarts for the same service.
Affected Services: This table displays the affected services when the system restarts. It can display one of the
following for each service:
— YES: The service is active and the system will restart the service upon execution of this task.
— NO: The service will not restart unless the Force service restart option is selected.
— DISABLED: The service is currently disabled.
4. To schedule a service restart task, click the Schedule icon at the top of the editor. In the Schedule Change panel,
complete the following:
— Now: Restarts services immediately.
— Later: Enter the following information to schedule the member to restart services at a certain date and time:
— Date: Enter a date in YYYY-MM-DD (year-month-day) format. The appliance displays today’s date. You
can also click the calendar icon to select a date from the calendar widget.
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also select
a time from the drop-down list by clicking the time icon.
— Time Zone: Select a time zone for the scheduled date and time from the drop-down list. This field
displays the time zone of the browser that the admin uses to log in to Grid Manager.
5. Click Restart to restart services immediately or click Schedule Restart to create a scheduled restart task.

Restarting Services by Groups

You can use the group restart feature for the DHCP and DNS services. You do this by adding Grid members to groups
and defining the restart order. Each service has a separate set of groups. You can specify whether a group is restarted
sequentially or simultaneously and can also create a recurring schedule for restarts.
To access restart groups:
1. Click Grid –> Grid Manager –> DHCP or DNS.
2. On the Services tab, click Toggle Restart Groups View.
You can arrange group restart order for each service independently. Members in a group can restart simultaneously
or sequentially, depending on your choice. When members are started sequentially, they are started in alphabetical
order. When you have several restart groups, they all restart sequentially in the order that you define. For information,
see Ordering Restart Groups on page 500.
For each service, there exists the Default restart group in Grid Manager: Default DHCP group and Default DNS group.
All Grid members belong to the Default group until you add them to another custom restart group. By default, the
members of the Default group are restarted sequentially. The Default group is always restarted in the last place in the
restart sequence for a service.

Note: You can manage restart groups only if you are a superuser. If you are a limited-access user, you can see the
restart groups and their restart status only if these groups include members for which you have permissions.
When you restart services by groups, the services are restarted only on those members for which you have
permissions.

For more information on how to create and manage restart groups, see the following sections. For how to restart
services by groups, see Restarting Groups on page 500.

498 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Restarting Services

Creating a Restart Group

You can add a member to a group if the member has a license for the corresponding service. Only members with the
appropriate license are available for grouping. For pre-provisioned members, you can add them to groups, but the
restart requests are not created for such members.
When you assign members to restart groups, Grid Manager checks if the restart may affect the service operation. If
the restart with the current grouping configuration can lead to a service interruption, a warning message is displayed.
For example, you cannot add two members from a DHCP failover association to the same group configured to restart
its members simultaneously.
To create a restart group:
1. Click Grid –> Grid Manager –> DHCP or DNS.
2. On the Services tab, click Toggle Restart Groups View.
3. Click the Add icon.
4. Specify the general information for the group:
— Name
— Comment
— Restart order for group members: simultaneously or sequentially

Note: For how to configure the restart delay between members and member timeout, see Configuring Restart
Settings on page 501.

5. Click Next.
6. Add members by clicking the Add icon for each new member.
7. Click Next.
8. If you want to create a restart schedule for this group, select Enable Restart Schedule and specify the required
parameters.

Note: The restart schedule can run either once or on a recurring basis. It does not create scheduled tasks. If a
schedule is configured for a restart group, you can still perform one-time restarts independently for Grid
members or restart groups and create scheduled tasks for these restarts.

9. Select the restart type for the services on the affected members:
— If needed: Select this to restart services only if there are changes requiring a service restart.
— Force service restart: Select this to force a service restart even if it is not needed. A forced restart may be
delayed if there are pending restarts for the same service.
10. Click Next.
11. If necessary, specify the extensible attributes.
12. Click Save & Close.

Editing a Restart Group

You can edit a restart group at any time, even when the restart process is running. The changes do not affect the
current restart process.
To edit a restart group:
1. In the restart groups list, select the check box of the group to edit.
2. Click the Edit icon.
3. Edit the group properties as described in Creating a Restart Group on page 499.
4. Click Save or Save &Close.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 499

Managing Appliance Operations

Deleting a Restart Group

Yo can delete any restart group, except the Default group. When you delete a group, all its members are automatically
moved to the Default restart group. You can delete a restart group at any time, even when the restart process is
running. The deletion does not affect the current restart process.
To delete a restart group:
1. In the restart groups list, select the check box of the group to delete.
2. Click the Delete icon.

Ordering Restart Groups

You can modify the order in which multiple groups are restarted. You cannot change the order for the Default group,
as it always restarts in the last position by default.
To order restart groups:
1. Go to the restart groups view for the DNS or DHCP service.
2. In the toolbar, click Order Restart Groups.
3. Reorder the groups by using the drag-and-drop operation or by clicking the up and down arrows.
4. Click OK.

Restarting Groups
When you already have restart groups defined, you can restart services by specific groups at any time after you make
configuration changes.
To restart services by groups:
1. Go to the restart groups view for the DNS or DHCP service.
2. Select the groups to restart.
3. In the toolbar, click Restart –> Restart Groups.
4. In the Restart Group Confirmation window, select the restart type for the services on the affected members:
— If needed: Select this to restart services only if there are changes requiring a service restart.
— Force service restart: Select this to force a service restart even if it is not needed. A forced restart may be
delayed if there are pending restarts for the same service.
5. To schedule a service restart, click the Schedule icon at the top of the wizard. In the Schedule Change panel,
complete the following:
— Now: Restarts services immediately.
— Later: Enter the following information to schedule the member to restart services at a certain date and time:
— Date: Enter a date in YYYY-MM-DD (year-month-day) format. The appliance displays today’s date. You
can also click the calendar icon to select a date from the calendar widget.
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also select
a time from the drop-down list by clicking the time icon.
— Time Zone: Select a time zone for the scheduled date and time from the drop-down list. This field
displays the time zone of the browser that the admin uses to log in to Grid Manager.
6. Click Restart to restart services immediately or click Schedule Restart to schedule the restart.

Note: Normally, you cannot restart or schedule a restart of services when a scheduled full Grid upgrade is in
progress. However, you can do so for the Default DNS or DHCP restart group. In this case, only the Grid Master
is restarted. The other members of the group remain in the Timed Out status and are restarted after Grid
Manager gets a response from them. For more information about the full Grid upgrades, see Guidelines for
Scheduling Full Upgrades on page 522.

500 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Restarting Services

Configuring Restart Settings

To configure the service restart settings for the Grid:
1. Click Grid –> Grid Manager –> DHCP or DNS tab.
2. In the toolbar, click Edit –> Grid DHCP Properties or Grid DNS Properties.
3. Click Toggle Advanced Mode –> Restart.
4. If necessary, modify the service restart settings:
— Delay between Restart Groups. This is the delay between the restarts of separate restart groups. The default
is 10 seconds.

Note: If the delay time from the previous group restart has not elapsed yet, the new restart requests are
displayed with the Pending restart status. To speed up the new restarts, you change the delay between
restart groups to a smaller value at any time.

— Member Restart Timeout. This is the amount of time that the appliance waits for a response from a member.
The default is 1 minute.
5. Optionally, select the check box Apply restart requests to offline members when they connect.
6. Click Save & Close.

Canceling a Scheduled Restart Task

Limited-access users can only cancel a scheduled task that they created. Superusers can cancel a scheduled task that
any user created. You can cancel scheduled restart tasks from Task Manager. For information, see Viewing Tasks on
page 82.
When you delete a scheduled restart task, the system cancels the scheduled task to restart services on the member
or Grid and does not restart services. To cancel a scheduled restart, see Canceling Scheduled Tasks on page 94.
You can also turn off the automatic service restart feature for other scheduled tasks. For example, if you set a recurring
automatic restart for a restart group, you may not need the automatic service restart which should normally happen
after a scheduled change of an object. You can do so from the Infoblox CLI using the set scheduled command. For
information, see the section set scheduled in the Infoblox CLI Guide.
Alternatively, administrator users with the approver role can cancel the automatic service restart for individual tasks
when approving them. If you are an approver, you can do so by deselecting the Enable automatic service restart
option for a task in the Task Manager. For information, see Viewing Tasks on page 82.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 501

Managing Appliance Operations

502 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 9 File Distribution Services
This chapter describes the file distribution services on the NIOS appliance. It contains the following sections:
• File Distribution Overview on page 505
— File(s) downloaded and/or uploaded on page 505
• File Distribution Storage on page 506
— Usage Threshold Alerts on page 506
— Modifying File Distribution Storage Limits on page 506
• Managing File Distribution Services on page 507
— Configuring the TFTP Service on page 507
— Configuring the FTP Service on page 507
— Configuring the HTTP Service on page 508
— Configuring Access Control for File Distribution on page 508
— Modifying Access Control Lists on page 509
— Starting and Stopping File Distribution Services on page 510
— Monitoring File Distribution Services on page 510
• Managing Directories on page 511
— Adding Directories on page 511
— Modifying Directories on page 511
— Creating a Virtual TFTP Root Directory on page 511
— Viewing Directories From the Files Tab on page 512
• Managing Files on page 513
— Uploading Files on page 513
— Enabling Upload to Grid Members on page 513
— Uploading Files using Grid Manager on page 513
— Uploading Files Using TFTP, FTP, or HTTP File Transfer Client on page 514
— Deleting Files From the Grid Master on page 514
— Deleting Files From a Member on page 514
• Viewing Files on page 515
— Viewing Files from the Files Tab on page 515
— Viewing Files from the Members Tab on page 515
• Managing Users on page 516
— Users Default Home Directory on page 516
— Enabling FTP Anonymous User on page 508

NIOS 7.3 NIOS Administrator Guide (Rev. A) 503

File Distribution Services

— Adding FTP Users through Grid Manager on page 517

— Adding FTP Users through CSV Import on page 517
— Modifying FTP Users on page 517

504 NIOS Administrator Guide (Rev. A) NIOS 7.3

 File Distribution Overview

File Distribution Overview

You can upload files to the NIOS appliance and to individual Grid members using TFTP, HTTP, and FTP, clients. You can
also upload files using the Grid Manager web interface or the API. Using access control lists, you can specify which
network devices can upload files or retrieve files. You can use the Group Results function for file distribution services
(TFTP, FTP, and HTTP) to group members by extensible attributes that contain the same values. For information about
how to group members by extensible attributes, see Grouping Members by Extensible Attributes on page 303.

Note: File distribution services using TFTP, HTTP, and FTP is not supported by IPv6-only appliances.

Network devices, such as VoIP phones, can use the DHCP services on the appliance for IP address assignments and
use the file distribution services for IP device configuration downloads. Downloads can be accomplished with TFTP,
HTTP, or FTP.

Figure 9.1 Uploading and retrieving files

1 Administrator uploads a file to a 2 A client sends a request

directory on the NIOS appliance to upload or retrieve a file.
Client
using Grid Manager or the API.

File NIOS appliance TFTP, HTTP, or FTP

3 The appliance checks if it is 4 If the client is on the access control list as

allowed to respond to the allowed to upload and retrieve files, the
request from the client. appliance accepts the request. If the client
is not on the access control list or is on the
list of denied clients, the appliance does not
allow the client to upload or retrieve the file.

File uploads and downloads by FTP and TFTP file distribution clients are logged in the syslog under the Administration
-> Logs tabs. The logs store the following information:
• Client IP
• Date and Time
• Event type
• File(s) downloaded and/or uploaded

NIOS 7.3 NIOS Administrator Guide (Rev. A) 505

File Distribution Services

File Distribution Storage

This section describes the storage capacity for file distribution, and how to manage file distribution storage settings.
Maximum storage space allowed for all file distribution services on a Grid is equal to the storage space allowed on
the Grid member with the smallest amount of space allowed. For example, if a Grid has a Riverbed member, which
has a maximum limit of 1GB file distribution storage, then the maximum storage capacity you can set at the Grid level
is 1GB, even if the Grid includes appliances with maximum limits of 10GB.
Maximum storage space is shown in table Table 9.1.

Table 9.1 Maximum Storage Space by Platform Type

Member Type Description Max Limit

INFOBLOX_MEMBER All Infoblox appliances 10GB
VNIOS_MEMBER All virtual appliances (VMWare) 5GB
VM_MEMBER Virtual IPAM member (IPAM Free Ware) 1GB

Usage Threshold Alerts

An SNMP trap generates an alarm message when a member nears storage capacity. The default threshold value is
90%, and the default reset value is 70%. If email notification is enabled, NIOS sends an email when either of these
thresholds are reached.
• When the Grid member storage capacity reaches 100%, the SNMP trap generates a “High Usage” message.
For information on how to modify the threshold values, see Defining Thresholds for Traps on page 1369.
• File distribution clients will fail to PUT files if the file is large enough that it will put the member over the
storage limit.

Modifying File Distribution Storage Limits

1. From the Data Management tab, select the File Distribution tab, and then click Grid File Distribution Properties
from the Toolbar.
2. In the Grid File Distribution Properties editor, complete the following:
— Storage Limit (MB): Enter the maximum storage space in megabytes.
— Include files and directories in system backup: This is selected by default to ensure that the appliance
includes the uploaded files in the backup. You can clear this check box to improve the backup performance
if you have stored these files separately.
3. Save the configuration and click Restart if it appears at the top of the screen.

Note: To avoid data loss, after you change the storage limit FD services will be disrupted briefly and will take
some time to resume. Wait until the File Distribution services are running again on the members before
you upload any files.

506 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing File Distribution Services

Managing File Distribution Services

This section describes how to configure file distribution services such as TFTP, FTP and HTTP. This section also
describes how to configure access control lists which determine which clients are granted access to the service, and
which clients are denied access to the service.

Configuring the TFTP Service

The TFTP file distribution service is disabled on the appliance by default. To allow file distribution access using TFTP,
you must specify the clients that are allowed to use the service and then enable the service on the appliance. If you
do not specify this information or enable the service, the appliance denies access to all clients. The appliance
provides read-only access to the files.
To configure the TFTP file distribution service on a member:
1. From the Data Management tab, select the File Distribution tab -> Members tab -> member check box, and then
click the Edit icon.
2. In the Member File Distribution Properties editor, select the TFTP tab, and then complete the following:
— Listen on Port: Enter the number of the port on which the appliance receives TFTP file distribution requests.
The default is port 69.
— Allow file transfers from: Configure the appliance to grant or deny permissions to TFTP file distribution
requests from clients, as described in Configuring Access Control for File Distribution on page 508.
3. Save the configuration and click Restart if it appears at the top of the screen.
After you configure the TFTP service, you must enable the service to allow file distribution access. For information, see
Starting and Stopping File Distribution Services on page 510.

Configuring the FTP Service

The FTP file distribution service is disabled on the appliance by default. To allow file distribution access using FTP, you
must create at least one user (see Managing Users on page 516), specify the clients that are allowed to use the
service, and then enable the FTP service on the appliance. If you do not specify this information or enable the service,
the appliance denies access to all clients. User creation is not necessary to access the FTP service if anonymous is
enabled at Grid level.The appliance provides read-only access to the files.
To configure the FTP file distribution service on a member:
1. From the Data Management tab, select the File Distribution tab -> Members tab -> member check box, and then
click the Edit icon.
2. In the Member File Distribution Properties editor, select the FTP tab, and then complete the following:
— Listen on Port: Enter the number of the port on which the appliance receives FTP file distribution requests.
The default is port 21.
— Login Banner: Enter your own login banner text that appears after you establish an FTP connection or use
the default (Restricted Access Only).
— FTP Passive Mode: By default, this is selected to enable FTP in passive mode; otherwise, it is in active
mode. An FTP connection between a client and server can be in active or passive mode. In active mode, the
server initiates the data connection. In passive mode, the client initiates the data connection. Depending
on your firewall policy, firewalls can block active mode connections. There is no firewall filtering in passive
mode.
— FTP File Listing: Select this to allow users to list files and subdirectories on the appliance.
— Allow file transfers from: Configure the appliance to grant or deny permissions to FTP file distribution
requests from clients, as described in Configuring Access Control for File Distribution on page 508.
3. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 507

File Distribution Services

Enabling FTP Anonymous User

The 'anonymous' FTP login is disabled by default, except when upgrading an earlier version in which case anonymous
FTP is automatically enabled.
When you enable anonymous FTP at Grid level, you enable anonymous FTP on all Grid members running the FTP
service. Anonymous user is only allowed to download files, even if the member is enabled to allow uploads.
1. From the Data Management tab, select Grid File Distribution Properties on the toolbar.
2. In the Grid File Distribution Properties dialog box, select the Enable Anonymous FTP check box.
3. Click Save & Close.

Configuring the HTTP Service

To allow file distribution access using HTTP, you must specify clients that can request the service and then enable the
HTTP service on the appliance.
Before you enable the HTTP service, however, be aware of the following configuration rules:
• HTTP only runs on the active member of an HA pair.
• HTTP can run on the master or any member.
• HTTP always runs on the LAN port, never the MGMT port.
• HTTP to HTTPS redirect becomes non-functional if the file distribution service is enabled and all administrative
access is run on the LAN port. For more information on HTTP redirect, see Enabling HTTP Redirection on page
440. For information on how to specify the MGMT port for HTTP, see Using the MGMT Port on page 461.
To configure the HTTP file distribution service on a member:
1. From the Data Management tab, select the File Distribution tab -> Members tab -> member check box, and then
click the Edit icon.
2. In the Member File Distribution Properties editor, select the HTTP tab, and then complete the following:
— Allow Any: This is selected by default to allow HTTP file distribution requests from any client.
— Only these addresses: Select this to configure the access control list for allowing HTTP file distribution
requests from clients, as described in Configuring Access Control for File Distribution on page 508.
3. Save the configuration and click Restart if it appears at the top of the screen.

Configuring Access Control for File Distribution

You can select a named access control list (ACL) or create individual access control entries (ACEs) for each file
distribution service (TFTP, FTP, HTTP) to control access to file distribution requests from specific clients. You can grant
or deny access from specific IPv4 addresses and IPv4 networks, but you cannot do so for IPv6 addresses and IPv6
networks as well as TSIG key based ACEs.

Note: For HTTP service, you can grant permissions to all clients or specific clients, but you can deny permissions only
to all clients, not specific clients.

When you grant access to a network for a specific file distribution service, all clients in the network are allowed to
request file distribution service. You can deny services to specific IP addresses within the network by adding these
addresses to an access control list and denying access to the service. Ensure that you list these IP addresses before
the network address in the list because the appliance applies permissions to the addresses in the order they are
listed. You can use the arrow keys to move the addresses up and down the list after you add them. For information
about how to create a named ACL, see Configuring Access Control on page 398.
To configure an access control list for a file distribution service:
1. From the Data Management tab, select the File Distribution tab -> Members tab -> member check box, and then
click the Edit icon.
2. In the Member File Distribution Properties editor, select a service tab: TFTP, FTP, or HTTP.

508 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing File Distribution Services

3. In the Allow these clients to perform file transfers section, select one of the following:
— For TFTP and FTP: None: Select this to deny any clients from using the TFTP and FTP file distribution services.
This is selected by default.
— For HTTP: Any: Select this to allow any clients to use the HTTP file distribution service. This is selected by
default.
— Named ACL: Select this and click Select Named ACL to select a named ACL that contains only IPv4
addresses and networks. File distribution does not support IPv6 addresses/networks and TSIG key based
ACEs. When you select this, the appliance allows clients that have the Allow permission in the named ACL
to use the file distribution service. You can click Clear to remove the selected named ACL.
— Set of ACEs: Select this to configure individual access control entries (ACEs). Click the Add icon and select
one of the following from the drop-down list. Depending on the item you select, Grid Manager either adds a
row for the selected item or expands the panel so you can specify additional information about the item you
are adding.
— IPv4 Address: Select this to add an IPv4 address. Click the Value field and enter the IP address. The
Permission column displays Allow by default. You can change it to Deny by clicking the field and
selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— Any Address/Network: For TFTP and FTP only. Select this to allow or deny access to all IPv4 addresses
and networks. The default permission is Allow, which means that the appliance allows access to and
from all IPv4 clients. You can change this to Deny to block access.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
4. Save the configuration and click Restart if it appears at the top of the screen.

Modifying Access Control Lists

1. From the Data Management tab, select the File Distribution tab -> Members tab -> member check box, and then
click the Edit icon.
2. In the Member File Distribution Properties editor, select the tab of the service to which the list belongs.
3. In the Allow file transfers from section, modify the fields as described in Configuring Access Control for File
Distribution on page 508.
You can also do the following:
• Add a new permission. For information, see Configuring Access Control for File Distribution on page 508.
• Delete a permission by selecting it and clicking the Delete icon.
• Reorder the list by selecting a permission and clicking an arrow next to the list to move the permission up or
down the list.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 509

File Distribution Services

Starting and Stopping File Distribution Services

You can enable and disable a file distribution service on a specific Grid member or on multiple members. You must
have read/write permission to the Grid members to start and stop a service on them.

Starting a service on a member:

1. From the Data Management tab, select the File Distribution tab -> Members tab -> member check box, and then
click the Start icon from the Toolbar. You can select multiple members by selecting their check boxes.
2. From the Start drop-down menu, select the service you want to start.
3. In the Start Service dialog box, click Yes.
Grid Manager enables the selected service on the selected member and displays the service status in the Status
column in the panel.

Stopping a service on a member:

1. From the Data Management tab, select the File Distribution tab -> Members tab -> member check box, and then
click the Stop icon from the Toolbar. You can select multiple members by selecting their check boxes.
2. From the Stop drop-down menu, select the service you want to stop.
3. In the Stop Service dialog box, click Yes.
Grid Manager disables the selected service on the selected member and displays the service status in the
Status column in the panel.

Note: When you start or stop a service, there may be a short delay before Grid Manager displays the correct status.

Monitoring File Distribution Services

To view the current status of the file distribution services:
1. From the Data Management tab, select the File Distribution tab -> Members tab.
2. Grid Manager displays the following information:
— Name: The name of the Grid member.
— Address: The IP address of the Grid member.
— Status: The overall status of the file distribution services running on the member. You can mouse over on
the field to view the status of each service. This field can display one of the following:
— Not Running: All the file distribution services are disabled.
— Running: One or more of the file distribution services are running properly.
— Warning: The services are functioning properly. However, there are some issues, such as storage space
has reached 90%, about the services.
— Error: One or more of the services have service issues.
— Comment: Information about the member.
— Site: The location to which the member belongs. This is one of the pre-defined extensible attributes.
You can sort the information in ascending or descending order by columns. You can also print and export the
information in this panel.

510 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Directories

Managing Directories
You can create directories on the Grid Master and on Grid members, in which you can store your files. You can manage
the directories in the following ways:
• Create a directory structure for file distribution, as described in Adding Directories.
• Modify the directory name and permissions, as described in Modifying Directories on page 511.
• Create a Virtual TFTP root directory, as described in Creating a Virtual TFTP Root Directory on page 511.
• View the directories, as described in Viewing Directories From the Files Tab on page 512.

Adding Directories
To add a directory:
1. From the Data Management tab, select the File Distribution tab -> Files tab.
2. Click the parent directory link, and then click Add -> Directory from the Toolbar.
3. Grid Manager adds a new directory to the parent directory and gives it the default name NewDirectory.
You can modify the directory name and permissions, as described in Modifying Directories on page 511.

Modifying Directories
1. From the Data Management tab, select the File Distribution tab -> Files tab.
2. Select a directory check box and click the Edit icon.
3. The Directory editor provides the following tabs from which you can modify data:
— General: You can modify the directory name here, except for the Root directory.
— Virtual TFTP Root: You can add an IP Address, a Network or a Range of IP addresses to support VMware ESX
hosts who need different PXE boot images based on where they are in the network.
— Permissions: You can add or delete admin permissions in this tab. For information, see About
Administrative Permissions on page 195.
4. Save the configuration and click Restart if it appears at the top of the screen.
You can also select a directory and click the Delete icon to delete it.

Note: When you delete a directory, the appliance automatically removes all its contents in that directory.

Creating a Virtual TFTP Root Directory

This section describes how to create a Virtual TFTP root directory for a specific IP address, network, or range of IP
addresses. Note that Virtual TFTP root is supported only for file downloads, but not for file uploads using TFTP client.

Note: Root directory can not be a virtual TFTP root.

1. From the Data Management tab, select the File Distribution tab -> Files tab.
2. Select the directory check box and click the Edit icon.
3. In the Directory editor select Virtual TFTP Root. Click the Add icon and select one of the following:
— IP Address: This creates a virtual TFTP directory that the clients from a specified IP address will see as the
root directory.
— Network: This creates a virtual TFTP directory that the clients on a specified network will see as the root
directory.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 511

File Distribution Services

— Range: This creates a virtual TFTP directory that the clients in a specified range of IP addresses will see as
the root directory.
4. From the drop-down in the Member column, select the member on which to make the virtual TFTP root directory.
5. In the Address/Network column, enter a value:
— IP Address: Enter the IP address of the client that will have access to the virtual TFTP root directory. This IP
address must be on the allow list in the TFTP access control list.
— Network: Enter a network address using the format 10.0.0.0/24. This allows all clients in that network to
access the virtual TFTP root directory. This network address must be on the allow list in the TFTP access
control list.
— Range: Enter the first IP address in the range Address/Network column, and the last IP address in the range
in the End column. This allows all clients in that range to access the virtual TFTP root directory. This range
must be on the allow list in the TFTP access control list.
6. Click Save & Close. Click Restart if it appears at the top of the screen.
7. To create more vIrtual TFTP root directories, repeat Steps 3 through 5.

Viewing Directories From the Files Tab

1. From the Data Management tab, select the File Distribution tab -> Files tab.
2. Grid Manager displays the following information in the Root directory.
— Name: The name of the directory or file.
— Type: Depending on the file type, this can be Directory or File.
— Size: The file size in B, KB, or MB depending on whether the file size crosses the unit limit or not. For
example, if the file size is 1023, Grid Manager displays 1023 B. If the file size is 1025, Grid Manager
displays 1 KB. For a directory, Grid Manager displays a dash (-).
— Date Modified: The timestamp when the directory was last created or when the file was last modified.
3. Click the directory link to view files and directories in a specific directory.
You can also do the following in this panel:
• Sort the information in ascending or descending order by columns.
• Use the breadcrumb to go to a specific directory.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Print and export the information in this panel.
• Add a directory or a file. For information, see Adding Directories on page 511 and Managing Files on page 513.
• Open and edit a directory. For information, see Modifying Directories on page 511.

512 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Files

Managing Files
This section describes how to upload files using the Grid Manager or a file transfer client. You can upload files to the
Grid Master or to individual members.

Uploading Files
Some things to keep in mind when you upload files:
• When you use the Grid Manager to upload files, you can upload files only to the Grid Master, not to
individual members of the Grid.
• To upload files to a member, you must use an FTP client, TFTP client or HTTP client. Files uploaded by file
transfer clients to any member, will be synchronized back to Grid Master.
• The logs for file transfers using third party clients can be found in syslog.
• You can use a third party file transfer client to upload and retrieve files:
— If the ‘anonymous’ login is enabled, you can retrieve files but this ‘anonymous’ user can not upload
files even if the “Allow uploads” option is enabled.
— If you create a user to use with a third party transfer client, this must be an FTP user with read/write
permissions in their directory.
• You can upload a maximum of 10,000 files.
• If uploading the file exceeds the storage limit, the appliance logs a message and does not upload the file.
For information about file distribution storage, see Modifying File Distribution Storage Limits on page 506.
• If you upload a file that has the same name and path as an existing file, the appliance automatically
replaces the old file.

Note: Administrators with superuser privileges can manage uploading files. Limited-access admins with read/write
permissions to specific directories can upload files to the directories. For information, see Administrative
Permissions for File Distribution Services on page 262.

Enabling Upload to Grid Members

1. From the Data Management tab, select Grid File Distribution Properties on the toolbar.
2. In the Grid File Distribution Properties dialog box, select the Allow Upload to Grid Members check box.
3. Click Save & Close.

Uploading Files using Grid Manager

The Grid Manager uploads files only to the Grid Master. The Grid Master propagates the files to the members. You
must use a third party file transfer client to upload files directly to an individual member:
— If the ‘anonymous’ login is enabled, you can retrieve files but this ‘anonymous’ user can not upload
files even if the “Allow uploads” option is enabled.
— If you create a user to use with a third party transfer client, this must be an FTP user with read/write
permissions in their directory.
1. From the Data Management tab, select the File Distribution tab -> Files tab.
2. Select the destination directory link.
3. Click the Add icon -> File from the Toolbar.
4. Select the Extract files after upload (.zip, .tar, .gz, .tgz) check box in the Upload dialog box if you are uploading
.zip, .tar, .gz, or.tgz files and you want to automatically extract the files upon upload.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 513

File Distribution Services

Note: The directory structure in the compressed file is restored when the files are extracted. A directory that already
exists it will be replaced by an extracted directory with the same name.

5. Click Select to navigate to the file you want to upload.

6. Select the file you want to upload, and then click Open.
7. If you want to upload more than one file, repeat Steps 4 and 6 until you have selected all the files you want to
upload. You can upload a maximum of ten files at one time.

Note: You can delete an incorrect file selection by clicking the red icon next to the filename before you click Upload

8. To verify the upload was successful. roll the mouse cursor over the green check mark next to the file name. If the
upload was successful, the message “Upload succeeded.” appears.

Uploading Files Using TFTP, FTP, or HTTP File Transfer Client

You can upload files to the Grid Master or to individual members using a third party FTP client. Files uploaded by file
transfer clients to any member, will be synchronized back to Grid Master.
To upload files to a member, you must first enable the Allow Upload to Grid Members check box in the Grid File
Distribution Properties dialog box. See Enabling Upload to Grid Members on page 513.
You must add an FTP user before you can upload files using a third party FTP client. This must be an FTP user. It is not
the NIOS admin. For information see Adding FTP Users through Grid Manager on page 517.

Deleting Files From the Grid Master

If the FTP user has read/write permissions, then that user can delete files from the Grid member wherever that FTP
user is connected. Only files can be deleted but not directories.
1. From the Data Management tab, select the File Distribution tab -> Files tab.
2. Grid Manager displays the files and folders in the Root directory. Click the directory link to see the files in a
specific directory.
3. To delete a file, select the check box and then click the Delete icon.

Deleting Files From a Member

You can delete files from a member only if “No” appears in the Synchronized with Grid Master column.
If the FTP user has Read/Write permissions, then that user can delete files from the Grid member wherever that FTP
user is connected. Only files can be deleted but not directories.
1. From the Data Management tab, select the File Distribution tab -> Files tab.
2. Grid Manager displays the files and folders in the Root directory. Click the directory link to see the files in a
specific directory.
3. If “No” appears in the Synchronized with Grid Master column, select the check box, then click the Delete icon.

514 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Files

Viewing Files
You can view files from the Files Tab and from the Members Tab.

Viewing Files from the Files Tab

1. From the Data Management tab, select the File Distribution tab -> Files tab.
2. Grid Manager displays the following information in the Root directory.
— Name: The name of the file.
— Type: Depending on the file type, this can be Directory or File.
— Size: The file size in B, KB, or MB depending on whether the file size crosses the unit limit or not. For
example, if the file size is 1023, Grid Manager displays 1023 B. If the file size is 1025, Grid Manager
displays 1 KB. For a directory, Grid Manager displays a dash (-).
— Date Modified: The timestamp when the directory was last created or when the file was last modified.
You can view files and directories in a specific directory by clicking the directory link.

Viewing Files from the Members Tab

1. From the Data Management tab, select the File Distribution tab -> Members tab.
2. Grid Manager displays the following information in the Root directory.
— Name: Member name.
— IPv4 Address: Member's IP address.
— Status: State of the member, running or not running.
— Comment: Additional comments about the member.
— Site: User defined information about the site.
3. To see the files on the Grid Master, click on the name of the Grid Master. Grid Manager displays the following
information:
— Name: The name of the file.
— Type: Depending on the file type, this can be Directory or File.
— Size: The file size in B, KB, or MB depending on whether the file size crosses the unit limit or not. For
example, if the file size is 1023, Grid Manager displays 1023 B. If the file size is 1025, Grid Manager
displays 1 KB. For a directory, Grid Manager displays a dash (-).
— Date Modified: The timestamp when the directory was last created or when the file was last modified.

Tip: When you drill down on the Grid Master from the Members tab, the Add icon is activated.

4. To see the files on a member, click on the name of the member. Grid Manager displays the following information:
— Name: The name of the file.
— Type: Depending on the file type, this can be Directory or File.
— Size: The file size in B, KB, or MB depending on whether the file size crosses the unit limit or not. For
example, if the file size is 1023, Grid Manager displays 1023 B. If the file size is 1025, Grid Manager
displays 1 KB. For a directory, Grid Manager displays a dash (-).
— Date Modified: The timestamp when the directory was last created or when the file was last modified.
— Synced with Grid Master: You cannot delete files with a value other than “No”. If this value is “No”, you
must delete the file.

Note: You cannot upload, modify, or delete a file or a directory when you drill down from the Members tab.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 515

File Distribution Services

You can also do the following in this panel:

• Sort the information in ascending or descending order by columns.
• Use the breadcrumb to go to a specific directory.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Print and export the information in this panel.
• Add a directory or a file. For information, see Adding Directories on page 511 and Managing Files on page 513.
• Open and edit a directory. For information, see Modifying Directories on page 511.
• You can enable “group by” function to organize your members in a meaningful way and quickly identify them
based on common data. Complete the following to group members with the same extensible attribute value:
— Group Results: Select this check box to enable the appliance to group members by extensible attributes.
— Group By: From the drop-down list, select the first extensible attribute that you want the appliance to use
for filtering members.
Grid Manager displays data per group of members configured with the same extensible attribute value. For
more information about grouping by extensible attributes, see Grouping Members by Extensible Attributes
on page 303.

Managing Users
This section describes how to add and modify user accounts for use with an FTP client.
You must be a NIOS admin user with super user privileges to add, modify, or delete FTP users. FTP users are created
at Grid level, so the same users will be available to access FTP service on all members.
— Each user must have unique Username.
— By default, the home directory with the user name is under the /ftpusers directory. However, the user can
also choose to use an existing directory outside of /ftpusers as his home directory. If the admin specified
home directory is not available then it will raise an error.
— Permission: Read-write or Read-only are assigned for each FTP user. Users with read-write permissions are
allowed to upload files, delete files and list the files and directories under his home directory.
— You can have multiple users to use same home directory. One user may have read-only permissions while
others have read-write permissions on same home directory.
— FTP users are not allowed to add, modify, or delete the directories, even with read-write permissions.
— If the "Allow uploads on the member" is disabled, then users with read-write permission also can not
upload files to his home directory.

Users Default Home Directory

— FTP users default home directory is /ftpusers.
— The /ftpusers directory is created by default and listed in the 'Files' viewer under the root directory.By
default, home directories for FTP users are under this directory.
— NIOS admin is allowed to upload and delete files to and from users home directories.
— Files uploaded by FTP users are visible in the Grid Manager.

516 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Users

Adding FTP Users through Grid Manager

1. From the Data Management tab, select the File Distribution tab -> FTP Users tab, and then click the Add icon.
2. In the Add FTP User dialog box, complete the following:
— Username: Enter a name for the user. This is the username that the user uses to log in.
— Password: Enter a password for the user to use when logging in.
— Confirm Password: Enter the same password.
— Permissions: From the drop down choose from the following:
— Read Only: This allows the user to display files, but not to upload, or delete files using a third party FTP
client.
— Read/Write: This allows the user to upload, delete and list files using a third party FTP client.
— Choose a directory for this user. This is the directory where files uploaded with this Username will go:
— Create Home DIrectory: This creates a directory using the Username.
— Choose Specified Directory: This allows the user to choose an existing directory.
3. Click Save & Close.

Adding FTP Users through CSV Import

You can add an FTP User by importing a CSV file with the headers in the following format:
version 1.0,,,,
header-ftpuser,username*,password*,create_home_dir,home_dir,permission
ftpuser,user1,passwd1,True,/ftpusers/user1,RO

Modifying FTP Users

1. From the Data Management tab, select the File Distribution tab -> FTP Users tab.
2. Select the check box for the user you want to modify and click the Edit icon.
3. In the FTP User Editor you can modify the following:
— Password: Enter a password for the user to use when logging in.
— Confirm Password: Enter the same password.
— Permissions: From the drop down choose from the following:
— Read Only: This allows the user to display the files and their properties, but not to edit them.
— Read/Write: This allows the user to display and edit the files and their properties.
4. Click Save & Close.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 517

File Distribution Services

518 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 10 Managing NIOS Software and
Configuration Files
This chapter explains how to manage upgrade groups and perform software upgrades and downgrades for NIOS
appliances. It also describes how to back up and restore configuration files. It includes the following sections:
• About Upgrades on page 521
— Lite Upgrades on page 521
— Full Upgrades on page 522
— Guidelines for Scheduling Full Upgrades on page 522
— Microsoft Management Rules on page 524
• Managing Upgrade Groups on page 524
— Adding Upgrade Groups on page 525
— Modifying Upgrade Groups on page 526
— Viewing Upgrade Groups on page 526
— Deleting Upgrade Groups on page 527
• Viewing Software Versions on page 527
• Upgrading NIOS Software on page 527
— Uploading NIOS Software on page 528
— Distributing Software Upgrade Files on page 528
— Managing Distributions on page 530
— Testing Software Upgrades on page 531
— Performing Software Upgrades on page 532
— Managing Upgrades on page 536
— Monitoring Distribution and Upgrade Status on page 537
• Downgrading Software on page 538
• Reverting the Grid to the Previously Running Software on page 539
• Applying Hotfixes on page 539
• Backing Up and Restoring Configuration Files on page 540
— Backing Up Files on page 541
— Automatically Backing Up Data Files on page 542
— Manually Backing Up Data Files on page 544
— Downloading Backup Files on page 545
— Restoring Backup Files on page 545

NIOS 7.3 NIOS Administrator Guide (Rev. A) 519

Managing NIOS Software and Configuration Files

— Downloading Backup Files from a Different Appliance on page 546

• Downloading Support Bundles on page 547

520 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Upgrades

About Upgrades
Infoblox frequently releases updated NIOS software. Contact Infoblox Technical Support to learn which file name to
use when downloading a new upgrade file, or watch your email for periodic notifications that a new software upgrade
is available. To get the latest upgrade, your local network must be capable of downloading a file from the Internet. For
information about how to upgrade, see Upgrading NIOS Software on page 527.
You can upgrade an appliance to a specific release if the current release on your appliance supports the upgrade
path. For information about the upgrade and revert paths of a specific release, refer to the latest release notes at
https://support.infoblox.com. Depending on whether there are database schema changes between the existing and
upgrade releases, the appliance can perform either a lite or full upgrade. For information, see Lite Upgrades and Full
Upgrades.
You can schedule certain upgrades for a Grid. Scheduling an upgrade can minimize network and operational outages,
especially when Grid members are spanned across different time zones. You can also arrange the upgrade to happen
during non-peak hours for specific members to avoid overloading the network traffic. When you schedule an upgrade,
you can schedule to update all Grid members at the same time or at different times. Depending on the configuration
of your Grid and the software version that is currently running in the Grid, you can also schedule your upgrades for
different members over a period of time. For more information, see Scheduling Upgrades on page 532.
Based on your network requirements and topology, you can organize your members into upgrade groups so these
members can be upgraded at the same time. For more information about upgrade groups, see Managing Upgrade
Groups on page 524.
You can also import and export upgrade groups and their distribution and upgrade schedules in CSV format. For
information about how to import and export in CSV format, see About CSV Import on page 101 and Exporting Data
to Files on page 108.

Note: When you promote a Grid Master candidate to a Grid Master, you cannot revert to the previous release. Also,
your login username cannot contain any uppercase letters (A to Z), otherwise an upgrade will fail.

Lite Upgrades
A lite upgrade occurs when there are incremental changes to the software that do not require any upgrade to the
database. The appliance can perform a lite upgrade only if the format of the database between the existing NIOS
version and the upgrade version is the same.
In general, when you upgrade from a patch release to another patch release, you are performing a lite upgrade. In a
lite upgrade, members can be running a different software version than the Grid Master. You can add objects, such
as zones, networks, and resource records to the members that are running an older NIOS version. Replication of
zones, networks, resource records, and DHCP leases is supported between the Grid Master and members. When you
want to revert a member however, you must revert the entire Grid.
Whenever possible, the appliance uses the lite upgrade mode to speed up the upgrade process. You can always
schedule a lite upgrade. Note that the appliance disables the testing function for lite upgrades because you do not
need to test a lite upgrade for any database translation. For information about how to schedule an upgrade, see
Scheduling Upgrades on page 532.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 521

Managing NIOS Software and Configuration Files

Full Upgrades
A full upgrade occurs when there are database schema changes between the existing and upgrade releases. In
general, when you upgrade to a major release, you are performing a full upgrade. Depending on the upgrade and
revert paths that your existing release supports, you may or may not be able to schedule a full upgrade. A full upgrade
that cannot be scheduled does not allow for data replication between the Grid Master and members. For information
about supported upgrade and revert paths, refer to the latest release notes on the Infoblox Support site.
Depending on the upgrade paths your current release supports, when you schedule a full upgrade, the Grid Master
immediately replicates certain core network service tasks to Grid members while putting other tasks in queue until
the members have been upgraded. For information about which data and tasks the Grid Master replicates to
members immediately, see Guidelines for Scheduling Full Upgrades on page 522. For information about how to
schedule an upgrade, see Scheduling Upgrades on page 532.

Guidelines for Scheduling Full Upgrades

When you schedule a full upgrade from NIOS 6.6.x or later to a later release, the Grid Master immediately replicates
the following to the Grid members, including those that have not been upgraded:
DNS resource records, DNS zones, DNS views, name server groups, shared record groups, IPv4 and IPv6 host
addresses, roaming hosts, IPv4 and IPv6 networks, IPv4 and IPv6 shared networks, fixed addresses, DHCP ranges,
DHCP failover association, DHCP option spaces, DHCP options, DHCP filters, MAC filter items, blacklist & NXDOMAIN
rules, DNSSEC key pairs, DNSSEC import keyset operation, sign and unsign zones, DNSSEC rollover KSK and ZSK
operations.
You can also perform the following tasks:
• Upgrade a specific member during the scheduled Grid upgrade. For information about how to upgrade a single
member during a scheduled Grid upgrade, see Upgrading a Single Member Immediately on page 534.
• Revert a single member that has already been upgraded so you can troubleshoot issues, such as service
outages, on the specific member. You can then reschedule its upgrade. For more information, see Reverting a
Single Member on page 534.
• During an upgrade, you can start, stop, or restart DNS and DHCP services through Grid Manager on members
that have not been upgraded.
• Clear authentication cache and authentication records.
• Perform AD (Active Directory) configurations. Note that you must upload the keytab file before the upgrade
starts.
The appliance also puts certain rules in place to ensure data integrity and controls data that can cause undesirable
results during the upgrade process. When you schedule a full upgrade from NIOS 6.6.x or later to a later release, the
following rules apply:
• You cannot modify member properties for the following: DNS, DHCP, TFTP/HTTP/FTP, bloxTools, Captive Portal,
Reporting, and load balancing until the member has completed the upgrade and exited its revert time windows.
• You cannot delete DNS views.
• You cannot delete DNS zones and IPv4 and IPv6 networks that are under Microsoft Management until the
managing member of the Microsoft servers has completed its upgrade and exited its revert time window.
Certain Microsoft management restrictions also apply, as described in Managing Upgrade Groups on page 524.
• Synchronization between load balancers and the appliance is disabled until the load balancer managing
member has completed its upgrade and exited its revert time window. You cannot change the managing
member during the upgrade.
• You cannot add, modify, or delete network views, rulesets, and DNS64 synthesis groups.
• Replication of Grid and member DNS and DHCP properties is not supported.
• You can create named ACLs (access control lists) only after the entire Grid has been upgraded. For information
about named ACLs, see Configuring Access Control on page 398.

522 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Guidelines for Scheduling Full Upgrades

Note that during a scheduled full upgrade, you cannot perform the following tasks on a Grid member that has not
been upgraded yet:
• Import the DHCP lease history file
• Use the DHCP expert mode configuration feature
• Clear the NAC authentication cache of a DHCP member
• Set the time zone for a Grid member
• View the capacity report of a Grid member
• Test the email configuration settings of a Grid member
• Check whether an IPv6 address is already configured on a Grid member
When you schedule a full upgrade from a previous NIOS release to a release that includes the DHCP fingerprint
detection feature, the following rules apply until the entire Grid has been upgraded:
• DHCP fingerprint detection is disabled
• You cannot add DHCP fingerprint filters
• You cannot apply DHCP fingerprint filters to any DHCP address range
When you schedule a full upgrade from a previous NIOS release to a release that includes the multi-primary zone
feature, the following rules apply until the entire Grid has been upgraded:
• You cannot configure multiple primary servers for an authoritative zone or configure a name server group that
contains multiple primary servers.
• You cannot assign or unassign a Grid member to an authoritative zone or name server group.
• You cannot change the stealth state of an authoritative zone or name server group.
When you schedule a full upgrade from a previous NIOS release to a release that includes the Infoblox Advanced
Protection feature, you cannot complete the following on a Grid member until the member has completed the
upgrade:
• Start or stop the Threat Protection and DNS services.
• Activate a ruleset.
• Perform any threat protection related tasks such as adding custom rules and activating rulesets.
Before scheduling a full upgrade from a previous NIOS release to a release that includes the IPv6 Grid feature, the
following rules apply:
• If the Grid has an HA Master or HA member and if it is configured with IPv6 VIP address, you must configure IPv6
addresses for both node 1 and node 2.
• Both the Grid Master and the Grid Master Candidate should have the same type of network connectivity.
• You have to back up the current configuration and database.
When you schedule a full upgrade from a previous release to NIOS 7.2.x and later, the following rules apply until the
entire Grid has been upgraded:
• You cannot add, modify, or delete an NS group.
• You cannot add, modify, or delete manually created NS records.
• You cannot add, modify, or delete a zone.
• You cannot assign or unassign an NS group to a zone.
• You cannot change the NS group assigned to a zone.
• You cannot change the host name of the Grid member that is assigned to a zone.
• You cannot start or stop the DNS service.
• You cannot restart or schedule a restart for the DNS and DHCP services on the Grid members, except the Default
restart group. For more information, see Restarting Groups on page 500.
Note that when you schedule a full upgrade from a previous release to NIOS 7.2.x and later, you must not modify the
settings for automated mitigation of phantom domain attacks using the CLI commands on a Grid member until the
member has completed the upgrade. Otherwise, the changes made during the upgrade may get lost.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 523

Managing NIOS Software and Configuration Files

When you schedule a full upgrade from a previous NIOS release to NIOS 7.3.x or later that includes the DNS Traffic
Control feature, the following rules apply until the entire Grid has been upgraded:
• You cannot add an SNMP health monitor.
• You cannot configure the All available load balancing method for a DTC pool.
• The record types are reset to default record types (A and AAAA records) and you cannot modify the record types
for an LBDN.
Note that when you schedule a full upgrade for a Grid which includes members that support Infoblox External DNS
Security and Infoblox Internal Security from a previous NIOS release to NIOS 7.3.x or later, the Threat Protection
Statistics widget in the Dashboard is replaced by the Threat Protection Status for Member widget. For information
about the Threat Protection Status for Member widget, see Threat Protection Status for Member on page 166.

Microsoft Management Rules

On a member that synchronizes data with Microsoft DNS and DHCP servers, the following functions are deactivated
during an upgrade:
• Synchronization of Microsoft DNS and DHCP data
• Rotation of Microsoft logs
• Start and stop of Microsoft servers
• Releases of DHCP leases from a Microsoft DHCP server

Note: Note that the deactivation of these functions does not affect any data on the Microsoft servers. After the
upgrade, the member automatically restarts the synchronization of Microsoft data.

On a member that synchronizes data with Microsoft DNS and DHCP servers, the following rules apply:
• You cannot modify the managing member if the old and new members have not been upgraded and have not
exited their revert time windows.
• You cannot add, modify, or delete zones, IPv4 DHCP ranges, and IPv4 networks until the managing member has
been upgraded and exits the revert time window.
• You cannot add, modify, or delete DNS resource records if the associated zone is managed by a Microsoft server
and the managing member is still in its revert time window.
• You cannot add, modify, or delete fixed addresses that are assigned to a Microsoft server and the managing
member is still in its revert time window.
• You must wait until the new managing member is upgraded to configure it as a DNS primary or secondary.

Managing Upgrade Groups

To minimize the impact of Grid upgrades on your system operations, you can organize members into upgrade groups
and schedule their software distributions. This is useful, for example, in a large Grid spanning multiple time zones
where there are fluctuating network and downtime considerations at various locations. Note that you can also
schedule their upgrades, depending on the existing releases and their upgrade paths. For information about the
different upgrade methods, see About Upgrades on page 521.
You can also import and export upgrade groups and their schedules in CSV format. For more information, refer to the
Infoblox CSV Import Reference.
Infoblox provides two default upgrade groups:
• Grid Master —After you configure the Grid Master, it automatically becomes the only member of this group. You
cannot modify or delete this group.

524 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Upgrade Groups

• Reporting Member —After you configure a reporting member in a Grid, it automatically becomes the only
member of this group. This group will be upgraded automatically after the Grid Master and before other upgrade
groups. You cannot modify, delete, or schedule this upgrade group. For information about reporting, see
Infoblox Reporting and Analytics on page 1379.
• Default—This is the default upgrade group to which the appliance automatically assigns Grid members. If you
do not explicitly assign a member to an upgrade group, it remains in the Default group. You cannot delete or
rename this group. For information, see Modifying Upgrade Groups on page 526.
Grid Manager provides information about the upgrade group to which a member belongs. You can add or delete an
upgrade group and monitor the software version that is currently running on the Grid and on individual member. You
can do the following:
• Add an upgrade group, as described in Adding Upgrade Groups.
• Modify an upgrade group, as described in Modifying Upgrade Groups on page 526.
• View upgrade group information, as described in Viewing Upgrade Groups on page 526.
• Delete an upgrade group, as described in Deleting Upgrade Groups on page 527.

Adding Upgrade Groups

When you create an upgrade group, you select the Grid members for that group, and specify whether the software
distribution and upgrade occur on all group members at the same time, or successively in the order they are listed in
the group members list. A Grid member can belong to only one upgrade group.

Note: The appliance displays a warning message when you create an upgrade group that includes the two peers of
a DHCP failover association. Infoblox recommends that you assign DHCP failover peers to separate upgrade
groups to minimize the risk of a loss in DHCP services. For example, if DHCP failover peers are in the same
upgrade group and its members upgrade simultaneously, the upgrade causes a loss in DHCP services.

Note the following recommendations when you create an upgrade group:

• Put the following members in the first upgrade group after the Grid Master upgrade: all Grid Master candidates,
DNS primaries, and the DHCP logging member.
• To minimize the risk of a loss in DNS services, put the name servers for a zone in different upgrade groups, and
assign the primary and secondary servers to separate upgrade groups.
To add an upgrade group:
1. From the Grid tab, select the Upgrade tab.
2. Click Toggle Group List View to display the list of upgrade groups, and then click the Add icon.
3. In the Add Upgrade Group wizard, complete the following:
— Name: Enter a name for the upgrade group. The name can contain alphanumeric characters, spaces,
underscores, hyphens, and dashes.
— Distribute to Members: Select one of the following to specify how the Grid Master distributes software to
the members in the group.
— Simultaneously: Select this to distribute software upgrade files to all group members at the same time.
— Sequentially: Select this to distribute software upgrade files to group members in the order they are
listed in the group members list.
— Upgrade Members: Select one of the following to specify how the group members upgrade to the new
software version.
— Simultaneously: Select this to upgrade all group members at the same time.
— Sequentially: Select this to upgrade group members in the order they are listed in the group members
list.
— Comment: Enter useful information about the upgrade group, such as the location of the group.
4. Click Next to select members for the group. Complete the following:
— Click the Add icon. Grid Manager adds a row to the Member Assignment table.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 525

Managing NIOS Software and Configuration Files

— Click Select. In the Member Selector dialog box, select the members you want to add to the group, and then
click the Select icon. Use Shift+click and Ctrl+click to select multiple members. Note that if you choose to
distribute and upgrade members sequentially, the distribution and upgrade occur in the order the members
are listed. You can reorder the list by dragging a member to a desired location or by selecting a member and
using the up and down arrows next to the check box to place the member at a desired location. You can also
delete a member from the list.

Note: After you add a member, the appliance adds it to the group members list. The first Grid member in the list
determines the time zone of the group when you schedule the distribution and upgrade. Therefore, Grid
Manager displays the time zone of the first Grid member in the list. (For information about setting time
zones, see Managing Time Settings on page 404.)

5. Save the configuration and click Restart if it appears at the top of the screen.

Modifying Upgrade Groups

You can modify an existing upgrade group to change the group name or how the distribution and upgrade are
performed. You can also add and delete members.
To modify an upgrade group:
1. From the Grid tab, select the Upgrade tab, and then click Toggle Group List View.
2. Select an upgrade_group check box, and then click the Edit icon in the row. You can also click the Edit icon
directly without selecting the check box.
3. The Upgrade Group editor provides the following tabs from which you can modify data:
— General: Modify the fields as described in Adding Upgrade Groups on page 525.
— Member Assignment: Add or delete members as described in Adding Upgrade Groups on page 525.
4. Save the configuration and click Restart if it appears at the top of the screen.

Viewing Upgrade Groups

In the Upgrade tab, Grid Manager lists the Grid Master group, the Default group, and other upgrade groups you have
configured. You cannot modify or delete the Grid Master group. You can modify the Default group, but you cannot
delete it. To view the members in a specific upgrade group, click the arrow next to the group name to expand the
group. All groups are collapsed by default.
Before a distribution or upgrade starts, you can move members from one group to another, reorder the members, or
remove a member from an upgrade group. The member you remove automatically joins the Default group. (For
information, see Managing Distributions on page 530.) You cannot add, delete, or reorder members in an upgrade
group while a distribution or upgrade is in progress. You can skip a member in an upgrade group from a distribution
only before the distribution starts, or after you pause it. For information, see Pausing and Resuming Distributions on
page 530.
To view the upgrade groups in a Grid:
1. From the Grid tab, select the Upgrade tab, and then click Toggle Group List View.
Grid Manager displays the Grid Master at the top of the list. All other upgrade groups are listed alphabetically
after the Grid Master. You can click the arrow next to a group to view members in the group.
2. Grid Manager displays the following:
— Group: The name of an upgrade group to which the member belongs.
— Member: The name of the member.
— Status: Displays the overall status of an upgrade group at the group level and individual status for each
member when you expand the upgrade group. At the group level, this displays the most severe status
among the members. For example, when there are three out of five members are offline, the overall status
shows 3 of 5 members in red, which means offline.
— IP Address: The IP address of the member.

526 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Software Versions

— Running Version: The NIOS software version that is currently running on the member.
— Distribution Status: The distribution status of the group.
— Timestamp: The date, time, and time zone when a distribution or upgrade is complete.
You can hide some of the default columns, but you cannot sort the information in this table. You can use filters and
the Go to function to narrow down the list. With the autocomplete feature, you can just enter the first few characters
of an object name in the Go to field and select the object from the possible matches. You can also create a quick filter
to save frequently used filter criteria. For information, see Using Quick Filters on page 77.

Deleting Upgrade Groups

When you delete an upgrade group, members in the upgrade group that you want to delete will be moved to the
Default group. Grid Manager displays a warning before deleting an upgrade group.
To delete an upgrade group:
1. From the Grid tab, select the Upgrade tab, and then click Toggle Group List View.
2. Select an upgrade-group check box, and then click the Delete icon.
3. In the Delete Confirmation dialog box, click Yes.

Viewing Software Versions

Before you upgrade, downgrade, or revert to a different NIOS software version, you can view the current software
version that is running on the Grid, the NIOS image you have uploaded, and the available version to which you can
revert. Grid Manager displays the software information in the Upgrade tab.
To view software information:
1. From the Grid tab, select the Upgrade tab.
2. Grid Manager displays the following in the Grid Version Information section:
— Running: The NIOS software version that is currently running on the Grid.
— Uploaded: The latest NIOS image file you have uploaded and is available for distribution.
— Distribution: The NIOS software version used for distribution or is available for distribution.
— Revert: The NIOS software version to which the appliance can revert.
— Distribution Schedule: Displays the date and time of the next scheduled distribution.
— Upgrade Schedule: Displays the date and time of the next scheduled upgrade.

Note: Grid Manager leaves a field empty when there is no available software for the specific function.

Grid Manager automatically refreshes the Upgrade tab with the latest information and displays the timestamp in the
Last Updated field below the Grid Version Information section.

Upgrading NIOS Software

Infoblox frequently releases updated NIOS software. Contact Infoblox Technical Support to learn which file name to
use when downloading a new upgrade file, or watch your email for periodic notifications that a new software upgrade
is available. To get the latest upgrade, your local network must be capable of downloading a file from the Internet.
After you download and store the new upgrade file on your local network, complete the following tasks to upgrade an
Infoblox independent appliance or a Grid.
• Upload the new software to the Grid Master, as described in Uploading NIOS Software.
• Distribute the software upgrade files, as described in Distributing Software Upgrade Files on page 528.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 527

Managing NIOS Software and Configuration Files

• Optionally, test the upgrade, as described in Testing Software Upgrades on page 531.
• Perform the software upgrade, as described in Performing Software Upgrades on page 532.
Before upgrading, Infoblox recommends that all members in the Grid be connected to the network and operating
normally. If one or more members are offline when you upgrade the Grid, they automatically receive the distributed
software and upgrade when they join the Grid or come back online.

Note: You cannot upgrade directly to NIOS 5.x from NIOS releases less than 4.2r4. Refer to the release notes for the
appropriate upgrade and revert paths.

Before you upgrade to a later NIOS release, use the show upgrade_compatible command to check if your Grid is
compatible with the release. For information about using this command, refer to the Infoblox CLI Guide.

Caution: Do not attempt to add or remove a member, or convert an HA pair to single members or vice versa during a
distribution or upgrade.

When you upgrade from NIOS 6.4.0 to a later release, you can start, stop, or restart DNS and DHCP services, or only
the DHCP service on a member that has not been upgraded. When you start, stop, or restart other services, such as
reporting or file distribution, the operation is put in queue for execution until after the targeted member has been
upgraded.

Uploading NIOS Software

After you download the NIOS software upgrade to your management station, upload it to the Grid Master, as follows:
1. From the Grid tab, select the Upgrade tab, and then click Upload in the panel or from the Toolbar.
2. Navigate to the directory where you have stored the NIOS software upgrade, and then click Open or Upload.
The appliance uploads the file and displays the status of the upload in the status bar. You can click the Stop
icon in the status bar to stop the upload. Ensure that you do not navigate away from the Upgrade tab until after
the upload is complete. Otherwise, the upload process stops.

Note: When you upload the NIOS software upgrade to an HA Grid Master, only the active node receives the software.
The passive node does not. Therefore, if the Grid Master fails over before a distribution starts, you must upload
the software again. If you do not, the distribution fails because the new active node does not have the
uploaded software.

Distributing Software Upgrade Files

Distributing the software upgrade files involves unpacking the software files and loading the new software. When you
perform a distribution, the NIOS appliance loads the new software code into an alternate disk partition, which
overwrites any previously saved version of code that is already there. Therefore starting the distribution disables the
appliance from reverting to a release prior to the current version.
The time this process takes depends on the number of appliances to which the software is distributed; the more
appliances, the longer it takes. Therefore, you might want to schedule the Grid distribution during times when your
network is less busy. You can distribute the software immediately or schedule the distribution of any software
upgrade file, even if it is not Upgrade Lite compatible.

Distributing Software Immediately

The Grid Master distributes the software upgrade to each member in the Grid, including itself. As an alternative to
scheduling the Grid distribution (see Scheduling Distributions on page 529), you can distribute the software upgrade
throughout the Grid immediately, as follows:
1. From the Grid tab, select the Upgrade tab, and then click Distribute -> Distribute Now from the Toolbar.
2. In the confirmation dialog box, click Yes to start the distribution.

528 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Upgrading NIOS Software

The distribution starts and if there is an active distribution scheduled, the appliance changes its status to
inactive. The appliance distributes the upgrade files and displays the status of the distribution in the status bar.
You can pause, resume, or stop the distribution by clicking the corresponding icon in the status bar. For
information, see Managing Distributions on page 530.
Note that starting a manual distribution cancels a scheduled distribution.

Scheduling Distributions
When you schedule a distribution, you schedule the distribution of the Grid Master as well as the upgrade groups,
including the Default group. The Grid Master distribution must always occur before the distribution of the upgrade
groups.
To schedule a software distribution:
1. From the Grid tab, select the Upgrade tab, and then click Distribute -> Schedule Distribution from the Toolbar.
2. In the Schedule Distribution editor, complete the following:
— Activate Distribution Schedule: Select this to enable the distribution schedule. Clear this if you are creating
a distribution schedule you plan to activate at a later date. You can configure and save information in this
editor even when you deactivate a scheduled distribution.
— Grid Master Distribution Start Information: Enter a Grid Master distribution date, time, and time zone. The
distribution date and time must be before those of the upgrade groups.
— Date: Enter a start date of the Grid Master distribution in YYYY-MM-DD (year-month-day) format. You
can click the calendar icon to select a date from the calendar widget.
— Time: Enter a start time of the Grid Master distribution in hh:mm:ss AM/PM (hour:minute:second in AM
or PM) format. You can also select a time from the drop-down list.
— Time Zone: Select a time zone that applies to the start time you enter. If this time zone is different from
the Grid time zone, the appliance converts the time you enter here based on the Grid time zone, after
you save this schedule. When you display this schedule again, it displays the converted time. Selecting
the time zone here does not affect any time zone settings in the Grid. (For information about selecting
the Grid and member time zones, see Managing Time Settings on page 404.)
— Admin Local Time: Displays the Grid Master distribution start date and time in the time zone of the
administrator, as explained in Creating Local Admins on page 208.
— In the upgrade group table, specify the following for each upgrade group by clicking the corresponding field
in each row:
— Start Distribution: Specify when the distribution occurs. Select one of the following from the drop-down
list:
• Date/Time: Select this to configure the distribution start date, time, and time zone.
• After <group>: Select After Grid Master to start the distribution immediately after the completion of
the Grid Master distribution. Select an upgrade group that must complete its distribution before
the group you are configuring. When you select this option, you cannot enter a date, time, and time
zone.
Date, Time, and Time Zone are enabled only when you select Date/Time for Start Distribution.
— Date: Enter a distribution start date in YYYY-MM-DD (year-month-day) format. You can click the calendar
icon to select a date from the calendar widget.
— Time: Enter a distribution start time in hh:mm:ss AM/PM (hour:minute:second in AM or PM) format. You
can select a time from the drop-down list.
— Time Zone: By default, the appliance displays the time zone of the first Grid member in the Upgrade
Group. You can change this time zone if you want to enter the time using a different time zone. After you
save the schedule though, the appliance converts the time you entered to the time zone of the upgrade
group, if it is different. (For information about setting the Grid and member time zones, see Managing
Time Settings on page 404.) To change the default time zone of the upgrade group, change the time
zone of the first group member, as explained in Adding Upgrade Groups on page 525.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 529

Managing NIOS Software and Configuration Files

— Admin Local Time: Displays the start date and time in the time zone of the administrator, as explained
in Creating Local Admins on page 208.
— Distribute to Members: Indicates whether the distribution within the group occurs simultaneously or
sequentially. You cannot edit this field here. You define this when you create the upgrade group. To
change this setting, see Modifying Upgrade Groups on page 526.
3. Save the configuration and click Restart if it appears at the top of the screen.
Grid Manager confirms that the schedule is saved and indicates whether the distribution schedule is active. You
can click the Refresh icon to refresh the information in this panel.
Note that the appliance does not save the schedule and displays an error message if the schedule contains the
following:
— Circular dependencies between upgrade groups. For example, the distribution of Group A is scheduled after
Group B, and the distribution of Group B Is scheduled after Group A.
— The distribution time is in the past.

Software Distribution Process

The following series of events occur after a Grid distribution starts:
• The appliance checks if a NIOS software upgrade was uploaded.
— If the upgrade files are not uploaded, the distribution stops. The appliance displays an error message and if
the distribution is scheduled, the appliance deactivates the distribution schedule.
— If the upgrade files are uploaded, the distribution proceeds.
• A single Grid Master uploads the file to a backup partition and unpacks the contents, which overwrites any
existing backup software that might have been there. For an HA Grid Master, it is the active node that uploads
the file to a backup partition and unpacks the contents.
— The Grid Master (or active node of the HA Grid Master) sends a command to all nodes that are online to
copy their database and software to a backup software partition.
— For an HA Grid Master, the active node sends the command to the passive node as well.
— The nodes perform resynchronization on their backup partition, retrieving only the changed files from the
Grid Master.
— After the active node of an HA member receives the software, it then distributes it to the passive node.
When the distribution successfully completes, the appliance updates the distribution status and sets the schedule,
if configured, to inactive. The new software is now staged on all member appliances and is ready for use. Grid
Manager displays the software version in the Distribution field in the Grid Version Information section.

Managing Distributions
After you start a distribution, you can pause, resume, or stop it. For information, see Pausing and Resuming
Distributions on page 530 and Stopping Distributions on page 531. Grid Manager displays the status of the overall
distribution as well as the status of individual members. You can view this information in the Upgrade tab.

Pausing and Resuming Distributions

The following are some operational guidelines for performing a distribution:
• You cannot create new upgrade groups, add members to a group, or remove members from a group after a
distribution starts.
• You can skip a member that is currently offline from a distribution. When both nodes of an HA pair are online,
the skip member function is not available.
To pause a distribution:
1. From the Grid Distribution Status bar, click the Pause icon.
2. When the appliance displays a confirmation dialog box, click Yes to pause the distribution.

530 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Upgrading NIOS Software

The Grid Distribution Status bar indicates the distribution is paused. For information about the distribution status of
each member, see Monitoring Distribution and Upgrade Status on page 537.
To skip a member from a distribution:
1. From the Grid tab, click the Upgrade tab, and then click Toggle Member List View.
2. Select a member check box, and then click Skip Member from the Toolbar. Grid Manager automatically skips the
distribution of software to the members that are offline.
To resume a distribution:
1. From the Grid Distribution Status bar, click the Resume icon.
2. When the appliance displays a dialog box confirming that you want to resume the distribution, click Yes to
continue.
Members that have not completed or started distributions that were scheduled at an earlier time resume the
distribution.

Stopping Distributions
You can stop a distribution immediately, for example, if there are offline members and you do not want to wait for
them to come back online, or if you realize that you have uploaded the wrong software version. When you stop a
distribution, you can do the following:
• If the Grid Master has completed its distribution, you can upgrade the Grid immediately. This forces members
that do not have a complete distribution to synchronize their releases with the Grid Master.
• If the Grid Master does not have a valid distribution, you can restart the distribution.
• Upload another software upgrade.
Ending a distribution does not affect the upgrade schedule, if configured. The Grid upgrade starts as scheduled, as
long as the Grid Master completes its distribution.
To stop a distribution:
1. From the Grid Distribution Status bar, click the Stop icon.
2. When the appliance displays a dialog box confirming that you want to stop the distribution, click Yes to continue.

Testing Software Upgrades

After you successfully distribute a software upgrade to the Grid Master, you can test an upgrade on the Grid Master
before actually implementing it. This allows you to resolve potential data migration issues before the actual upgrade.
The length of time the upgrade test takes depends on the amount of data and the difference between the current
NIOS version and the software upgrade. The test does not affect NIOS services and you can perform other
administrative tasks during the upgrade test.
To start an upgrade test:
• From the Grid tab, select the Upgrade tab, and then click Test Upgrade from the Toolbar. Test upgrade is enabled
only for a major upgrade (not an Upgrade Lite compatible upgrade).
After you start an upgrade test, you can view its status in the status bar. You can also stop it at anytime.
To stop an upgrade test:
• From the Grid Upgrade Test Status bar, click the Stop icon.
Note that if an admin restarts the Grid services or reboots the Grid Master, or if an HA failover occurs on the Grid
Master during the upgrade test, the appliance automatically stops the test. The appliance always resets the status of
the Grid to “Distributed” when it stops the upgrade test.
If the appliance encounters an error during the test, it stops the test and displays a message in the Upgrade Status
panel indicating that the upgrade test failed and the reason for the failure, such as a data translation error or data
import error. You can review the syslog for specific error messages before downloading the Support Bundle and
contacting Infoblox Technical Support.
After the test successfully finishes, the appliance displays a message confirming that the test upgrade is complete.
You can then perform the actual upgrade as described in Performing Software Upgrades on page 532.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 531

Managing NIOS Software and Configuration Files

Performing Software Upgrades

Performing a software upgrade involves rebooting the appliances and then running the new software. Essentially,
each appliance switches between the two software partitions on its system, activating the staged software and saving
the previously active software and database as backup.

Note: Before you upgrade the software, Infoblox recommends that you back up the current configuration and
database. For information, see Backing Up Files on page 541.

Depending on your upgrade paths, you can upgrade to a new release immediately or you can schedule the upgrade.
For information about how to upgrade immediately, see Upgrading the Grid Immediately. Before you schedule an
upgrade, ensure that you understand the limitations, as described in Managing Upgrade Groups on page 524. For
information about how to schedule an upgrade, see Scheduling Upgrades.

Upgrading the Grid Immediately

For unschedulable full upgrades, all the Grid members in the Grid must upgrade at the same time. For lite upgrades
and schedulable full upgrades, you can schedule the upgrades as described in Scheduling Upgrades on page 532,
or you can upgrade all the Grid members at the same time.
To upgrade a Grid immediately:
• From the Grid tab, select the Upgrade tab, and then click Upgrade -> Upgrade Now from the Toolbar.

Note: The Grid upgrades immediately and if there is an active upgrade schedule, it becomes inactive.

Scheduling Upgrades
You can schedule lite upgrades and full upgrades for certain NIOS versions. For limitations about scheduling a full
upgrade, see Managing Upgrade Groups on page 524. When you schedule an upgrade, you schedule the upgrade for
the Grid Master and the upgrade groups, including the Default group. The Grid Master must always upgrade before
the upgrade groups. Depending on your upgrade paths, you can schedule the upgrade for the Grid Master and
upgrade groups at different times over a period of nine days. If you schedule an upgrade that takes more than nine
days, the appliance displays a warning.
To schedule an upgrade:
1. From the Grid tab, select the Upgrade tab, and then click Upgrade -> Schedule Upgrade from the Toolbar.
2. In the Upgrade Schedule editor, complete the following:
— Activate Upgrade Schedule: Select this to enable the upgrade schedule. Clear it if you are creating an
upgrade schedule that you plan to activate at a later date. You can configure and save information in this
editor even when you deactivate a distribution.
— Grid Master Upgrade Start Information: Enter a Grid Master upgrade date, time, and time zone. The date
and time must be before those of the upgrade groups.
— Date: Enter a start date of the Grid Master upgrade in YYYY-MM-DD (year-month-day) format. You can
click the calendar icon to select a date from the calendar widget.
— Time: Enter a start time of the Grid Master upgrade in hh:mm:ss AM/PM (hour:minute:second in AM or
PM) format. You can select a time from the drop-down list.
— Time Zone: Select a time zone that applies to the start time you enter. If this time zone is different from
the Grid time zone, the appliance converts the time you enter here based on the Grid time zone, after
you save this schedule. When you display this schedule again, it displays the converted time. Selecting
the time zone here does not affect any time zone settings in the Grid. (For information about setting the
Grid and member time zones, see Managing Time Settings on page 404.)
— Admin Local Time: Displays the Grid Master upgrade date and start time in the time zone of the
administrator, as explained in Creating Local Admins on page 208.
— In the upgrade member table, specify the following by clicking the corresponding field in each row:

532 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Upgrading NIOS Software

— Group: The name of the upgrade group. You can assign a different upgrade group by selecting the
group from the drop-down list.
— Group Members: When you expand an upgrade group, this field displays the group members.
— Warning: This field turns yellow when there is a conflict among the upgrade groups. Hover your mouse
over the field and the tooltip displays the member that contains the conflict. It also displays
recommended upgrade groups in the Group column so you can change the group assignment to
resolve the conflict. The tooltip can display one of the following: GMC, DNS Primary, DHCP Logging
Member, or DHCP Failover. For information about how to resolve a conflict, see Resolving Upgrade
Warnings on page 533. Select an upgrade group from the drop-down list in the Group column to assign
a different upgrade group. Click Validate and Refresh to validate the new group assignment.
— Start Upgrade: Specify when the upgrade occurs. Select one of the following from the drop-down list:
• Date/Time: Select this to configure the upgrade start date, time, and time zone.
• After <group>: Select After Grid Master to start the distribution immediately after the completion of
the Grid Master distribution. Select an upgrade group that must complete its distribution before
the group you are configuring. If you select this option, you cannot enter a date, time, and time
zone.
Date, Time, and Time Zone are enabled only when you select Date/Time for Start Upgrade.
— Date: Enter an upgrade start date in YYYY-MM-DD (year-month-day) format. You can click the calendar
icon to select a date from the calendar widget.
— Time: Enter an upgrade start time in hh:mm:ss AM/PM (hour:minute:second in AM or PM) format. You
can select a time from the drop-down list.
— Time Zone: By default, the appliance displays the time zone of the first Grid member in the Upgrade
Group. You can change this time zone, if you want to enter the time using a different time zone. After
you save the schedule though, the appliance converts the time you entered to the time zone of the
upgrade group, if it is different. (For information about setting the Grid and member time zones, see
Managing Time Settings on page 404.) To change the default time zone of an upgrade group, change
the first group member in the Upgrade Group list, as explained in Adding Upgrade Groups on page
525.
— Admin Local Time: Displays the data and time in the time zone of the administrator, as explained in
Creating Local Admins on page 208.
— Upgrade Members: Indicates whether the upgrade within the group occurs simultaneously or
sequentially. You cannot edit this field here. You define this when you create the upgrade group. To
change this setting, see Modifying Upgrade Groups on page 526.
3. Save the configuration.
The appliance does not save the schedule and displays an error message if the schedule contains the following:
• Circular dependencies between upgrade groups; for example, the upgrade of Group A is scheduled after Group
B, and the upgrade of Group B is scheduled after Group A.
• The upgrade time is in the past.
The appliance also does not save the schedule and displays a warning when there is a group assignment conflict. For
information about how to resolve these conflicts, see Resolving Upgrade Warnings.
Otherwise, the appliance confirms that the schedule is saved and indicates whether the upgrade schedule is active.

Resolving Upgrade Warnings

The appliance can generate the following warnings when you schedule an upgrade:
• GMC: To resolve this warning, put all Grid Master candidates in the first upgrade group.
• DNS Primary: To resolve this warning, put all the members that are serving as DNS primaries in the first upgrade
group.
• DHCP Logging Member: To resolve this warning, put the DHCP logging member in the first upgrade group.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 533

Managing NIOS Software and Configuration Files

• DHCP Failover: To resolve this warning, place the peers of a DHCP failover association in separate upgrade
groups. Ensure that you schedule upgrades of the failover peers close to each other to minimize configuration
rules. NIOS does not allow DHCP configuration changes that affect the communication between the peers until
both peers are upgraded.

Upgrading Groups Immediately

After you schedule an upgrade with multiple upgrade groups, you can choose to immediately upgrade an upgrade
group that has not been upgraded yet. This function is available only for scheduled upgrades.
To upgrade an upgrade group now:
1. From the Grid tab, select the Upgrade tab, and then click Toggle Group List View.
2. In the Group List view, click the Upgrade Group Now icon in the upgrade group row.
Grid Manager immediately upgrades the selected group.

Upgrading a Single Member Immediately

After the Grid Master has been upgraded, you can choose to immediately upgrade a specific member that has not
been upgraded yet. This function is available only for scheduled Grid upgrades from NIOS 6.4.0 to a later release. You
can upgrade a single member only when the Grid upgrade is paused, and you cannot upgrade the Grid Master,
reporting appliance, and an offline member. Once the member has been manually upgrades, the appliance skips this
member when its scheduled upgrade time is reached.
To upgrade a specific member now:
1. From the Grid tab, select the Upgrade tab.
2. Pause the upgrade.
3. Click Toggle Member List View, and select the member check box from the table.
4. From the Toolbar, click Upgrade -> Upgrade Single Member.
Grid Manager immediately upgrades the selected member.

Reverting a Single Member

During an upgrade from NIOS 6.4.0 to a later release, you can revert a specific member that has already been
upgraded and is within its revert time window. The revert single member feature is useful when you want to
troubleshoot issues, such as service outages, on a specific member after it has been upgraded. You can revert a
member only when the Grid upgrade is paused, and you cannot revert the Grid Master, reporting appliance, and an
offline member. If the member you want to revert is in an upgrade group that has already completed the upgrade, you
must move the member to another upgrade group that has not been upgraded.
Once a member is upgraded, the appliance starts counting down and displays the time that is left for you to revert
this member. You can revert the member before the revert time window expires. The default time window to revert a
member is 24 hours. You can view the time that is left to revert the member in the Member List view, as described in
Grid and Member Status on page 537. You can also use the CLI commands set default_revert_window to
configure the default revert time window for the Grid. For information about this command, refer to the Infoblox CLI
Guide. Once a member exits the revert time window, you must revert the entire Grid in order to revert the member.

Note: You may potentially lose some data when you revert a member. The appliance keeps information about DHCP
leases and DNS records intact.

To revert a specific Grid member during a scheduled Grid upgrade:

1. From the Grid tab, select the Upgrade tab.
2. Pause the upgrade.
3. Click Toggle Member List View, and then select the member check box.
4. From the Toolbar, click Revert -> Revert Single Member.

534 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Upgrading NIOS Software

Grid Manager displays a message indicating that the revert process disrupts Grid services. Read the message
carefully, and then click Yes to confirm your decision to revert the member. Be aware that when you revert a
member, some changes made since the member was last upgraded may get lost.

Upgrade Process
When an upgrade starts, Grid Manager checks if the nodes of an HA Grid Master have the same NIOS software version
on their alternate partitions. If they do not have the same software version, the upgrade process stops. Grid Manager
displays an error message and if it is a scheduled upgrade, Grid Manager deactivates the schedule as well. Otherwise,
the upgrade process continues.

Note: During the upgrade, you can view the status of the Grid Master in the serial console.

During the upgrade, if a Grid member has not completed its distribution, it automatically resynchronizes with the Grid
Master after the Grid Master upgrade is complete.
Due to the nature of the upgrade sequence, HA pairs fail over during the upgrade. Therefore, be aware that the active
and passive nodes reverse roles. The order in which Grid members upgrade, including when HA pairs fail over, is
shown in Figure 10.1 (for an HA Grid Master) and Figure 10.2 on page 536 (for a single Grid Master).

Figure 10.1 Upgrade Sequence for an HA Grid Master and Grid Members

Grid
Failover 1 The passive node (Node 2) of the
HA Grid 2 Grid Master upgrades.
Master Active Passive
2 The Grid Master fails over from Node
1 to Node 2. At this point, the active
Grid Master (Node 2) is using the
3 upgraded code. All other nodes,
1 including the passive node (Node 1)
and all Grid members, rejoin the
newly updated active node (Node 2).
Node 1 Node 2 Since the NIOS version on these
nodes does not match that of the
4 Failover active Grid Master, the nodes are
Active Passive directed to upgrade.

3 Node 1 (now passive) of the Grid

HA Grid Master upgrades. The passive node
Member
5 3 (Node 2) of the HA member and the
single Grid member upgrade.

Node 1 Node 2
4 The HA Grid member fail overs from
Node 1 to Node 2.

5 Node 1 (now passive) of the HA

Single member upgrades.
Grid 3
Member

Note: Grid members that do not have the correct NIOS version on their alternate partitions due to an incomplete
distribution automatically resynchronize the NIOS version with the Grid Master, and then upgrade.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 535

Managing NIOS Software and Configuration Files

Figure 10.2 Upgrade Sequence for a Single Grid Master and Grid Members

Grid
1 Single Grid Master upgrades. All
other members rejoin the newly
1 updated Grid Master. Since the NIOS
version on these nodes does not
match that of the Grid Master, the
nodes are directed to upgrade.
Single Grid
Master Failover
2 Node 2 (passive) of the HA member
and the single member upgrade.
3
Active Passive
3 The HA member fails over from Node
1 to Node 2.
HA Grid
Member 4 2
4 Node 1 (now passive) of the HA
member upgrades.
Node 1 Node 2

Single Grid 2
Member

The Grid Manager session terminates when the HA Grid Master fails over from Node 1 to Node 2, or when the single
Grid Master reboots and goes offline.
During a scheduled upgrade, the Grid members that have not upgraded yet can join the Grid and function normally
until their scheduled upgrade time. When the upgrade finishes, the upgrade schedule is set to inactive.

Managing Upgrades
During an upgrade, Grid Manager displays a system message at the top of the screen indicating the Grid is being
upgraded. After you start an upgrade, you can pause or resume it. For information, see Pausing and Resuming
Upgrades and Monitoring Distribution and Upgrade Status on page 537.

Pausing and Resuming Upgrades

The following are some operational guidelines for performing an upgrade:
• You may not be able to perform certain administrative tasks during an upgrade.
• The Grid Manager session terminates when an HA Grid Master fails over from Node 1 to Node 2, or when a single
Grid Master reboots and goes offline. You can log back in to the appliance after the upgrade.
• When you pause an upgrade, you can do the following
— Change the sequence of the upgrade groups
— Change the scheduled upgrade time for an upgrade group
To pause an upgrade, from the Grid Upgrade Status bar, click the Pause icon. When you pause an upgrade, Grid
Manager displays a system message at the top of the screen indicating the upgrade is paused, until you resume the
upgrade. For information about the upgrade status of each member, see Monitoring Distribution and Upgrade Status
on page 537.

536 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Upgrading NIOS Software

To resume an upgrade:
1. From the Grid Upgrade Status bar, click the Resume icon.
2. When the appliance displays a dialog box confirming that you want to resume the upgrade, click Yes to continue.
Members that have not completed or started upgrades that were scheduled at an earlier time resume the
upgrade.

Monitoring Distribution and Upgrade Status

During a distribution or an upgrade, Grid Manager displays the status of the distribution or upgrade in the status bar.
It also displays the process status for each member. You can view the status in either the Member List view or Group
List view from the Grid tab -> Upgrade tab.
When you perform a distribution or an upgrade, the status bar displays the overall Grid distribution status with a
progress bar that describes the process being performed. The status bar also displays the number of members that
have completed the distribution or upgrade.
A difference between a distribution and an upgrade process is that during an upgrade, the Grid Manager session
terminates when an HA Grid Master fails over from Node 1 to Node 2, or when a single Grid Master reboots and goes
offline. You can log back in to the appliance after the upgrade.

Grid and Member Status

You can view the distribution and upgrade process status at the Grid and member level. To view the process status,
from the Grid tab, select the Upgrade tab, and then click Toggle Member List View.
The status bar displays the status of the overall Grid process. It contains a progress bar that indicates the percentage
of completion. It also shows the number of members that have completed the process.
Grid Manager displays the following information for each member:
• Member: The name of the Grid member.
• Group: The upgrade group to which the member belongs.
• HA: Indicates whether the member is an HA pair or not.
• Status: The current distribution or upgrade status. This can be Running (green) or Offline (red).
• IPv4 Address: The IPv4 address of the member.
• IPv6 Address: The IPv6 address of the member.
• Running Version: The NIOS software version that is currently running on the member.
• Alternate Version: Displays the NIOS software version to which the appliance can revert.
• Distribution/Upgrade Status: The current distribution or upgrade status. When the distribution or upgrade is in
progress, Grid Manager displays a progress bar in this field to indicate the percentage of completion.
• Hotfix: The name of the hotfix that was last run on the member.
• Status Time: The date, time, and time zone of the status displayed.
• Member Revert: Indicates whether the member has been reverted or not. This appears only when the member
has been upgraded from NIOS 6.4.0 to a later NIOS release.
• Time to Revert: The time (in HH:MM:SS format) left to revert a member. This appears only when the member has
been upgraded from NIOS 6.4.0 to a later NIOS release.
• Site: The location to which the member belongs. This is one of the predefined extensible attributes.
The appliance automatically refreshes the information in this panel.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 537

Managing NIOS Software and Configuration Files

Upgrade Group Status

You can view the distribution or upgrade status of an upgrade group in the group list view. In this view, the
distribution or upgrade status rolls up to the group level. You can expand an upgrade group to view the status of
individual member. However, you cannot view detailed status of a selected member from this view.
To view the process status of an upgrade group, from the Grid tab, select the Upgrade tab, and then click Toggle Group
List View. Grid Manager displays the following information for each member in an upgrade group:
• Group: The upgrade group to which the member belongs.
• Member: The name of the Grid member.
• Status: The current member status. This can be Running (green) or Offline (red).
• IPv4 Address: The IPv4 address of the member appliance.
• IPv6 Address: The IPv6 address of the member appliance.
• Running Version: The NIOS software version that is currently running on the member.
• Distribution Status: The current distribution status. For an upgrade group, Grid Manager displays a progress bar
to indicate the overall percentage of completion. For a member, Grid Manager displays the state of the
distribution process.
• Timestamp: The date, time, and time zone of the status displayed.

Detailed Status
You can view detailed process information of a member during a distribution or an upgrade.
To view detailed process information:
1. From the Grid tab, select the Upgrade tab, and then click Toggle Member List View.
2. Select a member and then click the Detailed Status icon.
Grid Manager displays a panel that shows the required steps during a distribution or an upgrade. It also displays a
color indicator, next to each step, to indicate the current status of each step. The color indicator can be one of the
following:
• Grey: The process has not started yet.
• Green: The process is complete.
• Blue: The distribution or upgrade that is in progress.
• Red: There is an error; Grid Manager displays a description of the problem.
• Yellow: A warning message.
When the selected member is an HA pair, Grid Manager displays the status information for both nodes. The panel
remains open until you close it or select a different member.

Downgrading Software
Each Infoblox appliance model has a minimum required release of Infoblox software. Before downgrading an
appliance, refer to the document, Minimum Required Release Software for Hardware Platforms, that shipped with
your product.
The downgrade procedure is for single independent appliances only. Infoblox does not support software downgrades
for Grid members, but you can revert to the previous NIOS release (see the next section) on a Grid Master.

Caution: Although the downgrade process preserves license information and basic network settings, it does not
preserve data. After you complete the downgrade procedure, all data in the database is lost.

538 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Reverting the Grid to the Previously Running Software

To downgrade software on a single independent appliance running NIOS 4.0 or later:

1. From the Grid tab, select the Upgrade tab, and then click Downgrade from the Toolbar.
Grid Manager displays a warning indicating that reverting to the current release is not possible once you start
the downgrade. Read the warning carefully, and then click Yes to confirm your decision to downgrade.
2. In the Choose file dialog box, navigate to the downgrade image file, and then click Open to upload the file. The
appliance uploads the file to the Grid Master. You cannot stop the downgrade process once you start it. Grid
Manager displays the downgrade status in the status bar.

Reverting the Grid to the Previously Running Software

You can revert the Grid to a version of software that was previously running on your NIOS appliance. The NIOS
appliance stores the previous software version in its backup software partition. You can see if there is a software
version to which you can revert and its version number in the Alternate Version column in the Grid Version Information
section of the Upgrade tab. To view the software version, from the Grid tab, select the Upgrade tab. Note that once
you start distributing a new NIOS version after an upgrade, you cannot revert to a previous NIOS version.
Be aware that when you revert to this software, changes made since the Grid was last upgraded are lost, including
the new DHCP leases and other DNS changes.
To revert to a version of software previously running on a Grid or on an independent appliance or HA pair:
• From the Grid tab, select the Upgrade tab, and then click Revert -> Revert Grid from the Toolbar.
Grid Manager displays a warning indicating that the revert process disrupts Grid services. Read the warning
carefully, and then click Yes to confirm your decision to revert.

Applying Hotfixes
Infoblox periodically releases hotfixes that contain resolved issues. Only superusers can apply hotfixes through Grid
Manager. When you install hotfixes through Grid Manager, you can apply them to the Grid Master and All Grid
members, the Grid Master only, the Grid Master and Grid Master Candidates, or selected Grid members. This feature
is supported on appliances running NIOS version 7.1 or later. Note that each hotfix addresses specific issues.
Infoblox recommends that you verify the hotfix before you apply it to ensure that it is the correct version.
After you apply a hotfix, Grid manager displays the hotfix status in the Upload Status bar. In addition, you can view
the history of the most recent list of applied hotfixes in the Hotfix History dialog box. For information about viewing
hotfix history, see Viewing Hotfix History on page 540.

Note: A hotfix installation may fail if there is a mismatch in the NIOS software versions or if a hotfix image fails to
meet the software or hardware restrictions.

To apply a hotfix:
1. From the Grid tab, select the Upgrade tab, and then click Apply Hotfix from the Toolbar and select one of the
following:
— To Grid Master and all Grid Members: Click this to apply hotfix to the Grid Master and all Grid members.
— To Grid Master: Click this to apply hotfix to the Grid Master only.
— To Grid Master and Grid Master Candidates: Click this to apply hotfix only to the Grid Master and Grid
Master candidates.
— To selected Grid Members: Click this to apply hotfix to the selected Grid member. This option is available
only after you have selected a Grid member or members.
2. In the Apply Hotfix dialog box, click Select and navigate to the hotfix image file you want to upload. Click Open
to select the file, and click Upload.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 539

Managing NIOS Software and Configuration Files

Note: If you have already installed a hotfix and subsequently try to upgrade or downgrade NIOS, the appliance
displays a warning message because resolved issues in the hotfix will no longer be valid if the upgrade or
downgrade version does not contain the original hotfix.

The appliance applies the hotfix to the targeted appliance(s). You cannot stop the hotfix process once you start
it. Grid Manager displays the hotfix status in the Upload Status bar.

Viewing Hotfix History

You can view hotfix history on selected members.
To view the hotfix history:
1. From the Grid tab, select the Upgrade tab, click the Show Hotfix History icon in the Hotfix column.
2. The Hotfix History dialog box displays the following information:
— Date: The timestamp when the hotfix was applied.
— Hotfix: The name of the hotfix that was last run on the member. The name of the hotfix image file that was
applied to the member.
3. Click Close to close the Hotfix History dialog box.

Backing Up and Restoring Configuration Files

Infoblox recommends that you regularly back up your configuration files and/or discovery database files. You can
back up your system files locally on the appliance or to your management system, or use TFTP (Trivial File Transfer
Protocol), FTP (File Transfer Protocol), or SCP (Secure Copy) to back them up to a remote server. Backing up and
restoring the configuration files using TFTP, FTP, or SCP is supported on both IPv4 and IPv6 communication protocols.
You can select to back up files manually or schedule automatic backups for a later date.
To avoid missing a backup when a remote server is unavailable during a scheduled automatic backup, you can
choose to save files locally on your appliance while backing up to the remote server. Both the local and remote
backup files share the same date because NIOS saves these files from the same backup. The backup file is a .tar.gz
file that contains the configuration settings, data set, and TFTP files. Note that the local backup contains only the Grid
backup. It does not contain backups for reporting and Network Automation.
You may also schedule automatic backups of the discovery database, which consists of the complete discovery data
for networks and network devices such as core, distribution and edge routers, enterprise switches, security devices,
and end host devices. NIOS backs up the discovery database in a .tar.gz file, with the raw discovery data formatted
as an XML file.

Note: Infoblox recommends that you backup the configuration after you convert a Grid to a different mode. Restoring
the old backup by performing a forced restore, may prevent the Grid members from rejoining the Grid Master
after the restore.

The following sections describe how to use the backup and restore functions:
• Backing Up Files
• Automatically Backing Up Data Files on page 542
• Backing Up Files on page 541
• Restoring Backup Files on page 545
• Downloading Backup Files from a Different Appliance on page 546

540 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Backing Up and Restoring Configuration Files

Note: Infoblox highly recommends that you always back up the current configuration file before upgrading, restoring,
or reverting the software on the appliance. If you are performing these operations on appliances licensed for
Discovery and that perform discovery, the discovery database can be backed up and restored using the same
mechanisms.

Backing Up Files
You can back up system files and discovery databases periodically and on demand. You can then restore the files on
the same appliance or on a different appliance. For information about restoring files, see Restoring Backup Files on
page 545. You can configure the appliance to automatically back up the files on a weekly, daily, or hourly basis.
Infoblox recommends that you back up the system files during off-hours to minimize the impact on network services.
By default, the automatic backup function is turned off. You must log in with a superuser account to back up files.
You can back up system configuration and/or discovery database files to the following:
• A local directory
• The management system that you use to operate the appliance
• A TFTP server
• An FTP server. This option requires that you have a valid username and password on the server prior to backing
up files.
• An SSH server that supports SCP. This option requires that you have a valid username and password on the
server prior to backing up files.

Local Backup
You can store a backup file on the appliance itself. However, Infoblox recommends that you store backup files in an
alternate location. When you back up the system files locally, the appliance uses the following format to name the
file: BACKUP_YYYY_MM_DD_MM.tar.gz. For example, a file name of BACKUP_2013_11_30_23_00 means that the file
is backed up on November 30th, 2013 at 11:00 PM.
The appliance can save up to 20 configuration files, regardless of how often the files are saved (weekly, hourly, or
daily). Ensure that you take the size of the configuration file into consideration when backing up files because the
storage limit on an appliance is 5 Gb (gigabytes). If your configuration file is 500 Mb (megabytes), then the appliance
can store 10 configuration files. When uploading configuration files on to a TFTP, FTP, or SCP server, you must consider
the file size on that server as well.

Using TFTP
TFTP is a client-server protocol that uses UDP as its transport protocol. It does not provide authentication or
encryption, therefore it does not require a username or password.
When you back up the system files to a TFTP server, you select the backup file you want to download, enter the name
in which the file is stored on the TFTP server and the server IP address.

Using FTP
FTP is a client-server protocol used to exchange files over TCP-based networks. The appliance, as the FTP client,
connects to a remote FTP server that you identify. When you use FTP to back up the system files, the password and
file contents are transmitted in clear text and may be intercepted by other users.
When you back up the system files to an FTP server, the appliance, as the FTP client, logs on to the FTP server. You
must specify the username and password the appliance uses to log on to the FTP server. The user account must have
write permission to the directory to which the appliance uploads the backup file.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 541

Managing NIOS Software and Configuration Files

Using SCP
SCP is more secure than TFTP and FTP. It uses the SSH protocol to provide authentication and security. You can use
SCP to back up the NIOS system files to a server running SSHv2.
When you use SCP to back up the system files to an SSH server, you must specify the username and password the
appliance uses to log on to the server. The user account must have write permission to the directory to which the
appliance uploads the backup file. In addition, make sure that you enter the correct IP address of the SSH server; the
appliance does not check the credentials of the SSH server to which it connects.

Note: The SCP protocol uses SSH for data transfer and thus provides the same authentication and security as SSH.
SCP uses LAN1 regardless of whether the MGMT port is enabled or not.

Automatically Backing Up Data Files

Infoblox recommends that you regularly back up your configuration files and/or discovery database files. The easiest
way to accomplish this task is to configure the appliance for scheduled automatic backups of the NIOS configuration
files. When you automatically back up a configuration file on the appliance, the file is named in the format
<GRIDNAME>_YYYY_MM_DD_HH.MM.tar.gz. The default time for an automatic backup is 3:00 AM. Infoblox
recommends scheduling configuration file backups to take place during the slowest period of network activity. You
can choose a schedule for when and how often files are backed up: weekly, daily, or hourly.
If a Grid has a discovery member, you may also schedule automatic backups of the Discovery database, which
consists of the complete discovery data for networks and network devices such as core, distribution and edge
routers, enterprise switches, security devices, and end host devices. NIOS backs up the Discovery database in a
.tar.gz file, with the raw Discovery data formatted as an XML file. For information on discovery features and
requirements, see the chapter Infoblox Network Insight on page 653.
To automatically back up a database file on an independent appliance or Grid Master:
1. From the Grid tab, select the Grid Manager tab, and then click Backup -> Schedule Backup from the Toolbar.
2. In the Schedule Backup dialog box, select the destination of the backup file from the Backup to drop-down list:
— TFTP: Back up system files to a TFTP server.
— Keep local copy: Select this to also save a local copy of the backup file on your appliance. This is disabled
by default. The local backup contains only the Grid backup, it does not contain backups for reporting and
Network Automation. Note that when you select this, the total backup time will increase.
— IP Address of TFTP Server: Enter the IP address of the TFTP server to which you want to back up the
system files.
— Directory Path: Enter the directory path of the file. For example, you can enter /archive/backups. The
directory path cannot contain spaces. The folder or directory you enter here must already exist on the
specified server. Do not include the file name in the directory path.
— Recurrence: Select how often you want to back up the files. You can select Weekly, Daily, or Hourly from
the drop-down list. When you select Weekly, complete the following:
• Every: Choose a day of the week from the drop-down list.
• Time: Enter a time in the hh:mm:ss AM/PM format. You can also click the clock icon and select a
time from the drop-down list. The Grid Master creates a backup file on the selected day and time
every week.
When you select Daily, enter a time in the hh:mm:ss AM/PM format. You can also select a time from the
drop-down list.
When you select Hourly, complete the following:
• Minutes after the Hour: Enter the minute after the hour when the Grid Master creates a backup file.
For example, enter 5 if you want the Grid Master to create a backup file five minutes after the hour
every hour.
— Disable Scheduled Backup: Select this if you want to disable automatic backups from occurring now.
You can still save the settings for future use.

542 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Backing Up and Restoring Configuration Files

— FTP: Back up system files to an FTP server.

— Keep local copy: Select this to also save a local copy of the backup file on your appliance. This is disabled
by default. The local backup contains only the Grid backup, it does not contain backups for reporting and
Network Automation. Note that when you select this, the total backup time will increase.
— IP Address of FTP Server: The IP address of the FTP server.
— Directory Path: Enter the directory path of the file. For example, you can enter /archive/backups. The
directory path cannot contain spaces. The folder or directory you enter here must already exist on the
specified server. Do not include the file name in the directory path.
— Username: Enter the username of your FTP account.

Note: If you have configured AD server for authentication, you must specify “domain name\\username”.

— Password: Enter the password of your FTP account.

— Recurrence: Select how often the scheduled backups should occur. You can select Weekly, Daily, or
Hourly. For information, see TFTP.
— Disable Scheduled Backup: Select this if you want to disable automatic backups from occurring now,
but want to save the settings for future use.
— SCP: Back up system files to an SSH server that supports SCP.
— Keep local copy: Select this to also save a local copy of the backup file on your appliance. This is disabled
by default. The local backup contains only the Grid backup, it does not contain backups for reporting and
Network Automation. Note that when you select this, the total backup time will increase.
— IP Address of SCP Server: The IP address of the SCP server.
— Directory Path: Enter the directory path of the file. For example, you can enter /archive/backups. The
directory path cannot contain spaces. The folder or directory you enter here must already exist on the
specified server. Do not include the file name in the directory path.
— Username: Enter the username of your SCP account.

Note: If you have configured AD server for authentication, you must specify “domain name\\username”.

— Password: Enter the password of your SCP account.

— Recurrence: Select how often the scheduled backups should occur. You can select Weekly, Daily, or
Hourly. For information, see the TFTP section.
— Disable Scheduled Backup: Select this if you want to disable automatic backups from occurring now.
You can still save the settings for future use.

Note: When you select FTP or SCP, ensure that you have a valid username and password on the server prior to
backing up the files.

— Grid Master (Local): Back up to a local directory on the Grid Master. This is the default.
By default, the Grid Master generates a backup file and saves it locally in its own storage at 3:00 AM daily.
Be aware that backing up the Grid and saving it locally on an hourly basis increases the turnover of files
stored on the Grid Master. Backing it up hourly to a remote server increases the overall amount of traffic on
your network.
3. If the Grid has a discovery member, Grid Manager displays the NIOS data and Discovery data check boxes. You
can select the NIOS data check box, to back up NIOS configuration data for the Grid and select the Discovery data
check box, to back up discovery data for the Grid.
If the Grid has a reporting member, Grid Manager displays the Infoblox Splunk App check box. You can select
the Infoblox Splunk App check box, to back up Splunk application reporting data.
4. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 543

Managing NIOS Software and Configuration Files

Manually Backing Up Data Files

You can manually back up a NIOS data file in addition to scheduling your backups. If a Grid has a discovery member,
you can also manually back up the current discovery database. Doing so backs up the complete discovery database
that is resident on the Consolidator appliance, which is a member of the Grid. Keep in mind that discovery processes
may be taking place on the associated NIOS appliances licensed for that task. NIOS will temporarily suspend the
Discovery service while the backup is being retrieved from the Consolidator appliance.
To back up manually:
1. From the Grid tab, select the Grid Manager tab, and then click Backup -> Manual Backup from the Toolbar.
2. In the Backup wizard, select the destination of the backup file from the Backup to drop-down list:
— My Computer: Back up system files to a local directory on your computer. This is the default.
— TFTP: Back up system files to a TFTP server.
— Filename: Enter the directory path and the file name of the backup file. For example, you can enter
/archive/backups/Infoblox_2009_10_20_15_30.
— IP Address of TFTP Server: Enter the IP address of the TFTP server to which you want to back up the
system files.
— FTP: Back up system files to an FTP server.
— Filename: Enter the directory path and the file name of the backup file. For example, you can enter
/archive/backups/Infoblox_2009_10_20_15_30.
— IP Address of FTP Server: The IP address of the FTP server.
— Username: Enter the username of your FTP account.

Note: If you have configured AD server for authentication, you must specify “domain name\\username”.

— Password: Enter the password of your FTP account.

— SCP: Back up system files to an SSH server that supports SCP.
— Filename: Enter the directory path and the file name of the backup file. For example, you can enter
/archive/backups/Infoblox_2009_10_20_15_30.
— IP Address of SCP Server: The IP address of the SCP server.
— Username: Enter the username of your SCP account.

Note: If you have configured AD server for authentication, you must specify “domain name\\username”.

— Password: Enter the password of your SCP account.

Note: When you select FTP or SCP, ensure that you have a valid username and password on the server prior to
backing up the files.

3. If the Grid has a discovery member, Grid Manager displays the NIOS data and Discovery data check boxes. You
can select the NIOS data check box, to back up NIOS configuration data for the Grid and select the Discovery data
check box, to back up discovery data for the Grid.
If the Grid has a reporting member, Grid Manager displays the Infoblox Splunk App check box. You can select
the Infoblox Splunk App check box, to back up Splunk application reporting data.
4. Click Backup.

544 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Backing Up and Restoring Configuration Files

Downloading Backup Files

You can save an existing backup file, or create and save a new one to your local management system, a TFTP server,
an FTP server, or a SCP server.
To download an existing backup file:
1. From the Grid tab, select the Grid Manager tab, and the click Backup -> Manage Local Backup from the Toolbar.
Grid Manager displays the current backup files in the Manage Local Backups dialog box.
2. To download a backup file, select the check box of a backup file, and then click the Transfer icon. You cannot
select multiple files for downloading.
3. Select one of the following from the Backup to drop-down list:
— My Computer: Backup to a local directory on your computer. This is the default.
— TFTP: Save the backup file to a TFTP server.
— Filename: Enter the directory path and the file name of the backup file. For example, you can enter
/archive/backups/Infoblox_2009_10_20_15_30.
— IP Address of TFTP Server: Enter the IP address of the TFTP server to which you want to save the backup
file.
— FTP: Save the backup file to an FTP server.
— Filename: Enter the directory path and the file name of the backup file. For example, you can enter
/archive/backups/Infoblox_2009_10_20_15_30.
— IP Address of FTP Server: The IP address of the FTP server.
— Username: Enter the username of your FTP server account.
— Password: Enter the password of your FTP server account.
— SCP: Save the backup file to an SSH server that supports SCP.
— Filename: Enter the directory path and the file name of the backup file. For example, you can enter
/archive/backups/Infoblox_2009_10_20_15_30.
— IP Address of SCP Server: The IP address of the SCP server.
— Username: Enter the username of your SCP server account.
— Password: Enter the password of your SCP server account.

Note: When you select FTP or SCP, ensure that you have a valid username and password on the server prior to
backing up the files.

4. Click Transfer Copy.

Restoring Backup Files

You can restore a backup file of a NIOS configuration or a Discovery database to an appliance running the same NIOS
version as that of the appliance from which the backup file originates. You can also restore a backup file from an
appliance running a NIOS version to an appliance running a later NIOS version as long as the upgrade from the earlier
NIOS version to the later version is supported. For example, you can restore a backup file from an appliance running
NIOS 4.3r6-1 to an appliance running NIOS 5.0r1-0 because upgrading from NIOS 4.3r6-1 to 5.0r1-0 is supported.
However, you cannot restore a backup file from an appliance running NIOS 4.1r2-1 to an appliance running NIOS
5.0r1-0 because upgrading from NIOS 4.1r2-1 to 5.0r1-0 is not supported.
You can restore an existing backup file on the appliance from which it originates, or restore a backup file from a
different appliance (referred to as a forced restore). To download a backup file from a different appliance, see
Downloading Backup Files from a Different Appliance on page 546.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 545

Managing NIOS Software and Configuration Files

You must log in with a superuser account to back up and restore files.
NIOS provides three ways to restore a backup file:
• From a local directory or the management system you use to operate the appliance
• From a TFTP server
• From a remote server using FTP. This option requires that you have a valid username and password on the FTP
server prior to performing a backup or restore.
To restore a backup file to the same independent appliance or Grid Master:
1. From the Grid tab, select the Grid Manager tab, and then click Restore from the Toolbar.
2. In the Restore dialog box, choose one of the following from the Restore from drop-down list:
— My Computer: Restore a file from your local computer. This is the default.
— Filename: Click Select File to navigate to the configuration file.
— TFTP: Restore a file from a TFTP server.
— Filename: Enter the directory path and the file name you want to restore. For example, you can enter
/archive/backups/Infoblox_2009_10_20_15_30.
— IP Address of TFTP Server: Enter the IP address of the TFTP server from which you restore the
configuration file.
— FTP: Restore a file from an FTP server.
— Filename: Enter the directory path and the file name of the backup file. For example, you can enter
/archive/backups/Infoblox_2009_10_20_15_30.
— IP Address of FTP Server: The IP address of the FTP server.
— Username: Enter the username of your FTP server account.
— Password: Enter the password of your FTP server account.
• Grid Master (Local): Restore from a local directory on the Grid Master. In the Backup Set table, select the file you
want to restore.
3. To restore NIOS configuration data, select the NIOS data check box.
4. To restore Discovery data, select the Discovery data check box. Discovery data should be restored to Consolidator
appliances with the correct licensing.
5. To download a backup file from one appliance to a different appliance, select Force Restore from Different Grid
to enable the feature, and then select one of the following:
— Retain Current Grid Master IP Settings (this is the default)
— Overwrite Grid Master IP Settings
6. Click Restore. In the Confirm Restore dialog box, click Yes.
After restoring the file, the appliance restarts. The restore process overwrites all existing data. All pending
scheduled tasks are not restored or reverted.
7. Close your current browser window, wait a few minutes, and then reconnect to the NIOS appliance.

Downloading Backup Files from a Different Appliance

When you “force restore” a NIOS appliance, you download a backup file from one appliance to a different appliance.
To restore a backup file to the same appliance or Grid Master, use the Restore function as described in Restoring
Backup Files on page 545.
To download a backup file from one appliance to a different appliance:
1. From the Grid tab, select the Grid Manager tab, and then click Restore from the Toolbar.
2. In the Restore wizard, do the following:
— Restore from: Choose a source from which you restore the configuration file, as described in Restoring
Backup Files on page 545.
3. Select Force Restore from Different Grid to enable the feature, and then select one of the following:

546 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Downloading Support Bundles

— Retain Current Grid Master IP Settings (this is the default)

— Overwrite Grid Master IP Settings
4. Click Restore. In the Confirm Restore dialog box, click Yes.
After restoring the file, the appliance reboots. The restore process overwrites all existing data. All pending
scheduled tasks are not restored or reverted.
5. Close your current browser window, wait a few minutes, and then reconnect to the NIOS appliance.

Downloading Support Bundles

When you need assistance troubleshooting a NIOS appliance, you can log in to the appliance as a superuser,
download the support bundle of the appliance, and then send it to Infoblox Technical Support for analysis. A support
bundle is a tar.gz file that contains configuration files and the appliance system files. You can download a support
bundle for an independent appliance and for each member in a Grid. When you download a support bundle for an HA
pair, it includes the files of both nodes in the HA pair.
By default, the appliance includes the following files in the support bundle: core files, current logs, and rotated logs.
Because core files can be quite large and take a significant amount of time to download, Infoblox recommends that
you include core files in the support bundle only when requested by Infoblox Technical Support. If your appliance
supports multiple primary servers for DNS authoritative zones, you can select to include cached zone data in the
support bundle. This data is not included in the bundle by default.
To download a support bundle:
1. From the Grid tab, select a member check box, and then click Download -> Support Bundle from the Toolbar.
2. In the Download Support Bundle dialog box, select the files you want to include in the support bundle, and then
click OK:
— Core Files: Infoblox recommends that you include these files only when requested by Infoblox Technical
Support.
— Current Logs: Infoblox recommends that you always include these files in the support bundle.
— Rotated Logs: These are rotated logs that contain historical information.
— Cached DNS Recursive Data: Select this to include cached DNS recursive data in the support bundle. This is
deselected by default.
— Cached Zone Data: Select this to include cached DNS zone data in the support bundle. This is deselected by
default.
— Discovery SNMP Logs: Event logs related to device discovery SNMP probes of routers, switches and other
network infrastructure devices.
3. Navigate to the location you want to save the file and change the file name. Do not change the .tar.gz file
extension in the file name.
4. Send this file to Infoblox Technical Support.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 547

Managing NIOS Software and Configuration Files

548 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 11 bloxTools Environment
The bloxTools environment provides a pre-installed environment for hosting custom web-based applications. This
chapter includes the following sections:
• About the bloxTools Environment on page 550
— System Requirements on page 550
• Using the bloxTools Environment on page 551
— Configuring the Service on page 551
— Allocating Memory on page 552
— Uploading Files on page 552
— Scheduling Tasks on page 553
— Moving the bloxTools Service on page 553
• Monitoring the Service on page 554
— Viewing the Logs on page 554
— Viewing Detailed Status on page 554

NIOS 7.3 NIOS Administrator Guide (Rev. A) 549

bloxTools Environment

About the bloxTools Environment

The bloxTools environment provides tools for creating custom applications that facilitate the administrative tasks in
your organization. It provides a pre-installed environment for running applications using Perl, Python, PHP, CGI
scripting, and Infoblox API libraries. Note that no direct external remote user (telnet and ssh, for example) or shell
access is available in this environment.
The bloxTools environment “borrows” resources such as CPU, memory, disk space, and networking from the host
Infoblox appliance, but is logically separated from the NIOS. The logical separation ensures that any failure in the
bIoxTools service does not affect the other services running on the appliance.
The bloxTools environment can only be configured to run on an independent appliance or a Grid member. You cannot
run the bloxTools service on a Grid Master, a Grid Master candidate, or a virtual appliance, such as vNIOS for Riverbed,
Cisco, VMware, or Microsoft Hyper-V.

Note: In previous NIOS releases, you could run the bloxTools service only on a Grid Master. If bloxTools has been
configured to run on a Grid Master before an upgrade, the bloxTools service continues to run on the Grid Master
after an upgrade. This configuration is preserved mainly for migration purposes only. Infoblox strongly
recommends that you move the bloxTools service to a Grid member after the upgrade. For information, see
Moving the bloxTools Service on page 553.

In a Grid, you can run the bloxTools service only on one Grid member at a time, and you cannot configure this member
as a Grid Master candidate. However, you can move the bloxTools service from one member to another. For
information, see Moving the bloxTools Service on page 553.
On an HA member, the bloxTools service runs on the active node. If there is an HA failover, the bloxTools service is
automatically launched after the passive node becomes active. For information, see About HA Pairs on page 282.

Note: When you run the bloxTools service on an independent appliance or a Grid member, the performance of other
services running on the appliance may be affected. Infoblox recommends that you run the bloxTools
environment on a member that does not host critical services.

After you enable the bloxTools service and configure its built-in file transfer services, you can upload content to the
bloxTools portal using either an FTP (File Transfer Protocol) or SFTP (SSH File Transfer Protocol) client. The uploaded
content is included in system backups and you can restore it from the backups.
For more information about the bloxTools environment and to access free applications, visit
https://community.infoblox.com/resource/bloxtools-snapins.

System Requirements
Table 11.1 shows which Infoblox appliances support the bloxTools service and the memory requirement for each. The
service “borrows” host resources such as CPU, memory, and disk space from the host Infoblox appliance.

Table 11.1 Memory and Disk Space Requirements

Supported Infoblox Memory Requirement

Appliance
Trinzic 1410 128 MB to 2048 MB
Trinzic 1420 The default is 256 MB

Trinzic 2210 128 MB to 2048 MB

Trinzic 2220 The default is 256 MB

Infoblox-4010 128 MB to 4096 MB

The default is 256 MB

550 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using the bloxTools Environment

Using the bloxTools Environment

Complete the following tasks to upload custom applications to the bloxTools environment:
1. Log in to the appliance as a superuser and configure the bloxTools service, as described in Configuring the
Service.
2. Use an FTP or a SFTP client to upload content to the bloxTools environment.
In addition, you can schedule tasks as described in Scheduling Tasks on page 553, and monitor the bloxTools service
as described in Monitoring the Service on page 554.

WARNING: Resetting the Grid member using either the reset all or reset database CLI commands permanently
deletes the content you uploaded to the bloxTools environment. Infoblox recommends that you
backup the appliance before using any of these commands.

Configuring the Service

When you configure the bloxTools service, you can enable FTP, SFTP, and HTTPS, and set their operational parameters.
FTP and SFTP are the services you use to upload data. You can disable these services when they are not in use. HTTPS
must remain enabled to allow the web based bloxTools applications to run. Note that the bloxTools service uses the
same SSL certificate as the host Infoblox appliance. For information on certificates, see Managing Certificates on
page 63.
You can configure the bloxTools service on port 443, 444 or on a port between 1024 to 63999. You can also enable
HTTP to HTTPS redirection for the bloxTools service from the default HTTP port 80 to any specified HTTPS port. When
you enable HTTP to HTTPS redirection, all the requests sent to the HTTP port are redirected to the HTTPS port
configured for the bloxTools service. By default, NIOS appliance does not redirect HTTP requests to HTTPS.

Note: When you redirect HTTP to HTTPS, the connection is not as secure as compared to connecting directly through
HTTPS.

Note the following when you configure the bloxTools service on port 443:
• HTTP to HTTPS redirection from Grid member to Grid Master is disabled.
• HTTP file distribution service is not allowed.
In previous NIOS releases, you could run the bloxTools service on a Grid Master or a Grid Master candidate. If you have
not removed the bloxTools service from a member before you upgrade it to NIOS 6.11.0 or later, you cannot configure
the bloxTools service on port 443 until you move the bloxTools service to an upgraded Grid member. For information,
see Moving the bloxTools Service on page 553.
To configure the bloxTools service:
1. Log in as a superuser.
2. From the Grid tab, select the Grid Manager tab, and then click bloxTools. In the Services tab, click Edit -> Grid
bloxTools Properties from the Toolbar.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 551

bloxTools Environment

3. In the Grid bloxTools Properties editor, complete the following:

— Enable Web Service: Select HTTPS Port to enable users to access the applications through an HTTPS
connection. The default port is 444. You can change the default HTTPS port to 443 or to a port between
1024 to 63999.
— Redirect Bloxtools HTTP to HTTPS: Select this check box to enable redirection from the default HTTP port to
the HTTPS port. The default HTTP port is 80. This is disabled by default.
— Enable FTP Service: Select FTP Port to enable the FTP service. The default port is 26. You can change the port
number to suit your environment.
— Enable SFTP Service: Select SFTP Port to enable the SFTP service for secure file transfer. The default port is
28. You can change the port to a number between 1024 and 63999, provided that the port is not currently
used for another purpose.
— Login: Enter the username for the FTP and SFTP services. The username can contain lower case letters,
numbers, underscores (_), and dollar signs ($), and it must begin with a letter, not a number.
— Set Password: Enter the password for the FTP and SFTP services in this field.
— Retype Password: Enter the same password.

Note: The password is sent as clear text when you use the FTP service. To maintain security on the Infoblox
appliance, this password should be different from the password set for the Infoblox appliance.

4. Save the configuration and click Restart if it appears at the top of the screen.
When you configure the bloxTools service on an independent appliance, you can configure the allocated memory in
the System bloxTools Properties editor. For information, see Allocating Memory on page 552.

Allocating Memory
You can configure the memory you want to allocate to the bloxTools service. You must configure this at the member
level. If you run the bloxTools service on an independent appliance, you can configure the allocated memory in the
System bloxTools Properties editor.
To configure the allocated memory:
1. Log in as a superuser.
2. From the Grid tab, select the Grid Manager tab, and then click bloxTools. In the Services tab, click Edit -> Member
bloxTools Properties from the Toolbar.
3. In the Member bloxTools Properties editor, complete the following:
— Allocated Memory (MB): The service “borrows” host resources such as CPU, memory, and disk space from
the host Infoblox appliance. The default amount of memory the appliance allocates for the bloxTools
environment is 256 MB. You can change this allocation, depending on the appliance platform. See System
Requirements on page 550 for the requirements and allowed values of each appliance.

Uploading Files
Use an FTP or a SFTP client to upload content, such as Perl modules, JavaScript files, PHP files, CGI files, and image
files, to the bloxTools environment. You can upload a maximum of 4 GB of data. After you have uploaded content to
your bloxTools environment, you should disable the FTP and SFTP services to prevent unauthorized or accidental
changes.
To upload files using the FTP service:
1. Open an Internet browser window and log in to the FTP service by entering:
ftp://Grid_member_ip_addr:ftp_port
For example, if the IP address of the Grid member is 10.1.1.1 and the FTP port number is 26, enter:
ftp://10.1.1.1:26

552 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using the bloxTools Environment

2. In the Authentication Required dialog box, enter the username and password. This is the username and
password you entered for the FTP service in the bloxTools Environment editor on the appliance.
3. Follow the instructions provided by your FTP client to upload the files.
To upload files using the SFTP service:
1. Open a terminal window and log in to the SFTP service by entering:
sftp -oPort=sftp_port sftp_user@Grid_member_ip_addr
For example, if the IP address of the Grid member is 10.1.1.1, the login username for the SFTP service is jdoe,
and the SFTP port number is 28, enter:
sftp -oPort=28 [email protected]
2. Enter the password. This is the password you entered for the SFTP service in the bloxTools Environment editor on
the appliance.
3. Follow the instructions provided by your SFTP client to upload the files.

Note: On a computer running Microsoft Windows, you can use WinSCP as the FTP or SFTP client for uploading files.

The bloxTools environment stores the uploaded data in the /portal directory.

Scheduling Tasks
bloxTools includes support for the Perl module Config::Crontab so you can manage scheduler services. You can
use the scheduler to execute commands in the future. You can also schedule recurring commands. For example, you
can schedule the creation of a host record or schedule recurring reports. The scheduler allows default “user level”
crontab access and you can use the user account ‘nobody’ to submit commands. The Grid Master replicates the
crontab data to the Master Candidates.

Moving the bloxTools Service

In a Grid, you can move the bloxTools service from one Grid member to another. When you move the bloxTools service,
the source member synchronizes data with the Grid Master, and the Grid Master synchronizes data with the
destination member. The time to resynchronize the bloxTools data on to the destination member depends on the
amount of data to synchronize and the Grid configuration. If the migration takes longer than two minutes, it becomes
a long running task. This allows the move of the bloxTools service to run in the background while you perform other
tasks. For information, see About Tasks on page 81. Note that on an independent appliance, you cannot move the
bloxTools service to another member.
After an upgrade from previous NIOS releases, Grid Manager displays a warning message in the system message
panel if you have previously configured to run the bloxTools service on the Grid Master. You can click Move in this
panel to launch the Move bloxTools dialog box to move the bloxTools service to a Grid member.
To move the bloxTools Service:
1. From the Grid tab, select the Grid Manager tab -> Members tab, and then click bloxTools -> Move from the Toolbar.
2. In the Move bloxTools dialog box, complete the following:
— Source Member: Displays the name of the Grid member that is currently running the bloxTools service. You
cannot modify this field.
— Destination Member: Click Select. In the Member Selector dialog box, select the member to which you want
to move the bloxTools service. Grid Manager displays the name of the selected member here.
3. Click Move.
The appliance synchronizes data with the Grid Master, and the Grid Master synchronizes data with the destination
member. This may take a while to complete depending on your Grid configuration and the amount of data.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 553

bloxTools Environment

Monitoring the Service

Infoblox provides several tools for monitoring the bloxTools Environment. The bloxTools Environment has its own
syslog service which you can access to view logs generated by the bloxTools service and its processes. The Detailed
Status panel also displays the status of the bloxTools Environment.

Viewing the Logs

The bloxTools Environment generates the following logs:
• access.log: The Apache access log
• error.log: The Apache error log
• syslog.log: The bloxTools Environment system log
These log files are included in the support bundle. You can download the log files using FTP. You can also connect to
the CLI of the member running the bloxTools environment and use the following commands to view the logs:
• Use the show file command to view the list of log files.
• Use the show bloxtools command to view the status of the bloxTools Environment.
• Use the show file bloxtools portal_access command to view the web portal access log.
• Use the show file bloxtools portal_error command to view the web portal error log.
• Use the show file bloxtools portal_log command to view the web portal system log.

Viewing Detailed Status

You can view the status of the bloxTools Environment from the Services tab of the Grid Manager tab. To display the
bloxTools service status, from the Grid tab, select the Grid Manager tab -> Services tab, and then click bloxTools. Grid
Manager displays all Grid members that can host the bloxTools service. The name of the Grid Master is displayed only
if you have completed an upgrade and previously configured the bloxTools service to run on the Grid Master. Though
you can continue to run the bloxTools service on the Grid Master, Infoblox strongly recommends that you move the
bloxTools service to a Grid member. For information, see Moving the bloxTools Service on page 553.
Grid Manager displays the following information about all Grid members:
• Name: The Grid member name.
• Service Status: Indicates the current operational status of the bloxTools service running on the member. This
can include the migration status if you are moving the bloxTools service to another member.
• IP Address: The IP address of the member.
• Comment: Information about the bloxTools Environment.
• Site: The location to which the member belongs. This is one of the predefined extensible attributes.
The service status icon indicates the operational status of the bloxTools Environment and the usage percentages for
the CPU, memory and disk resources. The status icon can be one of the following:

Icon Color Meaning

Gray The bloxTools Environment is disabled or offline.

Green The CPU, memory, and disk usage is below 80%.

Usage of at least one of the following resources is greater than or equal to 80%: CPU, memory
Yellow
or disk. The description indicates the percentage of each resource.
The bloxTools Environment is down, or an essential service within the bloxTools Environment
Red
has failed.

554 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 12 RIR Registration Updates
This chapter explains how to configure the Infoblox Grid to manage RIR (Regional Internet Registries) allocated
addresses and submit registration updates to the RIPE database. It includes the following sections:
• RIR Address Allocation and Registration Updates on page 556
— About the RIPE Database on page 556
• Configuring RIR Registration Updates on page 557
— Requirements and Permissions on page 556
— Enabling Support for RIR Registration Updates on page 557
— Configuring RIR Communication Settings on page 558
• Managing RIR Data on page 558
— Adding RIR Organizations on page 559
— Modifying RIR Organizations on page 560
— Deleting RIR Organizations on page 560
— Adding and Assigning RIR Networks on page 560
— Deleting RIR Networks on page 562
• Managing RIR Attributes on page 562
— RIR Organizational Attributes on page 563
— RIR Network Attributes on page 565
• Monitoring RIR Data on page 569
— Viewing RIR Organizations on page 569
— Previewing Registration Updates on page 569

NIOS 7.3 NIOS Administrator Guide (Rev. A) 555

RIR Registration Updates

RIR Address Allocation and Registration Updates

You can configure the Infoblox Grid to manage allocated IP address blocks that ISPs (Internet Service Providers)
receive from their RIRs (Regional Internet Registries). An RIR is an entity that manages the Internet number resources,
which include IP addresses and autonomous system numbers, within a specific region of the world. RIRs use SWIP
(Share WHOIS Project) or RWhois (Referral WHOIS) servers to provide address allocation information for IP address
blocks. Typically, an RIR determines the address blocks to be allocated for specific organizations (typically ISPs),
while an ISP manages the allocated address blocks, associated organizations and corresponding RIR registrations.
An organization can determine when to request for more address blocks from its RIR. Most ISPs manage multiple
organizations and synchronize network address data with their RIRs every few months.
To leverage IPAM (IP Address Management) on the NIOS appliance, you can enable the Infoblox Grid to manage RIR
allocated addresses and send registration updates to the RIPE (Réseaux IP Européens) database as often as you
update RIR data on NIOS. RIPE is one of the five RIRs in the world that manages the allocation and registration of
Internet number resources for Europe, Russia, the Middle East, and Central Asia.

Note: The RIR registration update feature is not supported in a Multi-Grid configuration.

About the RIPE Database

The RIPE database contains registration details of IP addresses and AS numbers originally allocated by the RIPE NCC
(RIPE Network Coordination Center). The database contains information such as organizations that hold IP resources,
where the allocations were made, and contact details for the networks. Organizations or individuals that hold the
allocated address blocks are responsible for updating information in the database.
The NIOS appliance supports submitting registration and reassignment updates to the RIPE database, which can be
accessed through the RIPE API interface or an email template. For more information, see Configuring RIR
Communication Settings on page 558.

Note: Before the NIOS appliance sends registration updates to the RIPE database, it does not validate the data you
submit. Therefore, if you enter invalid information that cannot be mapped to the RIPE database, your updates
will fail. In addition, the NIOS appliance does not synchronize data from the RIPE database.

Requirements and Permissions

To manage RIR allocated addresses, organizations, and network utilization that contain RIR assignments, you must
first enable support for RIR registration updates, and then configure the RIR communication method. Note that once
you have enabled support for RIR registration updates, settings and fields that are relevant to this feature are enabled
in Grid Manager. You do not need a special license to use this feature.
Only superusers can create, modify, and delete RIR organizations. Limited-access users can manage RIR allocated
address blocks if they have the required permissions to the objects.
To view and manage RIR related data, admins must have permissions to the applicable resources. For example, to
view RIR networks, admins must have read-only permission to the networks; and to edit them, admins must have
read/write permission to them. For more information about admin permissions, see About Administrative
Permissions on page 195.

556 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring RIR Registration Updates

Configuring RIR Registration Updates

To manage RIR allocated addresses and send registration updates through NIOS, you first add RIR organizations and
create RIR allocated networks in NIOS. You can then reassign network addresses within the RIR allocated address
block to other organizations based on your requirements, and then configure NIOS to send registration updates
directly to the RIPE database. Any data you manage through the Grid is handled by the Grid Master.
When the Grid Master is an HA pair, the active node handles the submission of data. If an HA failover occurs during
a submission, the failing node immediately aborts the submission. The new active node resumes the next
submission. For information about HA pairs, see About HA Pairs on page 282.
To manage and submit updates to the RIPE database, you must first enable the Grid to support RIR registration
updates. You can then enter RIR information, such as RIR organizations and RIR attributes.
To configure the Grid to manage RIR allocated addresses and submit updates to RIPE, complete the following:
1. Enable support for RIR registration updates, as described in Enabling Support for RIR Registration Updates on
page 557.
2. Define the method to communicate updates to RIPE, as described in Configuring RIR Communication Settings on
page 558.
3. Add and configure RIR organizations and RIR organizational attributes, as described in Adding RIR Organizations
on page 559.
4. Add allocated address blocks and assign specific network addresses to RIR organizations, as described in
Adding and Assigning RIR Networks on page 560.
5. Review and submit registration updates to RIPE, as described in Previewing Registration Updates on page 569.
You can also perform the following tasks:
• View a list of RIR organizations, as described in Viewing RIR Organizations on page 569.
• Modify RIR organizations and RIR organizational attributes, as described in Modifying RIR Organizations on
page 560.
• Monitor network utilization for networks that contain RIR assignments. For information, see IPAM Home on
page 590or Viewing Networks on page 1115.

Enabling Support for RIR Registration Updates

Before you can manage RIR data through Grid Manager, you must first enable support for RIR registration updates.
To enable support for RIR registration updates:
1. From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
2. In the Grid Properties editor, select the General tab -> Advanced tab, and complete the following:
— Enable Updates of RIR Registrations: Select this to enable the support for submitting RIR registration
updates to the RIPE database. When you enable this feature, you can configure the appliance to send
registration updates to RIPE for network reassignments and reallocations.

Note: Ensure that you configure DNS resolvers for the Grid when you enable this feature. For information about
how to configure DNS resolvers, see Enabling DNS Resolution on page 477.

3. Save the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 557

RIR Registration Updates

Configuring RIR Communication Settings

You can configure the appliance to send RIR address updates to RIPE through the RIPE REST API or through an email
using the maintainer email address specified in the RIR organization. Note that when you use the API method to
delete a registered address block, you do not need to submit RIR attributes that match the data in the RIPE database.
However, when you use the email method, you must enter RIR attribute values that match the data in the database.
Otherwise, your submission will fail. To view examples of registration updates that NIOS sends, see Previewing
Registration Updates on page 569.
To configure the RIR communication settings:
1. From the Administration tab, select the RIR tab, and then select RIR Settings -> RIPE from the Toolbar.
2. In the RIR Communication Settings - RIPE editor, select one of the following to determine how the appliance
sends updates to RIPE. The default is API.
— API: The appliance sends RIR updates to RIPE through the RIPE API. The default destination is
https://rest.db.ripe.net for accessing the production database and https://rest-test.db.ripe.net for
accessing the test database. Click Override and enter a different URL to override the default value. When
you select this as the communication method, the registration status will be updated automatically after
the registration update is completed. Note that RIPE supports only secure connections using HTTPS.
— Email: The appliance sends RIR updates to RIPE through the email address displayed in the field. The
default is [email protected]. Click Override and enter a different email address to override the default
value. The appliance uses a special email template that includes values of certain RIR attributes. If any of
the RIR attribute values do not match the database in the RIPE database, your submission will fail. When
you select Email as the communication method, ensure that you enable email notifications at the Grid level.
For information how to enable email notifications, see Setting SNMP and Email Notifications on page 1371.
Note that when you select this as the communication method, the registration status will not be
automatically updated. You can manually change the status. For information, see Modifying RIR Network
Data on page 561.
— None: The appliance does not send RIR updates to RIPE.
3. Save the configuration.

Managing RIR Data

An RIR organization provides information about an entity that has registered a network resource in the RIPE Database.
This entity can be a company (such as an ISP), a nonprofit group, or an individual. You can add RIR organizations
defined in the RIPE database and start managing their data through NIOS.
After you have enabled support for RIR updates and configure the desired communication method for the updates,
you can do the following to manage RIR data:
• Add RIR organizations and their associated data, as described in Adding RIR Organizations on page 559.
• Add the RIR allocated addresses to NIOS and assign specific address blocks to ISP organizations, as described
in Adding and Assigning RIR Networks on page 560.
• View a list of organization objects, as described in Viewing RIR Organizations on page 569.
• Review the reassignment information before sending the updates to RIPE, as described in Previewing
Registration Updates on page 569.
• Modify RIR organizational data and attributes, as described in Modifying RIR Organizations on page 560.
• Modify RIR network data and attributes, as described in Modifying RIR Network Data on page 561.
• Delete RIR organizations, as described in Deleting RIR Organizations on page 560.
• Delete delegated addresses from an organization, as described in Deleting RIR Networks on page 562.

558 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing RIR Data

Adding RIR Organizations

Before you can submit any RIR updates to the RIPE database, you must first add the RIR organization and its
corresponding data to NIOS. You can also create additional organizations for ISP customers.
To add an organization:
1. From the Administration tab, select the RIR tab, and then click Add -> RIPE Organization.
2. In the Add RIPE Organization wizard, complete the following:
— Internet Registry: The default is RIPE. This is the RIR that allocates address blocks to your organization. You
cannot change this.
— Organization Name: Enter the name of the organization that holds the resources allocated by RIPE NCC. You
can enter up to 256 characters. Enter the name in this format: A list of words separated by white space. A
word can be made up of letters, digits, the character underscore "_", and the character hyphen "-". The first
character of a word must be a letter or digit and the last character of a word must be a letter, digit or a
period. For example, you can enter SPRINT REGION2.
— Organization ID: Enter the handle or ID of the organization. You can enter up to 23 characters. Enter the ID in
this format: Start with ORG- followed by two to four characters, then followed by up to five digits and a
source specification. Note that the first digit cannot be "0". The source specification starts with "-" followed
by the source name that contains up to nine characters in length. For example, you can enter
ORG-CA1-RIPE or ORG-CB2-TEST.
— Maintainer: Enter the name of the maintainer for this organization. This is required. You can enter up to 256
characters; however, note that the RIPE database has an 80 characters limit for this field. A maintainer is
any registrant or person to whom the authority to update has been delegated by another registrant either
directly or indirectly, and who holds an identifier that allows updates to be authenticated and authorized.
Data entered here must match exactly how the maintainer appears in RIPE.
Enter the maintainer name in this format: Use letters, digits, the character underscore "_", and the character
hyphen "-". The first character must be a letter, and the last character must be a letter or a digit. You cannot
use the following words (they are reserved by RPSL): any, as-any, rs-any, peer, as, and, or, not, atomic, from,
to, at, action, accept, announce, except, refine, networks, into, inbound, outbound. Also note the following:
Names starting with certain prefixes are reserved for certain object types. For example, names starting with
"as-" are reserved for as set names. Names starting with "rs-" are reserved for route set names. Names
starting with "rtrs-" are reserved for router set names. Names starting with "fltr-" are reserved for filter set
names. Names starting with "prng-" are reserved for peering set names. Names starting with "irt-" are
reserved for irt names.
— Password: Enter the maintainer password. This is required. You can enter up to 256 characters.
— Retype Password: Enter the same password.
— Maintainer Email: Enter the originating or source email address of the maintainer. This is required.
RIR Organizational Attributes: This table lists all predefined RIR attributes associated with the RIR organization.
Click the Value field of an attribute in the table to enter a value. The Required field indicates whether a value for
the corresponding attribute is required.
You can add custom attributes by clicking the Add icon and select an attribute from the drop-down list. You can
also delete an RIR attribute by selecting its check box and clicking the Delete icon.
For information about the attributes and how to enter their values, see RIR Organizational Attributes on page
563.

Note: You cannot leave an optional RIR attribute value empty. If you do not have a value for an RIR attribute, you
must delete it from the table. You can enter up to 256 characters for all RIR attributes.

3. Save the configuration. Note that you cannot schedule the creation, modification, or deletion of an RIR
organization.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 559

RIR Registration Updates

Modifying RIR Organizations

To modify an RIR organization:
1. From the Administration tab, select the RIR tab -> rir_organization check box, and click the Edit icon.
2. In the Organization editor, modify the organization information, as described in Adding RIR Organizations on
page 559. You can also reorder the list of RIR organizational attributes using the up and down arrows.
3. Save the configuration.

Deleting RIR Organizations

You can delete an RIR organization that does not have any networks assigned to it. When you delete an RIR
organization, the appliance moves it to the Recycle Bin, if enabled. You can later restore the network if needed. For
information about the Recycle Bin, see Using the Recycle Bin on page 73.
To remove an RIR organization:
1. From the Administration tab, select the RIR tab -> rir_organization check box, and then click the Delete icon.
2. In the Delete Confirmation (RIR Organization) dialog box, click Yes.

Adding and Assigning RIR Networks

Before you can assign network addresses within an RIR allocated address block to an organization, you must first add
the allocated address block to NIOS. Infoblox supports IPv4 and IPv6 network containers and networks. You can also
create network templates that are specific for RIR networks. For information about creating network templates, see
About IPv4 Network Templates on page 1146 and About IPv6 Network Templates on page 1154.
Note that when you add network containers or networks to NIOS, the appliance does not validate whether the
corresponding networks actually exist in the RIPE database. Even though you can create the networks in NIOS, the
submission of updates for the network may fail. For example, if you create a child network and the parent network is
not registered in RIPE, the registration update will fail.
In addition, each network can only be associated with an RIR in one network view. If you have a network address block
registered with RIPE in a specific network view, you must not register the same address block in a different network
view.
When you enable the support for updates of RIR registrations, Grid Manager displays the appropriate data fields that
you can use to add or modify RIR related networks. You can do the following to add IPv4 and IPv6 networks:
• Add RIR allocated IPv4 networks to NIOS, or assign addresses to specific organizations. For information see
Adding IPv4 Networks on page 1111.
• Add RIR allocated IPv6 networks to NIOS, or assign addresses to specific organizations. For information, see
Adding IPv6 Networks on page 1161.
• Add IPv4 network templates that are specific to RIR address allocation. For information, see About IPv4 Network
Templates on page 1146.
• Add IPv6 network templates that are specific to RIR address allocation. For information, see About IPv6 Network
Templates on page 1154.
You can also do the following to modify specific data about the RIR networks:
• Modify RIR allocated or assigned IPv4 networks. For information see Modifying IPv4 Networks on page 1118.
• Modify RIR allocated or assigned IPv6 networks. For information see Modifying IPv6 Networks on page 1165.
• Modify IPv4 network templates that are specific to RIR address allocation. For information, see Modifying IPv4
Network Templates on page 1148.
• Modify IPv6 network templates that are specific to RIR address allocation. For information, see Modifying IPv6
Network Templates on page 1156.
You can preview the information before the appliance submits updates to the RIPE database. To preview registration
updates, click Preview RIR Submissions in the Add IPv4 Network or Add IPv6 Network wizards. For more information,
see Previewing Registration Updates on page 569.

560 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing RIR Data

Note: You can also add RIR networks through Task Dashboard. For information, see The Tasks Dashboard on page
119.

After you create an RIR network container or network, you can perform the following:
• Split a network that has an organization ID. A child network that is created does not contain an organization ID
by default. You must assign an organization ID to the child network after splitting it. For information about
splitting an RIR network, see Splitting IPv4 Networks into Subnets on page 592 and Splitting IPv6 Networks into
Subnets on page 606.
• Resize an IPv4 RIR network that contains an organization ID and has been registered with RIPE. For more
information, see Resizing IPv4 Networks on page 591.

Viewing RIR networks

You can view a list of IPv4 and IPv6 RIR networks in the Data Management tab -> IPAM tab or the Data Management
tab -> DHCP tab -> Networks tab -> Networks section. For more information, see IPAM Home on page 590 and Viewing
Networks on page 1115.

Modifying RIR Network Data

You can modify certain RIR network information in the RIR Registration tab of the IPv4 and IPv6 Network editors.
To modify RIR network information, complete the following:
1. From the Data Management tab, select the IPAM tab -> network check box, and then click the Edit icon.
or
From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network check box,
and then click the Edit icon.
2. In the IPv4 or IPv6 Network Container or Network editor, click the RIR Registration tab, and then complete the
following to modify RIR related data for the IPv4 or IPv6 network container or network:
— Internet Registry: Displays the RIR that allocates RIR address blocks. The default is RIPE. You cannot change
this.
— Organization ID: Displays the organization ID with which this network is associated. You cannot change this.
— Registration Status: Displays the current registration status. This can be Registered or Not Registered.
Registered indicates that the network has a corresponding entry in the RIPE database. Note that when you
select API as the communication method, the registration status will be updated automatically after the
registration update is completed. However, when you select Email as the communication method, the
registration status will not be automatically updated. You can modify this by selecting the appropriate
status from the drop-down list.
— Status of last update: Displays the registration status, communication method, timestamp of the last
registration update. The status can be Pending, Sent, Succeeded, or Failed. The displayed timestamp
reflects the timestamp used on the Grid Master. Each time you send a registration update to create, modify,
or delete a network container or network, the updated status and timestamp will be displayed here. If you
have selected not to send the registration update, the previous status and timestamp are retained.
— Registration Action: From the drop-down list, select what you want to do with the RIR network updates. If
you are creating a top-level network block that has already been assigned to the organization, select None.
If you are creating a child network within the allocated address block, you can select one of the following:
— None: The appliance does not submit the updates.
— Create: The appliance creates the network container or network for the specified organization.
— Modify: Modifies data for this network container or network.
— Delete: Deletes the RIR network from the organization. When you select this, you must enter a reason
for deleting this entry in the Delete Reason field.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 561

RIR Registration Updates

— Do not update registrations: By default, the appliance sends updates to RIPE if you specify Create, Modify,
or Delete as the registration action. Select this if you do not want the appliance to submit updates to the
RIPE database.
RIR Network Attributes: Modify the value of RIR network attributes by clicking the Value field of an attribute and
entering a new value. You can add a new RIR network attribute by clicking the Add icon and selecting an
attribute from the drop-down list. You can also select any optional attributes and click the Delete icon to delete
them. For information about RIR network attributes, see RIR Network Attributes on page 565.
You can enter up to 256 characters for all RIR network attributes, unless otherwise noted.
Preview RIR Submissions: Click this to view the updates before the appliance submits them to the RIPE
database. This button is enabled only when the registration action is Create, Modify, or Delete, and the Do not
update registrations check box is not selected. For more information, see Previewing Registration Updates on
page 569.
To schedule this task, click the Schedule icon at the top of the wizard. In the Schedule Change panel, click Later,
and then specify a date, time, and time zone.
3. Save the configuration.

Deleting RIR Networks

When you delete an RIR network or network container, the appliance moves it to the Recycle Bin, if enabled. You must
enter the reason for deleting the RIR network or network container and indicate whether you want to send the deletion
update to RIPE. You can delete multiple networks at the same time.
To delete an RIR network or network container:
1. From the Data Management tab, select the IPAM tab -> network check box, and then click the Delete icon. You can
choose to delete the network immediately or schedule its deletion.
2. In the Delete Confirmation (IPv4 or IPv6 Network) or Schedule Deletion dialog box, complete the following:
— Justification: Enter the reason for deleting this network.
— Do not update registrations: Select this check box if you do not want the appliance to submit updates to
RIPE.
3. Optionally, you can click Preview RIR Submissions to view the RIR network information before deleting the
network. Grid Manager displays the preview data in a separate browser window. For information, see Previewing
Registration Updates on page 569
4. Click Yes. If you are scheduling a deletion, enter the data and time for execution, and then click Schedule
Deletion.

Managing RIR Attributes

Before you can successfully submit RIR data updates, you must ensure that all RIR required attributes contain valid
values that can be mapped to data in the RIPE database. The appliance does not validate data with the RIPE database
before you submit your updates. The appliance also does not synchronize data from the database.

Note: RIPE does not support UTF-8 data in the Description and Remarks fields. After an upgrade, the NIOS appliance
keeps the UTF-8 data in these fields. However, if you want to modify these fields after the upgrade, you must
remove the UTF-8 data before you can save the changes.

When you enter a value for the following RIR attributes that cannot be mapped to a valid reference in the RIPE
database, updates to the RIR database will fail. However, these values will still be displayed in the IPv4 or IPv6
network or network container panels of Grid Manager.
• RIPE Routes Maintainer
• RIPE Lower Level Maintainer

562 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing RIR Attributes

• RIPE Reverse Domain Maintainer

• RIPE Admin Contact
• RIPE Technical Contact
• RIPE Computer Security Incident Response Team
You can add multiple values for certain RIR attributes. When you add multiple values of the same attribute, the
appliance groups the values in the order they are listed in the attribute table. You can also reorder the RIR attributes
using the up and down arrows in the attribute tables.

RIR Organizational Attributes

The following table lists RIR organizational attributes, the format you must use to enter values, and whether they are
required or optional.

Corresponding Required/
Organizational Attribute RIPE Attribute Description and Format Optional
RIPE Description descr Enter a short description about the organization. Optional
RIPE Country country From the drop-down menu, select the country name, Required
followed by the two-letter ISO 3166 country code, of
the country or area within the RIPE NCC service
region or through Local Internet Registries.
RIPE Admin Contact admin-c Enter the name of the on-site admin contact for the Required
organization. Enter the name in this format: Start
with two to four optional characters, followed by up
to six optional digits, and then follow by a source
specification. The first digit cannot be "0". The
source specification starts with "-" followed by the
source name that contains up to nine characters in
length.
RIPE Technical Contact tech-c Enter the name of the technical contact for the Required
organization. Enter the name in this format: Start
with two to four optional characters, followed by up
to six optional digits, and then follow by a source
specification. The first digit cannot be "0". The
source specification starts with "-" followed by the
source name that contains up to nine characters in
length.
RIPE Remarks remarks Enter remarks about the organization. Optional
RIPE Notify notify Enter the email address to which notifications of Optional
changes to the organization will be sent.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 563

RIR Registration Updates

Corresponding Required/
Organizational Attribute Description and Format
RIPE Attribute Optional
RIPE Registry Source source From the drop-down list, select the registry at which Optional
the organization is registered. The default is RIPE.
Select RIPE for the RIPE database, which is the
authoritative database. Select TEST for the RIPE
TEST database that operates in the same way as the
RIPE database but contains only test data. Note that
test data is cleaned out at the start of each month
and a predetermined set of basic objects is
re-inserted. You can use the RIPE TEST database to
learn how to update the database and try out
special scenarios. The RIPE TEST database has fewer
restrictions which allows you to create
encompassing or parent objects you may need for
testing.
RIPE Organization Type org-type From the drop-down list, select one of the following Optional
organization type:
• IANA for Internet Assigned Numbers Authority
• RIR for Regional Internet Registry
• NIR for National Internet Registry
• LIR for Local Internet Registry
• WHITEPAGES for special industry people
• DIRECT_ASSIGNMENT for direct contract with
RIPE NCC
• OTHER for all other organizations

Note: Only the RIPE database admin can set

the organization type, and there are no
NIRs in the RIPE NCC service region.

RIPE Address address Enter the organization address. Optional

RIPE Phone Number phone Enter the organization phone number in numeric Optional
format starting with the + character, followed by the
country code, area code, and the phone number. For
example, you can enter +18089991000. You can
also use one of the following formats:
• '+' <integer-list>
• '+' <integer-list> "(" <integer-list> ")" <integer-list>
• '+' <integer-list> ext. <integer list>
• '+' <integer-list> "(" integer list ")" <integer-list>
ext. <integer-list>

564 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing RIR Attributes

Corresponding Required/
Organizational Attribute Description and Format
RIPE Attribute Optional
RIPE Fax Number fax-no Enter the organization fax number in numeric format Optional
starting with the + character, followed by the country
code, area code, and the fax number. For example,
you can enter +16052529000. You can also use one
of the following formats:
• '+' <integer-list>
• '+' <integer-list> "(" <integer-list> ")" <integer-list>
• '+' <integer-list> ext. <integer list>
• '+' <integer-list> "(" integer list ")" <integer-list>
ext. <integer-list>
RIPE Email email Enter the organization email address. Required
RIPE Abuse Mailbox abuse-mailbox Enter the email address to which abuse complaints Optional
are sent.
RIPE Reference Notify ref-nfy Enter the email address to which notifications are Optional
sent when a reference to the organization object is
added or removed.

RIR Network Attributes

When you create or edit an RIR associated network, ensure that you enter valid values for the RIR network attributes.
The following table lists RIR network attributes, the format you must use to enter values, and whether they are
required or optional:

Corresponding Required/
Network Attributes RIPE Attribute Descriptions and Formats
Optional
RIPE Admin Contact admin-c The name of the on-site admin contact for the Required
network address. This attribute is populated from
the organizational attribute.
You can modify the value in this format: Start with
two to four optional characters, followed by up to six
optional digits, and then follow by a source
specification. The first digit cannot be "0". The
source specification starts with "-" followed by the
source name that contains up to nine characters in
length.
RIPE Computer Security mnt-irt The name of the Computer Security Incident Optional
Incident Response Team Response Team (CSIRT) that handles security
incidents for the network address.
You can enter the value in this format: Use letters,
digits, the character underscore "_", and the
character hyphen "-". The value must start with
"irt-", and the last character of a name must be a
letter or a digit. You must enter a minimum of five
characters.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 565

RIR Registration Updates

Corresponding Required/
Network Attributes Descriptions and Formats
RIPE Attribute Optional
RIPE Country country The two-letter ISO 3166 country code of the country Required
within the RIPE NCC service region or through Local
Internet Registries. This attribute is populated from
the organizational attribute. You can select a
different country code from the drop-down list.
RIPE Description descr Enter a short description about the network. Required
RIPE IPv4 Status status The status of the IPv4 network address. From the Required
drop-down list, select one of the following status:
ALLOCATED PA
ALLOCATED PI
ALLOCATED UNSPECIFIED
LIR-PARTITIONED PA
LIR-PARTITIONED PI
SUB-ALLOCATED PA
ASSIGNED PA
ASSIGNED PI
ASSIGNED ANYCAST
EARLY-REGISTRATION
NOT-SET
RIPE IPv6 Status status The status of the IPv6 network address. From the Required
drop-down list, select one of the following:
ALLOCATED-BY-RIR
ALLOCATED-BY-LIR
ASSIGNED
ASSIGNED ANYCAST
ASSIGNED PI

566 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing RIR Attributes

Corresponding Required/
Network Attributes Descriptions and Formats
RIPE Attribute Optional
RIPE Lower Level mnt-lower Enter the name of the registered maintainer for Optional
Maintainer hierarchical authorization purposes. This can
protect the creation of networks directly (one level)
below in the hierarchy of a network container or
another network. The authentication method of the
maintainer will be used upon creation of any
network directly below the network that contains
the "mnt-lower:" attribute.
Enter the maintainer name in this format: Use
letters, digits, the character underscore "_", and the
character hyphen "-". The first character must be a
letter, and the last character must be a letter or a
digit. You cannot use the following words (they are
reserved by RPSL): any, as-any, rs-any, peer, as,
and, or, not, atomic, from, to, at, action, accept,
announce, except, refine, networks, into, inbound,
outbound. Also note the following: Names starting
with certain prefixes are reserved for certain object
types. Names starting with "as-" are reserved for as
set names. Names starting with "rs-" are reserved
for route set names. Names starting with "rtrs-" are
reserved for router set names. Names starting with
"fltr-" are reserved for filter set names. Names
starting with "prng-" are reserved for peering set
names. Names starting with "irt-" are reserved for irt
names.
RIPE Network Name netname The name of the IP address range. You can enter up Required
to 80 characters. Enter the network name in this
format: Use letters, digits, the character underscore
"_", and the character hyphen "-". The first character
must be a letter, and the last character must be a
letter or a digit.
RIPE Notify notify Enter the email address to which notifications of Optional
changes to the object must be sent.
RIPE Registry Source source From the drop-down list, select the registry at which Required
the organization is registered. The default is RIPE.
Select RIPE for the RIPE database, which is the
authoritative database. Select TEST for the RIPE
TEST database that operates in the same way as the
RIPE database but contains only test data. Note that
test data is cleaned out at the start of each month
and a predetermined set of basic objects is
re-inserted. You can use the RIPE TEST database to
learn how to update the database and try out
special scenarios. The RIPE TEST database has
fewer restrictions which allows you to create
encompassing or parent objects you may need for
testing.
RIPE Remarks remarks Enter remarks about the network. Optional

NIOS 7.3 NIOS Administrator Guide (Rev. A) 567

RIR Registration Updates

Corresponding Required/
Network Attributes Descriptions and Formats
RIPE Attribute Optional
RIPE Reverse Domain mnt-domains Enter the name of a registered maintainer used for Optional
Maintainer reverse domain authorization. This can protect
domain objects. The authentication method of this
maintainer will be used for any encompassing
reverse domain object.
Enter the maintainer name in this format: You can
use letters, digits, the character underscore "_", and
the character hyphen "-". The first character must be
a letter, and the last character must be a letter or a
digit. You cannot use the following words (they are
reserved by RPSL): any, as-any, rs-any, peer, as,
and, or, not, atomic, from, to, at, action, accept,
announce, except, refine, networks, into, inbound,
outbound. Also note the following: Names starting
with certain prefixes are reserved for certain object
types. Names starting with "as-" are reserved for as
set names. Names starting with "rs-" are reserved
for route set names. Names starting with "rtrs-" are
reserved for router set names. Names starting with
"fltr-" are reserved for filter set names. Names
starting with "prng-" are reserved for peering set
names. Names starting with "irt-" are reserved for irt
names.
RIPE Routes Maintainer mnt-routes This attribute references a maintainer that is used in Optional
determining authorization for the creation of route
objects. Enter the name in this format: Start with the
reference to the maintainer, followed by an optional
list of prefix ranges inside of curly brackets or the
keyword "ANY". The default, when no additional set
items are specified, is "ANY". For more information,
refer to RFC-2622. Example: <mnt-name> [ { list of
<address-prefix-range> } | ANY ].
RIPE Technical Contact tech-c The name of the technical contact for the network. Required
Enter the name in this format: Start with two to four
optional characters, followed by up to six optional
digits, and then follow by a source specification.
The first digit cannot be "0". The source
specification starts with "-" followed by the source
name that contains up to nine characters in length.

568 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring RIR Data

Monitoring RIR Data

You can view RIR organizations and networks you added to NIOS through Grid Manager. The appliances sends SNMP
traps and email notifications about registration updates. It also logs RIR events in the Infoblox syslog. Note that
sometimes due to network timeout from RIPE, your registration updates may fail.
You can do the following to monitor RIR data:
• View RIR update events in the syslog, as described in Viewing the Syslog on page 1341.
• View RIR organizations, as described in Viewing RIR Organizations on page 569.
• View RIR IPv4 and IPv6 network containers and networks, as described in IPAM Home on page 590 and Viewing
Networks on page 1115.
• Preview RIR updates before submitting them to RIPE, as described in Previewing Registration Updates on page
569.

Viewing RIR Organizations

You can view the list of RIR organizations that have received address allocation and the ones you have added
associated networks.
To view RIR organizations:
1. From the Administration tab, select the RIR tab.
2. Grid Manager displays the following information for each RIR organization:
— Organization ID: The RIR organization ID.
— RIR: The RIR that allocates the address block to the organization.
— Maintainer: The name of the maintainer for the organization.
You can also select Organization Name and RIR organizational attributes for display.
You can do the following in this tab:
• Modify some of the data in the table. Double click a row, and either modify the data in the field or select an item
from a drop-down list. Click Save to save the changes. Note that some fields are read only.
• Sort the data in ascending or descending order by column.
• Select an organization and click the Edit icon to modify data, or click the Delete icon to delete it.
• Click the Permissions icon to configure permissions for the admin account.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information about quick filters, see Using Quick
Filters on page 77.
• Print and export the data in this tab.

Previewing Registration Updates

Before the appliance submits RIR updates to RIPE, you can preview the data in Grid Manager. The appliance uses the
email template when displaying preview data in a separate browser window.
Preview data includes the subject line for the email, followed by the inetnum or inet6num template for the network
and other associated data, such as network name, organization name, and others. When there are multiple
operations involved, such as deleting multiple networks, the preview data includes a separate subject line for each
operation.
You can preview registration updates when you create a new RIR network. In the Add Networks wizard, click Preview
RIR Submissions in the wizard. For information about how to create or assign RIR networks, see Adding and Assigning
RIR Networks on page 560.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 569

RIR Registration Updates

Following is a sample preview for a network creation request:

Subject: CREATE inetnum 100.200.0.0 - 100.200.255.255 KEYWORDS: NEW
inetnum: 100.200.0.0 - 100.200.255.255
netname: corp100_network
descr: RIR network for Corp100.
status: ASSIGNED PA
org: ORG-MC1-TEST
country: US
source: TEST
changed: [email protected] 20120809
notify: [email protected]
admin-c: NP1-TEST
tech-c: NP1-TEST
mnt-by: JohnDoe
password: ***
password: ***
Following is a sample preview for a network modification request:
Subect: MODIFY inetnum 100.200.0.0 - 100.200.255.255 KEYWORDS:
inetnum: 100.200.0.0 - 100.200.255.255
netname: corp100_network
descr: RIR network for Corp100.
status: ASSIGNED PA
org: ORG-MC1-TEST
country: US
source: TEST
changed: [email protected] 20120809
notify: [email protected]
admin-c: NP1-TEST
tech-c: NP1-TEST
mnt-by: JohnDoe
password: ***
Following is a sample preview for deleting multiple networks:
Subect: DELETE inetnum 100.200.0.0 - 100.200.255.255 KEYWORDS:
inetnum: 100.200.0.0 - 100.200.255.255
netname: corp100_network
descr: RIR network for Corp100.
status: ASSIGNED PA
org: ORG-MC1-TEST
country: US
source: TEST
changed: [email protected] 20120809
notify: [email protected]

570 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring RIR Data

admin-c: NP1-TEST
tech-c: NP1-TEST
mnt-by: JohnDoe
password: ***
delete: Removed network.

Subect: DELETE inetnum 100.300.0.0 - 100.300.255.255 KEYWORDS:

inetnum: 100.300.0.0 - 100.300.255.255
netname: corp200_network
descr: RIR network for Corp200.
status: ASSIGNED PA
org: ORG-MC1-TEST
country: US
source: TEST
changed: [email protected] 20120809
notify: [email protected]
admin-c: NP1-TEST
tech-c: NP1-TEST
mnt-by: JohnSmith
password: ***
delete: Removed network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 571

RIR Registration Updates

572 NIOS Administrator Guide (Rev. A) NIOS 7.3

Part 3 IP Address Management
IPAM (IP Address Management) is the allocation, administration, reporting, and tracking of IP addresses, network
devices, and their associated data. This section provides information about IPAM and how to use the Infoblox tools
to perform IPAM tasks and manage your entire IP network. It includes the following chapters:
• Chapter 13, IP Address Management, on page 575
• Chapter 14, IP Discovery and vDiscovery, on page 617
• Chapter 15, Infoblox Network Insight, on page 653

NIOS 7.3 NIOS Administrator Guide (Rev. A) 573

574 NIOS Administrator Guide (Rev. A) NIOS 7.3
Chapter 13 IP Address Management
This chapter describes how to manage your networks and IP addresses through the Infoblox IPAM (IP Address
Management) implementation. It contains the following sections:
• About IP Address Management on page 577
• About Host Records on page 578
— Assigning Multiple IP Addresses to a Host on page 579
— Adding Host Records on page 579
— Copying and Modifying Host Records on page 583
• About Network Containers on page 584
— Adding IPv4 and IPv6 Network Containers and Networks on page 585
— Modifying IPv4 and IPv6 Network Containers and Networks on page 585
— Deleting Network Containers on page 585
• Managing IPv4 Networks on page 586
— IPv4 Network Map on page 586
— IPAM Home on page 590
— Resizing IPv4 Networks on page 591
— Splitting IPv4 Networks into Subnets on page 592
— Joining IPv4 Networks on page 592
— Discovering Networks (Under Network Insight only) on page 593
• Viewing and Managing IPv4 Addresses on page 594
— IP Map on page 594
— IP Address List on page 595
— Managing IPv4 Addresses on page 600
— Managing IPv4 Addresses on page 600
• Managing IPv6 Networks on page 602
— IPv6 Network Map on page 602
— IPv6 Network List on page 606
— Splitting IPv6 Networks into Subnets on page 606
— Joining IPv6 Networks on page 607
• Viewing IPv6 Data on page 607
• Viewing Identity Mapping Information on page 614
— Viewing Active Network Users on page 615
— Viewing Network Users Login History on page 616
• Managing IPv4 and IPv6 Addresses on page 608

NIOS 7.3 NIOS Administrator Guide (Rev. A) 575

IP Address Management

— Converting Objects Associated with IP Addresses on page 609

— Reclaiming Objects Associated with IPv4 and IPv6 Addresses on page 612
— Pinging IP Addresses on page 612
— Clearing Active DHCP Leases on page 612
• Configuring Thresholds for IPAM Utilization on page 613
• About Network Insight on page 614
• Viewing Identity Mapping Information on page 614
— Viewing Active Network Users on page 615
— Viewing Network Users Login History on page 616
— Configuring Active User Timeout Session on page 616

576 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IP Address Management

About IP Address Management

IPAM is the allocation, administration, reporting, and tracking of public and private IP spaces, network devices, and
their associated data. It comprises the deployment of DNS and DHCP services and the monitoring of network devices
and performance to ensure data integrity and security of your networks.
The Infoblox IPAM implementation is a feature-rich and easy-to-use solution that encompasses support for IPv4, IPv6,
network discovery, and automated monitoring.
Infoblox IPAM provides tools that integrate the allocation, administration, reporting, and tracking of your entire
network space. Figure 13.1 highlights the Infoblox IPAM implementation.

Figure 13.1 Infoblox IPAM Features

Allocation Administration Reporting Tracking

Configure networks and Use network maps The Dashboard Use network discovery
allocate IP addresses to and IP maps to view provides widgets that to track your network
network devices. and administer your monitor IPAM and devices and monitor
Resize, join, or split entire network space, network statistics. network performance.
networks. and manage the IP Configure how you
The syslog and audit
addresses of your want the Infoblox
Use Infoblox host log provide detailed
network devices. appliance to populate
records to centralize the information about
the discovered data.
management of DNS system and admin
and DHCP data. activities. Use DHCP fingerprint
detection to track
The reporting solution
network devices, block
automates the
those that are not
collection, analysis,
allowed, and plan for
and presentation of
future growth.
core network service
data.

You can perform the following IPAM tasks to effectively manage and control your network:
• Create host records. Host records integrate the DNS records and DHCP data of a network device. You can use a
host record to manage a network device from one central point. For more information, see About Host Records
on page 578.
• Create IPv4 and IPv6 networks. For information, see About Network Containers on page 584.
• Discover devices in IPv4 and IPv6 networks and other Objects created in IPAM. For more information, see
Adding IPv4 and IPv6 Network Containers and Networks on page 585, Adding Host Records on page 579 and
other sections throughout this chapter. View your IPv4 network and address utilization in a graphical mode. For
information, see IPv4 Network Map on page 586 and IP Map on page 594.
• When necessary, resize, join, or split networks. For information, see Resizing IPv4 Networks on page 591,
Splitting IPv4 Networks into Subnets on page 592, Joining IPv4 Networks on page 592, Splitting IPv6 Networks
into Subnets on page 606, and Joining IPv6 Networks on page 607.
• Manage IPv4 and IPv6 address data. For information, see Viewing and Managing IPv4 Addresses on page 594,
Viewing IPv6 Data on page 607, and Managing IPv4 and IPv6 Addresses on page 608.
• Add and manage DNS resource records associated with IP addresses. For information, see DNS Resource
Records on page 875.
• Monitor your core service network data using the Dashboard, audit log, syslog, and reports. For information, see
Part 7 Monitoring and Reporting on page 1323.
• Discover and track network devices. For information, see IP Discovery and vDiscovery on page 617 and DHCP
Fingerprint Detection on page 1357.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 577

IP Address Management

About Host Records

Host records provide a unique approach to the management of DNS, DHCP, and IPAM data. By using host records, you
can manage multiple DNS records and DHCP and IPAM data collectively, as one object on the appliance.
When you create a host record, you are specifying the name-to-address and address-to-name mappings for the IP
address that you assign to the host. The Infoblox DNS server then uses this data to respond to DNS queries for the
host. When the server receives a name-to-address query, it responds with an A record for an IPv4 host or an AAAA
record for an IPv6 host that contains the data from the host record. Likewise, when it receives an address-to-name
query for the host, the appliance responds with a PTR record that contains data from the host record. Additionally, if
you specify an alias in the host record, the appliance uses this data as a CNAME record to respond to queries with
the alias. It maps the alias to the canonical name and sends back a response with the canonical name and IP address
of the host. Thus, a single host record is equivalent to creating A, PTR, and CNAME resource records for an IPv4
address and AAAA and PTR records for an IPv6 address. The appliance supports IDNs for a host record. You can
specify alias and domain names in the native character set. For information about IDN support, see Support for
Internationalized Domain Names on page 113.
Hosts also support prefix delegation for IPv6. For example, you can specify an IPv6 prefix in the host record of a router.
The router then advertises this prefix on one of its interfaces, so hosts that connect to the interface can generate their
IP addresses, using the stateless autoconfiguration mechanism defined in RFC 2462, IPv6 Stateless
Autoconfiguration.
In addition, if the Infoblox DHCP server manages the IP address assigned to the host, the server uses it as a fixed
address record as well. The DHCP server assigns the IP address to the host when it receives a DHCP request with the
matching MAC address or DUID. Its response includes configuration information, and any DHCP options defined for
the host or inherited from the network to which the fixed address belongs. You can also assign multiple IPv4 and IPv6
addresses to a host, as described in Assigning Multiple IP Addresses to a Host on page 579.
You can copy an existing host record and turn it into a new one. When you copy a host record, other than the new host
name and IP address, all DHCP and IPAM configuration including the MAC address and extensible attributes apply to
the new record. You can also modify information, except for the host name and IP address, of an existing host record.
For information about how to copy or modify a host record, see Copying and Modifying Host Records on page 583.
Note that you can also modify an IPv4 host record and turn it into a IPv4 reservation. For information, see Configuring
IPv4 Reservations on page 1131.
You can execute immediate discovery on a host record. This simple setting enables you to determine the precise type
of device that is associated with the host, along with its IP addresses, its name and other information.
You can define extensible attributes for a host record to further describe the device. You can include information such
as its location and owner for IP address management purposes. For information about extensible attributes, see
About Extensible Attributes on page 417.
Figure 13.2 illustrates how the appliance uses the host record for both DHCP and DNS.

Figure 13.2 Using the Host Record for DHCP and DNS

1 The DHCP client sends its MAC DNS and 1 A resolver sends a query for the IP
address in the DHCP DISCOVER DHCP address of ftp.corp.100.com.
and REQUEST packets. server

2 The appliance responds with the A

DHCP 2 The appliance determines the
network segment of the host and record of ftp.corp.100.com: DNS
Client Resolver
matches the MAC address with the ftp.corp100,com
Host record. It assigns the fixed internet address=10.1.1.7
address from the host record and ttl = 86400 (10)
includes the configuration
settings and DHCP options
inherited from the network.
ftp.corp100.com

578 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Host Records

Note that If the zone of the host record is associated with networks, the IP addresses must belong to the associated
networks. For example, if the host record is in the corp100.com zone, which is associated with 10.1.0.0/16 network,
then the IP addresses of the host record must belong to the 10.1.0.0/16 network. For information about associating
zones and networks, see Associating Networks with Zones on page 1093.

Assigning Multiple IP Addresses to a Host

You can assign multiple IPv4 and IPv6 addresses to a host depending on the function of the device. For example, you
can create a host record for a router that supports three network interfaces in two different networks, and assign IP
addresses to each interface, as illustrated in Figure 13.3. When the DNS server responds to DNS queries for the host,
it includes an A or AAAA record for each IP address.
In addition, if the IP addresses belong to different networks, they can have different DHCP configurations and
options. As shown in Figure 13.3, the configuration information and DHCP options of the interface with the IPv6
address 2001:db8:1::2 may be different from the other two interfaces, 10.31.209.5 and 10.31.209.7, because it is
in a different network.

Figure 13.3 Assigning Multiple IP Addresses to one Host Record

LAN 1: 2001:db8:1::/48
You create a host record for
the router and assign
three IP addresses to it.
Router has
three network
Host Record interfaces
Server
2001:db8:1::2

=
10.31.209.5

NIOS Appliance 10.31.209.7

LAN 2: 10.31.209.0/24 Web Server

Adding Host Records

You can add host records from the Toolbar of the IPAM, DHCP and DNS tabs of the Data Management tab and from
the Tasks Dashboard. For information about the Tasks Dashboard, see The Tasks Dashboard on page 119.
When you create a host record, you must specify its zone and at least one IP address. If the zone of the host record
is associated with one or more networks, the IP addresses must belong to one of the associated networks. If a zone
of a host record contains IDNs, the appliance displays the zone name in the native character set.
For Cloud Network Automation, you can create host records within a delegated network view only when you enable
DNS for the host record.
To add a host from the Data Management tab:
1. From the IPAM, DHCP or DNS tab of the Data Management tab, expand the Toolbar.
2. Click Add and select the option to add a host from the drop-down menu.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 579

IP Address Management

3. In the first page of the Add Host wizard, do the following:

— Name: If Grid Manager displays a zone name, enter the host name here. The displayed zone name can
either be the last selected zone or the zone from which you are adding the host. If no zone name appears or
if you want to specify a different zone, click Select Zone. When there are multiple zones, Grid Manager
displays the Zone Selector dialog box. Click a zone name in the dialog box, and then enter a unique name
for the host. The name you enter is prefixed to the DNS zone name that is displayed, and the complete
name becomes the FQDN (fully qualified domain name) of the host. For example, if the zone name
displayed is corp100.com and you enter admin, then the FQDN is admin.corp100.com.
— Enable in DNS: This is selected by default. It enables DNS service for the host. If you clear this check box,
DNS does not serve this host and you cannot assign it to a zone.
— DNS View: Displays the DNS view for the host record. This appears only when you enable the host record in
DNS.
— Host Name Policy: Displays the host name policy of the selected zone. This appears only when you enable
the host record in DNS.
— RRset Order: Select one of the following RRset orders that the appliance uses to return A and AAAA records
of the host. This check box appears only when you have enabled the configuration of RRset order for the
Grid and there are multiple IP addresses in this host record. For information about how to enable this
feature, see Enabling the Configuration of RRset Orders on page 759.
— Cyclic: The records are returned in a round robin pattern. This is the default.
— Fixed: The records are returned in the order you specify in this host record. When you select this check
box, the appliance displays up and down arrows next to the IPv4 and IPv6 address tables. You can use
these arrows to reorder the address list. The appliance returns the A and AAAA records of this host
based on the order you define in the address tables.
— Random: The records are returned in a random order.
Note that when you specify Fixed as the RRset order, the appliance places the resource records as follows:
• A and AAAA records of the host in the fixed order you specify in the address tables. Note that the
order of the returned A and AAAA records are independent of each other.
• Other A and AAAA records in an undefined order.
• Other record types in the default cyclic order.
For more information about RRset order, see Enabling the Configuration of RRset Orders on page 759.
— In the IPv4 Addresses and IPv6 Addresses sections, specify the IP addresses of the host record. Click the
Add icon do one of the following:
— Select Next Available IP Address to retrieve the next available IP address in a network. Infoblox
recommends this option to ensure that you assign an IP address from the appropriate network.
If the host record is in a zone that has one associated network, Grid Manager retrieves the next available
IP address in that network.
If the host record is in zone that has multiple associated networks, the Network Selector dialog box lists
the associated networks. If the zone has no network associations, the Network Selector dialog box lists
the available networks. When you select a network, Grid Manager retrieves the next available IP address
in that network.
If you want to enter a link-local IPv6 address, you must enter an IPv4 address and the host MAC address
first, and then click the Add (+) icon again to enter the link-local IPv6 address. When you select the
link-local IPv6 address, the MAC address is automatically filled in. For information, see Understanding
DNS for IPv6 on page 747.
Optionally, you can delete an IP address from the host by selecting an IP address in the table and clicking
the Delete icon.
or
— Select Add Address to enter an IPv4 or IPv6 address. You can also enter an IPv6 prefix. Note that when
you use this option, you could specify an IP address from a network that has not yet been defined. To
avoid this, use the Next Available IP Address option instead.

580 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Host Records

— MAC Address: For an IPv4 address, enter the MAC address of the network device associated with this
host IP address. Note that you must enter a MAC address if DHCP is enabled for the host IP address.
or
— DUID: For an IPv6 address, enter the DHCP Unique Identifier (DUID) of the network device associated
with this host IP address. Note that you must enter a DUID if DHCP is enabled for an IPv6 host address.
— DHCP: Select this to enable the DHCP services to manage the host IP address. If you do not select this
option, the host IP address is not managed by the DHCP server.
— Comment: Optionally, enter additional information about the host record.
— Disable: Select this option to temporarily disable the host record. For example, you might want to disable a
host when you need to update the network device.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. This section displays the following
information:
• Cloud Usage: This field indicates whether this object is associated with any specific cloud extensible
attributes or within a scope of delegation. It can be one of the following:
— Cloud from adapter: Indicates that this object has been created by a cloud adapter and it may or may
not be within a scope of delegation at the moment.
— Cloud from delegation: Indicates that this object is within the scope of delegation or the object itself
defines a scope of authority delegation, and it is not created by a cloud adapter.
— Used by cloud: Indicates that this network or network container is associated with the extensible
attribute Is External or Is Shared and the value is set to True, which implies the network is a private or
shared network managed by the CMP, and it is not Cloud from adapter or Cloud from delegation.
— Non-cloud: The object is a regular NIOS object and is not within the scope of any authority delegation
nor is it associated with any of these extensible attributes: Cloud API Owned, Is External or Is Shared.
NIOS admin users can modify this object based on their permissions.
• Owned By: A cloud object can be owned by the Grid Master or the cloud adapter. When the object is created
by the Grid Master, this shows Grid. If the object is created by the cloud adapter, this shows Adapter.
Delegate authority from the Grid Master
— Delegate To: This field indicates whether the authority for the object you want to create has already been
delegated. If so, it displays the name of the delegation.
4. (Applies only to Network Insight) In the current Wizard step, you can optionally define the following identification
values and settings for the new object’s port reservation:
— Choose the Device Type: Router, Switch-Router, Switch, MSFT (Microsoft) Server, NetMRI, NIOS, VNIOS, or
ESX (VMware) Server.
The values on this page are not required for defining the actual port reservation in a later wizard step.
— Choose the Device Vendor: Cisco, Juniper, Aruba, Dell, Infoblox, or HP.
— You can also enter a Location and a Description. These values are advisory and not required for
configuration.
After you define this group of settings, you will still need to define a device port reservation.
5. (Applies only with Network Insight) Click Next to initiate or disable discovery of the new host.
— Choose either Exclude from Network Discovery or Enable Immediate Discovery. If you choose to Exclude,
discovery will not execute on the host. If you choose Enable Immediate Discovery, discovery will execute on
the host after you save your settings. You may also choose to leave both options disabled.
— By default, the new host inherits its SNMP credentials from those defined at the grid level. Should you wish
to override them for a local set of credentials, check the Override Credentials check box and select the
SNMPv1/SNMPv2 or SNMPv3 option and enter the locally used credentials. For more information, see the
sections Configuring SNMP1/v2 Credentials for Polling on page 680 and Configuring SNMPv3 Properties
on page 680 for a complete description of SNMP credentials for discovery. (You can also test SNMP
credentials to ensure they work before use.)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 581

IP Address Management

— For the new object, you can check the Override CLI Credentials check box to override the inherited set of CLI
credentials taken from the Grid level. This set of credentials may be used for the device that is directly
associated with the new object (in this case, a Host) in its port reservation.
— You can also click Test CLI Credentials to enter and test a set of CLI login credentials against a device based
on its IP address.
Port control operations require CLI credentials for the involved devices. (If you are not using port control for
the new object, usage of CLI credentials is optional.) Because some IPAM and DHCP objects will use port
control features as part of object creation, CLI credentials are automatically leveraged as part of discovery.
Ensure you have the correct sets of CLI credentials for devices in your network. For more information, the
section Configuring CLI Discovery Properties on page 681.
— SSH is the default for CLI operations. Check the Allow Telnet check box if you know the device involved in
the object assignment may support Telnet but may not support SSH, or if you want Telnet as an option.
6. (Applies only with Network Insight) Click Next to define switch port connectivity for the device that will be
associated with the new host record. This step is optional and not required for creating the new host record. This
feature set is also termed port control in Grid Manager. The device to which the new host record will be
associated should already be discovered and managed from Grid Manager.
— Begin by checking the Reserve Port check box. Note that reserving a switch port does not guarantee its
availability.
Optionally, you can skip connecting port configuration by clicking Next.
Click the Clear button to remove the selected device from the configuration.
— Click the Select Device button to choose the device for which the port reservation will be associated. You
should know the identity of the device to whose interface the new object will be associated before taking
this step. For more information, see the section Using the Device Selector on page 689.
— After choosing the device, choose the Interface with which the port reservation will be bound. The
drop-down list shows only interfaces that are most recently found to be available by Grid Manager during
the last discovery cycle. This list will not include any ports that are Administratively Up and Operationally
Up or that are otherwise already assigned to other networks or objects.
— The Wizard page also shows a list of any VLANs that are currently configured in the chosen device (The
following VLANs are configured). This Wizard page allows only the assignment of an existing VLAN in the
chosen device to the new port reservation.
— Check the Configure Port check box to define specific port control settings for the port reservation.
— Choose the Data VLAN and/or the Voice VLAN settings you may need for the port assignment. Depending
on the selected device, you may or may not be able to apply VLAN settings.
— Set the Admin Status to Up if you need to activate the port after assignment in the current task.
All port control operations require CLI credentials to be entered into Grid Manager. Because some IPAM and
DHCP objects will use port control features as part of object creation, CLI credentials are automatically
leveraged as part of discovery and configuration of port configurations such as Admin Up/Down status.
Ensure you have the correct sets of CLI credentials for devices in your network.
— Enter a Description for the port assignment. Infoblox recommends doing so to help other technicians to
recognize the port assignment task.
7. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
8. As the final step in the Add Host wizard, you define when Grid Manager creates the new object by scheduling it.
As a separate task, you also schedule when the associated Port Configuration task executes.
— To create the new Host and its associated port reservation immediately, select Now. The port control event
is automatically synchronized to take place at the same time as the activation of the new host.
— You can choose to have Grid Manager execute the port reservation at the same time as the host object
creation. To do so, select At same time as Host.
— You can have Grid Manager execute the port reservation at a later time by selecting Later. Choose a
Selected time by entering or selecting a Start Date (click the calendar icon to choose a calendar date) and a
Start Time, and choose a Time Zone.

582 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Host Records

9. Choose one of the following from the Save & ... drop-down button menu:
— Click Save & Close to add the Host object and close the wizard (this is the default).
— Click Save & Edit to add the Host object and launch the editor.
— Click Save & New to add the Host object and launch the wizard again to add another Host object.

Copying and Modifying Host Records

You can create a new host record by copying an existing one. When you copy a host record, other than the new host
name and IP address, all DHCP and IPAM configuration including the MAC address and extensible attributes apply to
the new record. You can also modify information, except for the host name and IP address, of an existing host record.
To copy or modify an existing host record:
1. From the Data Management tab, select the IPAM, DHCP, or DNS tab.
2. In the selected tab, search for or navigate to the host record that you want to copy or modify.
3. Do one of the following:
• To copy a host record, select the record and expand the Toolbar, and then click Add -> Host -> Copy Host.
Grid Manager displays the Host Record editor.
• To modify a host record, select the record and click the Edit icon. Grid Manager displays the Host Record
editor.
4. The Host Record editor provides the following tabs from which you can modify all the fields:
— General: Enter the new hostname and specify at least one IP address. Optionally, you can modify the
information you entered through the wizard as described in Adding Host Records on page 579.
Note that when you are modifying a DHCP enabled host address, you can apply IPv4 logic filters.
To apply IPv4 logic filters, complete the following in the IPv4 Addresses section:
— Select the IP address and click the Edit icon.
— Click the IPv4 Filters tab in the Advanced tab and complete the following:
• IPv4 Filters: You can keep the inherited IPv4 logic filters or override them and add a new IPv4 logic
filter. For information, see Applying Filters to DHCP Objects on page 1204.
— Device Information: You can change advisory Device Information settings for the object’s port reservation;
settings are described in the section Adding Host Records on page 579.
— TTL: This tab displays the default TTL settings the record inherited from the Grid or the DNS zone, if you
enabled override TTL settings at the zone level. You can keep the default settings or override them. To
override the inherited value, click Override to enable the configuration. Specify how long the record is
cached. Select the time period in seconds, minutes, hours, days, or weeks from the drop-down list. To
enable the record to inherit the Grid or zone TTL settings, click Inherit.
— Aliases: Click the Add icon. Grid Manager displays a new row in the table. Enter a fully qualified domain
name (a CNAME record for the host) in the Aliases column. You can delete an alias by selecting the alias
check box and clicking the Delete icon.
— IPv4 Discovered Data: Displays the discovered data of the IPv4 addresses, if any, of the host record. For
information, see Viewing Discovered Data on page 642.
— Port Reservation: Review and edit any device port reservations that may be defined for the current object, or
create a new port reservation and schedule it. For a closer look, see the section Port Control Features in
Network Insight on page 714, and steps 4-8 in the section Adding Host Records on page 579.
— IPv6 Discovered Data: Displays the discovered data of the IPv6 addresses, if any, of the host record. For
information, see Viewing Discovered Data on page 642.
— Extensible Attributes: You can add and delete extensible attributes that are associated with a host record.
You can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see About
Administrative Permissions on page 195.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 583

IP Address Management

5. Save the configuration and click Restart if it appears at the top of the screen.

About Network Containers

Grid Manager uses network containers to group IPv4 and IPv6 networks. A network container is a parent network that
contain other network containers and leaf networks. A leaf network is a network that does not contain other networks.
For example, Figure 13.4 illustrates the IPv4 20.0.0.0/8 network, which is a network container with two network
containers, 20.8.0.0/13 and 20.72.0.0/13. The 20.8.0.0/13 network has two leaf networks, 20.8.0.0/16 and
20.9.0.0/16. The 20.72.0.0/13 network has one leaf network, 20.72.0.0/16.

Figure 13.4 IPv4 Network Container

20.8.0.0/16 20.9.0.0/16 20.72.0.0/16

20.8.0.0/13 20.72.0.0/13

20.0.0.0/8

From Grid Manager, you can click the link of the network container 20.0.0.0/8 in the IP List panel and drill down to
the two network containers, 20.8.0.0/13 and 20.7.0.0/13, as shown inFigure 13.5. You can click the network
container links to drill down further to the leaf networks.

Figure 13.5 IP List View of Network Containers

584 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Network Containers

In the IPAM tab, when you create an IPv4 or IPv6 network that belongs to a larger network, the appliance automatically
creates a network container and puts the leaf network in the container. The appliance also creates network containers
when you split IPv4 or IPv6 networks into smaller networks. For information, see Splitting IPv4 Networks into Subnets
on page 592 and Splitting IPv6 Networks into Subnets on page 606.

Adding IPv4 and IPv6 Network Containers and Networks

To add an IPv4 or IPv6 network container or network:
1. From the Data Management tab, select the IPAM tab.
2. Click the Add icon and select either IPv4 Network or IPv6 Network.
3. In the Add Network wizard, create a network as described in Adding IPv4 Networks on page 1111 or Adding IPv6
Networks on page 1161.

Modifying IPv4 and IPv6 Network Containers and Networks

You can modify existing network settings, with the exception of the network address and subnet mask.
To modify an IPv4 or IPv6 network container or network:
1. From the Data Management tab, select the IPAM tab -> network check box, and then click the Edit icon.
2. In the DHCP Network editor, modify the network settings as described in Modifying IPv4 Networks on page 1118
or Modifying IPv6 Networks on page 1165.

Deleting Network Containers

Depending on the configuration, you may or may not be able to delete or schedule the deletion of a network container
and all its contents. Contents in a network container can include other network containers, leaf networks, and
associated objects. For recursive deletions, only network containers and networks are considered. Objects such as
hosts are not considered for recursive deletions.
Superusers can determine which group of users are allowed to delete or schedule the deletion of a network container
and all its contents. For information about how to configure the recursive deletion of network containers, see
Configuring Recursive Deletions of Networks and Zones on page 327.
Note that you must have Read/Write permission to all the contents in order to delete a network container. When you
delete a network container only, the appliance reparents the other network containers and leaf networks.
The appliance puts all deleted objects in the Recycle Bin, if enabled. You can restore the objects if necessary. When
you restore a parent object from the Recycle Bin, all its contents, if any, are re-parented to the restored parent object.
For information about the Recycle Bin, see Using the Recycle Bin on page 73.
To delete a network container:
1. From the Data Management tab, select the IPAM tab -> network_container check box. You can select multiple
network containers for deletion.
2. Click the Delete icon.
3. Do one of the following in the Delete Confirmation dialog box:
• Select one of the following. Note that these options appear only if you are allowed to delete the network
container and all its contents. For information about how to configure this, Configuring Recursive Deletions
of Networks and Zones on page 327.
— Delete only the network container and re-parent the subnets: Select this to delete only the network
container and re-parent its subnets.
— Delete the network container and all its subnetworks: Select this to delete both the network and its
contents.
• Click Yes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 585

IP Address Management

The appliance puts the deleted network container in the Recycle Bin, if enabled. You can also schedule the deletion
for a later time. Click Schedule Deletion and in the Schedule Change panel, enter a date, time, and time zone. For
information, see Scheduling Deletions on page 90. For information about scheduling recursive deletions of network
containers, see Scheduling Recursive Deletions of Network Containers and Zones on page 90.

Managing IPv4 Networks

In Grid Manager, you use the Net Map (network map) and List panels to manage your IPv4 network infrastructure.
After you select a network container from the IPAM tab, Grid Manager displays it in the Net Map panel, by default. The
Net Map panel provides a graphical view of your networks and has a number of features that simplify network
management. The List panel displays the networks in table format.
You can always switch your view of a network container between the Net Map and List panels. Grid Manager keeps
track of which panel you last used. When you select a network container, Grid Manager displays it in the Net Map or
List panel, depending on which one you last used. For information about each panel, see IPv4 Network Map on page
586 and IPAM Home on page 590.
Use the IP Map and List panels to manage the IP addresses in leaf networks. For information, see Viewing and
Managing IPv4 Addresses on page 594.
After you create an IPv4 network, you can modify its properties, resize it, use the split network feature to create
subnets, enable discovery to discover routers, switches, firewalls, wireless access points and other device types
within it, or join it to another network to create a larger network that encompasses adjacent subnets. You can do the
following from both the Net Map and List panels:
• Resize a network. For information, see Resizing IPv4 Networks on page 591.
• Split a network into subnets. For information, see Splitting IPv4 Networks into Subnets on page 592.
• Join a network. For information, see Joining IPv4 Networks on page 592.
• Discover devices in the network. For information, see Discovering Networks (Under Network Insight only) on
page 593.

IPv4 Network Map

After you select an IPv4 network container from the IPAM tab, Grid Manager displays it in the Net Map (network map)
panel, by default. Net Map provides a high-level view of your IPv4 network address space. You can use Net Map to
design and plan your network infrastructure, configure and manage individual networks, and evaluate their
utilization. Its unique display of the IPv4 network address space across multiple rows is similar to a road map that
starts with the first IP address in the network and ends with the last address. Net Map displays the network address
space across a maximum of eight rows, depending on the size of the network. It automatically scales the map so that
it displays the entire address space of a network container.
The Net Map panel presents a complete view of the network space, including the different types of networks that are
in it and its unused address space. IP addresses that belong to a network are blocked off. Each color-coded block
represents a network container, a leaf network, or a block of networks that are too small to be displayed individually
in the map. For example, in a /8 or /16 network, networks smaller than /20 or /28 respectively and that are beside
each other are represented as a multiple network block. In addition, the fill pattern of the blocks indicates their
utilization. Therefore, you can quickly evaluate how many and what type of networks are in a network container, their
relative sizes, utilization, and how much space you have left.
As you mouse over areas of the map, it displays IP information about the area. Net Map also has a zoom feature that
allows you to enlarge or reduce your view of a particular area.
Figure 13.6 displays the network map of a 20.0.0.0/8 network, which is a network container that has network
containers and leaf networks.

586 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv4 Networks

Figure 13.6 20.0.0.0/8 Network Map

Network address Network container Network container Unused address space that was
that is 50% utilized that is 100% utilized selected. Note that the selection
wraps to the next row.

Leaf network with no A block of Net Map displays information about Start and end
used IP addresses multiple this network container after you addresses of the
networks mouse over it network container

Displaying IP Information
As shown in Figure 13.6, as you mouse over the map, Net Map displays IP information about the area. When you
mouse over an unused area, Net Map displays the following information:
• The start and end IP address
• The number of IP addresses that can fit in that space
• The largest possible network
• The number of /16 and /24 networks that can fit in that space
When you mouse over a network, Net Map displays the following information:
• Network address and netmask
• Utilization of the network. For a leaf network, Net Map reports the percentage of used IP addresses, except the
broadcast and network addresses. For a network container, Net Map reports the percentage of the IP address
space that has been allocated to either network containers or leaf networks.
• The first and last IP address of the network
• The total number of IP addresses in the network
When you mouse over a block of multiple networks, Net Map displays the following information:
• The start and end IP address of that block of networks
• The total number of IP addresses in that block of networks
• The number of networks in that block

NIOS 7.3 NIOS Administrator Guide (Rev. A) 587

IP Address Management

Zooming In and Out

Use the zoom function to enlarge and reduce your view of a selected area. You can zoom in on any area in your
network. You can zoom in on an area until it displays 128 addresses per row, for a total of 1024 addresses for the
map. When you reach the last possible zoom level, the Zoom In icon in the Net Map task bar and the menu item are
disabled.
After you zoom in on an area, you can click the Zoom Controller icon to track where you zoomed in. The Zoom
Controller lists all the areas that you zoomed in and updates its list dynamically. You can click an item on the list to
view that area again. Click the Zoom Controller again to close it.
To select an area and zoom in:
1. Right-click and select Zoom In, or click the Zoom In icon in the Net Map task bar.
The pointer changes to the zoom in selector.
2. Select a starting point and drag to the end point. The starting point can be anywhere in the map. It does not have
to be at the beginning of a network.
Net Map displays a magnified view of the selected area after you release the mouse button. As you mouse over
the zoomed in area, Net Map displays IP information about it.
3. You can do the following:
• Select an area and zoom in again.
• Add a network. If you zoom in on an area and click Add without selecting an open area first, Net Map selects
the area where it can create the biggest possible network in that magnified area.
• Select a network and perform any of the following operations:
— Split the network.
— Join it to another network.
— Resize the network.
— Edit its properties.
— Open it to display its network or IP map.
• Right-click and select Zoom Out, or click the Zoom Out icon in the Net Map task bar. Each time you click
Zoom Out, Net Map zooms out one level and the Zoom Controller is updated accordingly.

Net Map Tasks

From Net Map, you can create IPv4 networks, and evaluate and manage your network resources according to the
needs of your organization. You can do the following:
• Zoom in on specific areas, as described in Zooming In and Out on page 588.
• Add a network, as described in Adding a Network from Net Map.
• Select a network and view either its network or Net Map, as described in Viewing Network Details on page 590.
• Select a network and edit its properties, as described in Modifying IPv4 and IPv6 Network Containers and
Networks on page 585.
• Split a network, as described in Splitting IPv4 Networks into Subnets on page 592.
• Join networks, as described in Joining IPv4 Networks on page 592.
• Resize a network, as described in Resizing IPv4 Networks on page 591.
• (Applies only with Network Insight) Execute vDiscovery on the selected network, as described in Configuring
vDiscovery Jobs on page 630.
• (Applies only with Network Insight) View Discovery Status for the selected network, as described in Viewing
Discovery Status on page 710.
• (Applies only with Network Insight) Execute Discovery Diagnostics on the selected network, as described in
Executing Discovery Diagnostics on page 712.

588 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv4 Networks

• (Applies only with Network Insight) Direct NIOS to discover devices on the selected network (Discover Now). The
network must have discovery enabled before this button will be active. For more information about
requirements and discovery features, see the topics under About Network Insight on page 656.

Note: If the Discover Now button and other associated discovery elements are disabled on the Toolbar, it
indicates that discovery is not enabled for the parent network of the selected network or IP, or the network
is not associated with a discovery appliance.

• Delete one or multiple networks, as described in Discovering Networks (Under Network Insight only) on page
593.
• Clear All Unmanaged Data or Clear All Discovered Data, as described in the section Clearing Discovered Data on
page 649.
• Switch to the List view of the network. For information, see IPAM Home on page 590.
— When you select one or more networks in Net Map and then switch to the List view, the list displays the
page with the first selected network.
— If you select one or more networks in the List view and then switch to the Net Map view, the first network is
also selected in Net Map. If you select a network in the List view that is part of a Multiple Networks block in
Net Map, it is not selected when you switch to the Net Map view.

Adding a Network from Net Map

When you create networks from Net Map, you can evaluate your network infrastructure and add networks accordingly.
You can view the address space to which you are adding a network, so you can determine how much space is
available and which IP addresses are not in use. When you mouse over an open area, Net Map displays useful
information, such as the largest possible network that fits in that area and the total number of IP addresses. In
addition, you can create networks without having to calculate anything. When you add a network, Net Map displays
a netmask slider so you can determine the appropriate netmask for the size of the network that you need. As you
move the slider, it displays network information, including the total number of addresses. After you select the
netmask, you can even move the new network around the open area to select another valid start address.
To add a network from the Net Map panel:
1. Do one of the following:
• Click the Add icon.
Net Map displays the netmask slider and outlines the open area that can accommodate the largest
network.
• Select an open area, and then click the Add icon.
Net Map displays the netmask slider and outlines the largest network that you can create in the open area
that you selected.
2. Move the slider to the desired netmask. You can move the slider to the netmask of the largest network that can
be created in the open area.
As you move the slider, Net Map displays the netmask and its corresponding number of IP addresses. The
outline in the network map also adjusts as you move the slider. When you mouse over the outline, it displays
the start and end address of the network.
3. After you set the slider to the desired netmask, you can drag the new network block around the open area to
select a new valid starting address. You cannot move the block to a starting address that is invalid.
4. Click Launch Wizard to create the network.
The Add Network wizard displays the selected network address and netmask.
5. You can add comments, automatically create reverse mapping zones, and edit the extensible attributes. (For
information, see Adding IPv4 Networks on page 1111.) You cannot change the network address and netmask.
6. Save the configuration and click Restart if it appears at the top of the screen. Grid Manager updates Net Map with
the newly created network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 589

IP Address Management

Viewing Network Details

From the Net Map panel, you can focus on a specific network or area and view additional information about it. If you
have a network hierarchy of networks within network containers, you can drill down to individual leaf networks and
view their IP address usage.
1. Select a network or area.
2. Click the Open icon.
— If you selected a network container, Grid Manager displays it in the Net Map panel. You can drill down
further by selecting a network or open area and clicking the Open icon again.
— If you selected a block of multiple networks, Grid Manager displays the individual networks in the Net Map
panel. You can then select a network or open area for viewing.
— If you selected a leaf network, Grid Manager displays it in the IP Map panel.
— If you selected an open area, Grid Manager displays an enlarged view of that area in the Net Map panel.
This is useful when you are creating small networks in an open area.

IPAM Home
The IPAM Home panel is an alternative view of an IPv4 and IPv6 network hierarchy. For a given network, the panel
shows all the networks of a selected network view in table format. This panel displays only the first-level subnets. It
does not show further descendant or child subnets. You can open a subnet to view its child subnets. Subnets that
contain child subnets are displayed as network containers. If the number of subnets in a network exceeds the
maximum page size of the table, the network list displays the subnets on multiple pages. You can use the page
navigation buttons at the bottom of the table to navigate through the pages of subnets.
The IPAM home panel displays the following:
• Network: The network address.
• Comment: The information you entered about the network.
• RIR Organization: This appears only if support for RIR updates is enabled. This displays the name of the RIR
organization to which the network is assigned.
• RIR Organization ID: This appears only if support for RIR updates is enabled. This displays the ID of the RIR
organization to which the network is assigned.
• RIR Registration Status: This appears only if support for RIR update is enabled. This field displays the RIR
registration status. This can be Registered or Not Registered. Registered indicates that the network has a
corresponding entry in the RIPE database.
• Last Registration Updated: Displays the timestamp when the last registration was updated. The displayed
timestamp reflects the timestamp used on the Grid Master.
• Status of Last Registration Update: Displays the registration status and communication method of the last
registration update. The status can be Pending, Sent, Succeeded, or Failed. Each time you send a registration
update to create, modify, or delete a network container or network, the updated status will be displayed here. If
you have selected not to send registration updates, the previous status is retained.
• IPAM Utilization: For a network, this is the percentage based on the IP addresses in use divided by the total
addresses in the network. For example, in a /24 network, if there are 25 static IP addresses defined and a DHCP
range that includes 100 addresses, the total number of IP addresses in use is 125. Of the possible 256
addresses in the network, the IPAM utilization is about 50% for this network.
For a network container that contains subnets, this is the percentage of the total address space defined within
the container regardless of whether any of the IP addresses in the subnets are in use. For example, when you
define a /16 network and then 64 /24 networks underneath it, the /16 network container is considered 25%
utilized even when none of the IP addresses in the /24 networks is in use.
You can use this information to verify if there is a sufficient number of available addresses in a network. The
appliance updates the IPAM utilization data immediately for a network container, but for a network it is updated
every 15 minutes.
The IPAM utilization data is displayed in one of the following colors:

590 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv4 Networks

— Red: The IPAM utilization percentage is above the configured Trigger value.
— Blue: The IPAM utilization percentage is below the configured Trigger value.
• Active Users: The number of active users on the selected network.
• Site: The site to which the IP address belongs. This is a predefined extensible attribute.
You can select the following columns for display:
• Disabled: Indicates whether the network is disabled.
• Leaf Network: Indicates whether the network is a leaf network or not. A leaf network is a network that does not
contain other networks.
• Discovery Enabled: (Applies only with Network Insight) Indicates whether discovery is allowed on the network
container or the network.
• Managed: (Applies only with Network Insight) Indicates whether the network is set to Managed status under
Grid Manager. For more information, see the section Converting Unmanaged Networks under IPAM to Managed
Status on page 694.
• First Discovered: (Applies only with Network Insight) The date and timestamp of the first occasion that Grid
Manager discovered the network.
• Last Discovered: (Applies only with Network Insight) The date and timestamp of the last occasion that Grid
Manager performed discovery on the network.
• Extensible attributes and RIR attributes: You can select the extensible attributes such as Building, Country,
Region, State, and VLAN for display. When you enable support for RIR registration updates, you can also select
associated RIR attributes for display. For information about RIR attributes, see Managing RIR Attributes on page
562.
• Active Directory Sites: You can also select Active Directory Sites for display. For information about Active
Directory Sites, see About Active Directory Sites and Services on page 1267.
You can sort the list of networks in ascending or descending order by columns. For information about customizing
tables in Grid Manager, see Customizing Tables on page 69.
You can also modify some of the data in the table. Double click a row of data, and either edit the data in the field or
select an item from a drop-down list. Note that some fields are read-only. For more information about this feature,
see Modifying Data in Tables on page 70.

Tip: If you select a network from the list and switch to the Net Map panel, the network is also selected in the network
map.

Filtering the Network List

You can filter the network list, so it displays only the networks you need. You can filter the list based on certain
parameters, such as network addresses, comments and extensible attributes. When you expand the list of available
fields you can use for the filter, note that the extensible attributes are those with a gray background.

Resizing IPv4 Networks

You can resize a network to increase or decrease the network size and the number of IP addresses in the network.
When you resize a network to a smaller netmask, you increase the number of IP addresses within that network. You
can change the size of an IPv4 network when the operation does not affect existing objects in the network. You can
resize an existing network only if the resized network does not exceed the upper network limit or create orphan
objects, such as hosts and DHCP ranges. When a network has a parent network or subnets, the upper limit of the
network size is marked in red in the resize network slider, and you cannot resize beyond this limit. For example, if a
network has a /16 parent network, you cannot resize the network to a network that is larger than /16.
Before you resize an RIR allocated network block, ensure that the network block has already been registered at the
corresponding RIR. Otherwise, when you reassign addresses within this block, the registration updates may fail. For
information about RIR registration updates, see RIR Registration Updates on page 555.
To resize a network:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 591

IP Address Management

1. From the Net Map or List panel, select a network, and then click Resize from the Toolbar.
2. In the Resize Network editor, do the following:
— Address: Displays the network address. You cannot modify this field.
— Netmask: Displays the netmask of the network as you resize the network. You cannot modify this field.
— Resize slider: Use the resize network slider to specify the appropriate subnet masks for the subnets. When
you move the slider, Grid Manager displays the number of subnets and IP addresses within that subnet.
— Automatically create reverse-mapping zone: This is enabled only when you resize a /8, /16, or /24 network.
Select this check box to have the appliance automatically create reverse-mapping zones for the subnet. The
appliance automatically creates reverse-mapping zones only for /8, /16, and /24 netmasks.
3. Click OK.

Splitting IPv4 Networks into Subnets

You can create smaller subnets simultaneously within a network by splitting it. You do not have to configure each
subnet individually. You can create smaller subnets with larger netmasks. A larger netmask defines more networks
with a smaller number of IP addresses.
These subnets inherit the address properties of the parent network, such as member assignments. The exceptions
are the default router and broadcast address configuration. The default router and broadcast address configuration
for address ranges and fixed address are disabled by default after splitting a network. You can enable these
properties for each subnet after splitting the parent network.
Note that you cannot split a network that is part of a shared network.
To split a network:
1. From the Net Map or List panel, select the check box of a network, and then click Split from the Toolbar.
2. In the Split Network editor, do the following:
— Address: Displays the network address. You cannot modify this field.
— Netmask: Displays the netmask of the network. You cannot modify this field.
— Subnetworks: Displays the number of subnets and IP addresses for each subnet.
— Split network slider: Use the split network slider to specify the appropriate subnet masks for each subnet.
When you move the slider, Grid Manager displays the number of subnets and the IP address range within
that subnet.
— Immediately Add: Select one of the following options.
— Only networks with ranges and fixed addresses and unmanaged: Adds only the networks that have
DHCP ranges, fixed addresses, and unmanaged addresses.
— All possible networks: Adds all networks that are within the selected netmasks. The is enabled only
when you split the /8 networks to /9 or /16 networks.
Note that when you add a large number of networks, it could take a little longer for Grid Manager to display
the networks.
— Automatically create reverse-mapping zone: Select this check box to have the appliance automatically
create reverse-mapping zones for the subnets.
3. Click OK.

Joining IPv4 Networks

Joining multiple networks into a larger network is the opposite of splitting a network. You can select a network and
expand it into a larger network with a smaller netmask. A smaller netmask defines fewer networks while
accommodating a larger number of IP addresses. Joining or expanding a network allows you to consolidate all of the
adjacent networks into the expanded network. Adjacent networks are all networks falling under the netmask of the
newly-expanded network. You can expand the selected network to a new size and add all other subnets into the new
network. When you join networks, you need not define all small networks that cover the address spaces for a larger
network.

592 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv4 Networks

Each of the adjacent networks join the expanded network and inherit the DHCP member configuration options of the
selected network. The expanded network does not inherit the default router and broadcast address configurations of
the adjacent networks. Those configurations are disabled by default.

Note: The member assignment for the expanded network combines all member assignments of the joining
networks.

Note that the join and resize features work identically only when you have a single network. If the resize feature is
disabled and if you have a single network object with additional new networks, then you must use the join feature to
combine all networks.
To join or expand a network:
1. From the Net Map or List panel, select a network, and then click Join from the Toolbar.
2. In the Join Network editor, do the following:
— Address: Displays the network address. You cannot modify this field.
— Netmask: Displays the netmask of the network as you expand the network.
— Join Network slider: Use the join network slider to specify the available subnet masks for the newly
expanded network. Select a smaller netmask value, based on your requirements of the newly-expanded
network. When you move the slider, a dialog box displays the total number of IP addresses and the IP
address range of a selected subnet mask.
— Automatically create reverse-mapping zone: Select this check box to configure the expanded network to
support reverse-mapping zones Adding Grid Members on page 297
3. Click OK.

Discovering Networks (Under Network Insight only)

Note: If the Discover Now button and other associated discovery elements are disabled on the Toolbar, it indicates
that discovery is not enabled for the parent network of the selected network or IP, or that a discovery appliance
(known as a Probe) is not associated with the network that you wish to discover.

To discover IPv4 or IPv6 networks:

1. From the Net Map or List panel, select a network, and then click Discover Now from the Toolbar.
NIOS asks you to confirm that you wish to launch discovery on the selected network.
In the Net Map panel, you can click on IP addresses in the network being discovered. As new data becomes available,
NIOS updates the Discovered Data section of the panel with any information found on the device associated with the
selected IP.
For more information about requirements and discovery features, see the topics under About Network Insight on
page 656.

Deleting Networks
From the IPAM tab, you can delete multiple IPv4 and IPv6 networks. When you delete a network, all of its data,
including all of its DHCP records, subnets, and records in its subnets, is deleted from the database and goes to the
Recycle Bin, if enabled. Because of the potentially large loss of data that can occur when you delete a network, Grid
Manager requires a confirmation to move the data to the Recycle Bin.
To delete IPv4 or IPv6 networks:
1. From the Data Management tab, select the IPAM tab -> network check box. You can select multiple check boxes
for multiple networks.
2. Select Delete or Schedule Delete from the Delete drop-down menu.
3. To delete the network now, in the Delete Confirmation dialog box, click Yes. To schedule a deletion, see About
Extensible Attributes on page 417.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 593

IP Address Management

The appliance puts the deleted network in the Recycle Bin, if enabled.

Viewing and Managing IPv4 Addresses

You can view and manage IPv4 address data in the IP Map and IP List panels. Grid Manager displays the IP Map and
List panels for a specific network after you navigate through the network hierarchy, or when the selected network
does not have subnets under it.

IP Map
The IPv4 Map panel provides a graphical representation of all IPv4 addresses in a given subnet. IP Map displays cells
that represent IPv4 addresses. Each cell in the map represents an IPv4 address, and its color indicates its status as
described in the legend section. You can run a network discovery on the selected network, and the status of each IP
address is updated accordingly. For information, see Chapter 14, IP Discovery and vDiscovery, on page 617.
Each IP Map panel can accommodate up to 256 cells with each cell representing an IP address. If a given network has
more than 256 addresses, additional IP addresses are displayed by paging to the next page. You can use the page
navigation buttons to page through the IP addresses. To go to a specific IP address, you can enter the IP address in
the Go to field or click a specific cell in IP Map.
IP Map has a basic and an advanced view. You can toggle between these views by clicking Toggle Basic View or Toggle
Advanced View.
In the basic view, the IP Map panel displays the following IP address status:
• Unused: An IP address that has not been detected and is not associated with any network device or active host
on the network.
• Conflict: An IP address that has either a MAC address conflict or a DHCP lease conflict detected through a
network discovery.
• Used: An IP address that is associated with an active host on the network. It can be a resource record, fixed
address, reservation, DHCP lease, or host record.
• Selected IP Address: The IP address that you selected.
• DHCP Range: The IP addresses within a DHCP range in the network. The appliance highlights the cells using a
blue background.
• Reserved Range: A range of IP addresses that are reserved for statically configured hosts. They are not served as
dynamic addresses. You can allocate the next available IP from the reserved range when you create a static
host.
In the advanced view, the IP Map panel displays additional status as follows:
• Unmanaged: An IP address that has a discovered host, is not previously known to the appliance, and does not
have an A record, PTR record, fixed address, host address, lease, or is not within a DHCP range. You can change
an unmanaged address to a host, DHCP fixed address, A record, or PTR record. You can also clear an unmanaged
address. All existing administrator permissions apply to the unmanaged addresses.
• Fixed Address/Reservation: A host that is either a fixed address or reservation.
• DNS Object: An object that is configured for DNS usage.
• Host Not in DNS/DHCP: An IP address that is associated with a host record, but is not configured for DHCP or
DNS services.
• Active Lease: An IP Address that has an active DHCP lease.
• DHCP Exclusion Range: A range of IP addresses within a DHCP range. The appliance cannot assign addresses in
the exclusion range to a client. You can use these addresses as static IP addresses. This prevents address
conflicts between statically configured devices and dynamically configured devices.

594 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing and Managing IPv4 Addresses

Note: For a Microsoft split-scope range, the appliance highlights the cells using a combination of orange and
pink background colors when the network is managed by two Microsoft servers. For a DHCP exclusion
range, the appliance highlights the cells using an orange background.

Under the IP map, Grid Manager displays the following information for the IP address that you have selected in the
map:
• Type: The object type that is associated with the IP address. For example, this can be Lease, IPv4 DHCP Range or
Fixed Address.
• Comment: Additional information about the IP address.
• Lease State: The lease state of the IP address. This can be one of the following: Free, Backup, Active, Expired,
Released, Abandoned, Reset, BootP, Static, Offered, or Declined.
• Name: The name of the object type associated with the IP address. This field displays the name of the object
type in the native character set if a host record contains IDNs. If a host record contains IDNs in punycode, this
field displays the name in the punycode representation. For example, if the IP address belongs to a host record,
this field displays the hostname. For IDNs, this field displays the name in the native character set. If punycode is
used, then the appliance displays name in punycode.
• MAC Address: The discovered MAC address of the host. This is the unique identifier of a network device. The
discovery acquires the MAC address for hosts that are located on the same network as the Grid member that is
running the discovery. This can also be the MAC address of a virtual entity on a specified vSphere server. The
appliance displays an X mark beside the MAC address if it is invalid. For more information about invalid MAC
addresses, see Synchronizing IP Addresses with Invalid MAC Addresses on page 1306.
• DHCP Fingerprint: The name of the DHCP fingerprint or vendor ID of the network device that was identified
through DHCP fingerprint detection. This field displays No Match for devices that do not have any DHCP
fingerprint information. For information about DHCP fingerprints, see DHCP Fingerprint Detection on page 1357.
You can do the following in the IP Map panel:
• Click Go to DHCP View to view DHCP properties of a selected network.
• Select an address range by clicking once on a start address and then use SHIFT+click on the end address. Click
Add -> Range from the Toolbar to add the selected range as an IPv4 or IPv6 DHCP range or reserved range.
• Click the Resolve Conflict icon to resolve IP address conflicts. For information, see Resolving Conflicting
Addresses on page 647.
• Click the Ping icon to ping a selected IP address. For information, see Pinging IP Addresses on page 612.
• Click the Reclaim icon to reclaim an IP address. For information, see Reclaiming Objects Associated with IPv4
and IPv6 Addresses on page 612.
• Click the Clear icon to clear an active lease. For information, see Clearing Active DHCP Leases on page 612.
You can also select an IP address from the IP Map panel and view the following information:
• General information, as described in IP Address Header Panel on page 599.
• Data retrieved through a network discovery or integrated from a PortIQ appliance and Trinzic Network
Automation. For information, see Viewing Discovered Data on page 642.
• The records associated with the IP address, as described in Related Objects on page 608.
• The audit history, as described in Audit History on page 608.
• Detailed lease information, as described in Viewing Detailed Lease Information on page 1246.
• Click DHCP View to view DHCP properties of the selected network. For information, see Modifying IPv4 Networks
on page 1118.

IP Address List
The IP address List panel displays all IPv4 addresses of a selected subnet in table format. The list provides
information about the IP addresses in a hierarchy view. You can use this list to view detailed information about each
IP address and its related objects in a selected network. This list provides information such as address status, object
type, and usage.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 595

IP Address Management

You can configure filter criteria to display only IP addresses that you want to see in the table. For example, you can
enter “MAC Address begins with 00” as the filter criteria to view only IP addresses that have associated MAC
addresses that begin with 00. You can also enter a specific IP address in the Go to field to view information about the
address.
Grid Manager can display the following information for the IP addresses. You can edit the columns to display
information that is not shown by default.
• IP Address: The IP address of the corresponding record. The appliance highlights disabled DHCP objects in gray.
A DHCP object can be an DHCP address range, fixed address, reservation, host configured for DHCP, or roaming
host with an allocated IP address.
• Name: The name of the object type associated with the IP address. For example, if the IP address belongs to a
host record, this field displays the hostname.
• MAC Address: The discovered MAC address of the host. This is the unique identifier of a network device. The
discovery acquires the MAC address for hosts that are located on the same network as the Grid member that is
running the discovery. This can also be the MAC address of a virtual entity on a specified vSphere server.
• DHCP Client Identifier: For an IPv4 address, the DHCP Unique Identifier of the host.
• Port Reservation: Lists any Port Reservation from Network Insight that is associated with the IP address. The
information takes the form of device name:interface name.
• VIP: Indicates when the IP address is operating as a Virtual IP and operates in router redundancy.
• Status: The current status of the corresponding record. This can be Used or Unused.
• Type: The object type that is associated with the IP address. For example, this can be Broadcast, Lease, IPv4
DHCP Range or Fixed Address.
• Usage: Indicates whether the IP address is configured for DNS or DHCP.
• Lease State: The lease state of the IP address. This can be one of the following: Free, Backup, Active, Expired,
Released, Abandoned, Reset, BootP, Static, Offered, or Declined.
• User Name: The name of the user who received the lease for the IP address.
• Comment: Additional information about the IP address.
• First Discovered: The timestamp when the IP address was initially discovered. This data is read-only.
• Last Discovered: The timestamp when the IP address was last discovered. This data is read-only.
• OS: The operating system of the discovered host. The OS value can be one of the following:
— Microsoft for all discovered hosts that have a non-null value in the MAC addresses using the NetBIOS
discovery method.
— A value that a TCP discovery returns.
— The OS of a virtual entity on a vSphere server.
Note that this field sometimes displays the percentage of certainty about the discovered OS.
• NetBIOS Name: The returned NetBIOS name from the last discovery.
• Device Type(s): The type of device associated with the IP address, if any: Router, Switch-Router, and other types.
• Open Port(s): Lists any TCP/UDP ports that are open on the current IP address.
• Discovered Name: The name of the discovered IP address, if any was previously assigned by an administrator.
• Discoverer: The identity of the appliance that discovered the IP address.
• Fingerprint: The name of the DHCP fingerprint or vendor ID of the network device that was identified through
DHCP fingerprint detection. This field displays No Match for devices that do not have any DHCP fingerprint
information. For information about DHCP fingerprints, see DHCP Fingerprint Detection on page 1357.
• Site: The site to which the IP address belongs. This is a predefined extensible attribute.
• Disabled (hidden): Indicates whether the DHCP or DNS record is disabled.

Note: For an IP address that falls within a DHCP range, Grid Manager displays extensible attribute values for the
DHCP range and fixed address or host record. When you view the same IP address in the DHCP tab however,
Grid Manager displays only the extensible attribute values associated with the fixed address or host record,
but not the DHCP range. For example, when you define extensible attribute State with the value California for

596 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing and Managing IPv4 Addresses

DHCP range 1.0.0.1 – 1.0.0.5, and then define extensible attribute State with the value of Alaska for fixed
address 1.0.0.3, Grid Manager displays both California and Alaska in the State field for IP address 1.0.0.3 in
the IP Address List view. However, when you view 1.0.0.3 from the DHCP tab, the State field displays Alaska
only.

IP List Neighbor Information

Other values will be available for display in the List page. Most of the hidden columns consist of information
discovered by Grid Manager, to identify devices connected to the network interfaces neighboring the listed IP
addresses in the table. These data columns are hidden and must be selected for display by the operator by selecting
the Visible check box for each field when editing the columns for the table. (Most of this information will not appear
unless a device is recognized in IPAM or is in managed state under IPAM.) Additional values include:
• Discovered Name: The discovered name of the device bound to the IP address. The IP address may be just one
of several or many IP addresses bound to the device on a specific interface.
• Discovered MAC Address: The discovered MAC of the interface bound to the IP address.
• Discoverer: Name of the Infoblox appliance that discovered the IP address and its associated information.
• Attached Device Description: Listing of the device neighboring to the IP address.
• Attached Device Address: The IP address of the neighboring device to the current IP.
• Attached Device Name: The host name of the device discovered as neighboring to the current IP.
• Attached Device Vendor: The device vendor for the neighbor to the current IP address.
• Attached Device Model: The device vendor’s model number for the neighbor to the current IP address.
• Attached Device Port Description: An admin-provided description for the neighboring IP address, if any is
discovered.
• Attached Device Port Name: The standard port name for the interface facing the current IP address.
• Attached Device Port: The neighboring device’s connected port number.
• Attached Device Type: Indicates the device type for the neighboring device: Router, Switch-Router, Switch, and
other types.
• Port Duplex: Discovered Duplex setting for the neighboring port, when applicable.
• Port Link: Indicates the state of the link: Connected or Disconnected.
• Port Speed: Indicates the speed of the network connection.

Using the List Panel Action Menu

The IP address List panel provides an Action icon column with a series of menu options for features related to IP
address management and IP data management under IPAM. Menu choices change based upon the context and the
current state of IP addresses in the table; features available in the List panel action menu include the following:
• (Applies only with Network Insight) View Router Redundancy information for discovered IP addresses in an IPv4
network. For active VIPs, you will see several sets of related information:

Figure 13.7 Virtual IPs and discovered redundancy information

— Active: lists the active interface in the redundancy pair;

NIOS 7.3 NIOS Administrator Guide (Rev. A) 597

IP Address Management

— VIP: The Virtual IP for the router redundancy pair;

— Standby: The standby IP interface for the router redundancy.
Discovery of all three IP components of the Router Redundancy instance also provides related information for all
three IP entities:
— Show IPAM Address: opens the IPAM page to the listed IP address;
— VIP: Opens the virtual interface in the host device’s Interfaces page;
— Associated router: The third item lists the hostname router for each of the three IP address entities
comprising the redundancy instance. The currently active router will be identified with the Active and VIP
objects; the second Standby router is identified with the Standby IP address.
• Show Interfaces View: Opens the IP address’ related Interface page to highlight the interface’s listed
information in the table.
• Assets View –> Show Assets: Opens the IP address’s list of network assets that are connected to the IP address
or reachable through the IP address in some way, such as through a routable path. Provides a quick look at
basic connectivity provided by the selected IP address; for more information about Assets views, see Viewing
Assets Associated with Discovered Devices on page 708.
• Clear: Allows you to remove data associated with the currently selected IP address, form three categories:
— Clear Lease: If the IP interface gets its configuration from a DHCP lease, choosing this option will clear the
IP’s DHCP configuration. Applies only to IP addresses that are fully managed through IPAM;
— Clear Unmanaged Data: Clears the discovered data for an unmanaged IP address;
— Clear Discovered Data: Clears discovered data from the IPAM object, and re-launches discovery afterwards if
necessary.
• Convert: Conversion feature to convert the currently unmanaged IP address to an object fully managed by IPAM:
Network, To Host, To A Record, To PTR Record, or To Fixed Address. (For related information, see Managing
Discovered Data on page 691, About Host Records on page 578, Managing A Records on page 880 and
Managing PTR Records on page 884.)
• Discover Now: Requests Grid Manager to execute discovery on the selected IP address.
• Exclusion: Exclude or disable exclusion of the current IP address from discovery. For related information, see
Excluding IP Addresses from Discovery on page 685.
• Show Active Users: Displays all the users who are currently active on the selected network. For information, see
Viewing Active Network Users on page 615.

Additional IP List Information

You can display all available extensible attributes. You can also sort the list of IP addresses in ascending or
descending order by IP Address only. If you enabled the IP Discovery feature, you can configure the IP List panel to
display discovered data and fields imported from Trinzic Network Automation appliances. For information about
integrating discovered data from Trinzic Network Automation, see Integrating Discovered Data From Trinzic Network
Automation on page 650.
You can select an IP address from the List panel and view the following information about it:
• General information, as described in IP Address Header Panel on page 599.
• Data retrieved through a network discovery or integrated from a PortIQ appliance, as described in Viewing
Discovered Data on page 642.
• The records associated with the IP address, as described in Related Objects on page 608.
• Audit history, as described in Audit History on page 608.
• Detailed lease information, as described in Viewing Detailed Lease Information on page 1246.
You can also do the following from the IP List panel:
• Click Go to DHCP View to view DHCP properties of a selected network. For information, see Modifying IPv4
Networks on page 1118.
• Click the Ping icon to ping a selected IP address. For information, see Pinging IP Addresses on page 612.

598 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing and Managing IPv4 Addresses

Filtering the IP Address List

You can filter the IP address list, so it displays only the IP addressees you need. You can filter the list based on any
combination of extensible attributes and the parameters displayed in the IP address list, such as usage and type.
When you expand the list of available fields you can add to the filter, note that the extensible attributes are those with
the gray background.

IP Address Header Panel

When you select an IP address from the IP Map or List panel, Grid Manager displays information about the highest
priority object associated with the IP address. Depending on the object type, Grid Manager displays all or some of the
following information. For example, if the highest priority object is a fixed address, Grid Manager displays only the
object type, MAC address, lease state, and comment of the object.
• Type: The object or record type, such as A record, PTR record, or host record.
• Name: The name of the object. For example, if the IP address belongs to a host record, this field displays the
hostname. The appliance highlights disabled DHCP objects in gray. A DHCP object can be a DHCP address
range, fixed address, reservation, host configured for DHCP, or roaming host with an allocated IP address.
• MAC: The MAC address of the network device associated with the IP address.
• Lease Sate: The current status of the DHCP lease.
• Comment: Comments about the IP address.

Discovered Data
The Discovered Data tab displays discovered data through a network discovery or integrated from PortIQ and Trinzic
Network Automation appliances. For information about viewing discovered data, see Viewing Discovered Data on
page 642.

Related Objects
The Related Objects tab displays the following information about the records associated with the IP address:
• Name: The name of the object. For example, if the IP address belongs to a host record, this field displays the
hostname. The appliance highlights disabled DHCP objects in gray. A DHCP object can be a DHCP range, fixed
address, reservation, host configured for DHCP, or roaming host with an allocated IP address.
• Type: The object type, such as DHCP lease, host, A record, and bulk host.
• Comment: Information about the object.
You can also select the following for display:
• DNS view: The DNS view to which the object belongs.
You can do the following in this tab:
• Add a resource record. You can select the following from the drop-down list:
— Host Record—For information, see Adding Host Records on page 579.
— Range—For information, see Adding IPv4 Address Ranges on page 1122.
— Fixed Address—For information, see Adding IPv4 Fixed Addresses on page 1126.
— Reservation—For information, see Adding IPv4 Reservations on page 1131.
— A Record—For information, see Adding A Records on page 881.
— PTR Record—For information, see Adding PTR Records on page 884.
• Edit the properties of the selected object. Depending on the type of object, Grid Manager displays the
corresponding editor for the object. For example, if the selected object is a fixed address, Grid Manager displays
the fixed address editor. When you select a lease object, Grid Manager displays the lease viewer.
• You can also modify some of the data in the table. Double click a row of data, and either edit the data in the field
or select an item from a drop-down list. Note that some fields are read-only. For more information about this
feature, see Modifying Data in Tables on page 70.Delete a selected object or multiple objects.
• When you select a lease object and click the Show Details icon, you can view the lease start and end dates.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 599

IP Address Management

• Depending on the object type, you can convert a selected object to one of the following:
— Reservation
— Host
— Fixed Address
• View detailed lease information about the IP address, as described in Viewing Detailed Lease Information on
page 1246.
• Print and export the information in the Related Objects table.

Audit History
By default, the Audit History tab displays the following information about the last five actions performed on the
selected IP:
• Timestamp: The day, date, and time of the operation.
• Action: The type of operation that was performed by the administrator.
• Object Type: The object type of the entry.
• Object Name: The name of the object.
• Admin Name: The name of the administrator who performed the operation.
• Message: The description of the administrative activity.

Note: If you change the IP address of an existing record to a new one in the IP MAP tab when the Grid Audit Logging
is set to Brief, then NIOS will not display modification or transition details about the new IP address in this tab.
You can only view subsequent modifications and deletions to the new IP address. However, you can view the
audit log history and transition details of the old IP address, but you cannot view the initial transition from an
old IP address to the new IP address.

Managing IPv4 Addresses

You can do the following from the IP Map and List panels:
• Add IP addresses to existing hosts. For information, see Adding IP Addresses to Existing Host Records on page
600.
• Clear unmanaged IP addresses. For information, see Clearing Unmanaged Data on page 601.
• Convert objects to other object types. For information, see Converting Objects Associated with IP Addresses on
page 609.
• Reclaim IP addresses. For information, see Reclaiming Objects Associated with IPv4 and IPv6 Addresses on
page 612.
• Ping IP addresses. For information, see Pinging IP Addresses on page 612.
• Configure and run a network discovery. For information, see IP Discovery and vDiscovery on page 617.
• Resolve discovery conflicts. For information, see Resolving Conflicting Addresses on page 647.
• Clear discovered data. For information, see Clearing Discovered Data on page 649

Adding IP Addresses to Existing Host Records

You can add unused and unmanaged addresses, including all their information, to existing host records. When you
add an unmanaged address to a host record, the appliance adds the discovered data to the host record. You can
select the desired host to which you want to add the unmanaged address.
To add an unmanaged IP address to an existing host record:
1. From the IP Map or List panel, select an IP address, and then click Add -> Add to Existing Host from the Toolbar.
2. In the Select Host dialog box, do the following:

600 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing and Managing IPv4 Addresses

— In the table, select the host to which you want to add the selected IP address. You can also use the filters or
the Go To field to narrow down the host list. For information, see Using Filters on page 76 and Using the Go
To Function on page 81.
— Click the Select icon.
Grid Manager displays the Host Record editor.
3. In the Host Record editor, update the host properties as described in Choose one of the following from the Save
& ... drop-down button menu: on page 583.
4. Save the configuration and click Restart if it appears at the top of the screen. To close the editor without saving
the changes, click the Close icon.

Clearing Unmanaged Data

You can clear the status of unmanaged data at the network and IP address levels. When you clear an unmanaged
address, the status of the IP address changes to Unused. An unmanaged address is an IP address with a discovered
host, is not previously known to the appliance, and does not have an A record, PTR record, fixed address, host
address, lease, or is not within a DHCP range. You can change an unmanaged address to a host, a DHCP fixed address,
an A record, or a PTR record. You can also clear the unmanaged data associated with the address.
To clear unmanaged data:
1. From the IP Map or List panel, select the IP address for which you want to clear unmanaged data, and then click
Clear -> Clear Unmanaged Data from the Toolbar. You can select multiple IP addresses.
2. In the Clear Unmanaged data dialog box, click Yes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 601

IP Address Management

Viewing Router Redundancy Information for Virtual IPs (VIPs)

1. From the Data Management tab, click CSV Job Manager from the Toolbar.
2. In CSV Job Manager, click the CSV Import tab and select the import job that you want to delete. Click the Action
icon and select Delete or click the Delete pending job icon.

Managing IPv6 Networks

In Grid Manager, you can use the IPv6 Net Map (network map) and List panels to manage your IPv6 network
infrastructure. After you select a network container from the IPAM tab, Grid Manager displays it in the Net Map panel,
by default. The Net Map panel provides a graphical view of your networks and has a number of features that simplify
network management. The List panel displays the networks in table format.
You can always switch your view of a network container between the Net Map and List panels. Grid Manager keeps
track of which panel you last used. When you select a network container, Grid Manager displays it in the Net Map or
List panel, depending on which one you last used. For information about each panel, see IPv4 Network Map on page
586 and IPAM Home on page 590.
You can use Grid Manager to manage IPv6 networks and their AAAA, PTR and host resource records. You can configure
IPv6 networks and track IP address usage in those networks. You can also split and join IPv6 networks, when
necessary.

IPv6 Network Map

After you select an IPv6 network container from the IPAM tab, Grid Manager displays it in the IPv6 Net Map (network
map) panel, by default. Just like the IPv4 Net Map, the IPv6 Net Map provides a high-level view of the network address
space. You can use Net Map to design and plan your network infrastructure, and to configure and manage individual
networks.
The Net Map panel presents a complete view of the network space, including the different types of networks that are
in it and its unused address space. IP addresses that belong to a network are blocked off. Each color-coded block
represents a network container, a leaf network, or a block of networks that are too small to be displayed individually
in the map. For example, in a /64 or /96 network, networks smaller than /76 or /108 respectively and that are beside
each other are represented as a multiple network block. In addition, the fill pattern of the blocks indicates their
utilization. Therefore, you can quickly evaluate how many networks are in a network container, their relative sizes,
utilization, and how much space you have left.
As you mouse over areas of the map, it displays IP information about the area. Net Map also has a zoom feature that
allows you to enlarge or reduce your view of a particular area.
Figure 13.8 displays the network map of a 1111::/16 network, which is a network container that has network
containers and leaf networks.

602 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv6 Networks

Figure 13.8 IPv6 Network Map

Network address Unused address space that was Leaf network

selected.

Network container that Net Map displays information about

is 40% utilized. Start and end addresses
Block of  the network container after you
of the network container.
multiple networks. mouse over it.

Displaying Network Information

As shown in Figure 13.8, as you mouse over the map, Net Map displays IP information about the area. When you
mouse over an unused area, Net Map displays the following information:
• The start and end IP address
• The largest possible network
• The number of /64 networks that can fit in that space
When you mouse over a network container, Net Map displays the following information:
• Network address and netmask
• The first and last IP address of the network
• The number of networks in that block
• IPAM utilization
When you mouse over a network, Net Map displays the following information:
• Network address and netmask
• The first and last IP address of the network
When you mouse over a block of multiple networks, Net Map displays the following information:
• The start and end IP address of that block of networks
• The number of networks in that block

NIOS 7.3 NIOS Administrator Guide (Rev. A) 603

IP Address Management

Zooming In and Out

Use the zoom function to enlarge and reduce your view of a selected area. You can zoom in on any area in your
network. You can zoom in on an area until it displays 128 addresses per row, for a total of 1024 addresses for the
map. When you reach the last possible zoom level, the Zoom In icon in the Net Map task bar and the menu item are
disabled.
After you zoom in on an area, you can click the Zoom Controller icon to track where you zoomed in. The Zoom
Controller lists all the areas that you zoomed in and updates its list dynamically. You can click an item on the list to
view that area again. Click the Zoom Controller again to close it.
To select an area and zoom in:
1. Right-click and select Zoom In, or click the Zoom In icon in the Net Map task bar.
The pointer changes to the zoom in selector.
2. Select a starting point and drag to the end point. The starting point can be anywhere in the map. It does not have
to be at the beginning of a network.
Net Map displays a magnified view of the selected area after you release the mouse button. As you mouse over
the zoomed in area, Net Map displays IP information about it.
3. You can do the following:
— Select an area and zoom in again.
— Add a network. If you zoom in on an area and click Add without selecting an open area first, Net Map selects
the area where it can create the biggest possible network in that magnified area.
— Select a network and perform any of the following operations:
— Edit its properties.
— Open it to display its IP List.
— Delete it immediately, or schedule its deletion.
— Right-click and select Zoom Out, or click the Zoom Out icon in the Net Map task bar. Each time you click
Zoom Out, Net Map zooms out one level and the Zoom Controller is updated accordingly.

Net Map Tasks

From Net Map, you can create IPv6 networks, and evaluate and manage your network resources according to the
needs of your organization. You can do the following:
• Zoom in on specific areas, as described in Zooming In and Out on page 588.
• Use the Go to function to find a network in the current zoom level of Net Map.
• Add a network, as described in Adding a Network from Net Map.
• Select a network and view IP address list, as described in Viewing IPv6 Data on page 607.
• Select a network and edit its properties, as described in Modifying IPv4 and IPv6 Network Containers and
Networks on page 585.
• Split a network, as described in Splitting IPv6 Networks into Subnets on page 606.
• Join networks, as described in Joining IPv6 Networks on page 607.
• Delete one or multiple networks, as described in Discovering Networks (Under Network Insight only) on page
593.
• Switch to the List view of the network. For information, see IPv6 Network List on page 606.
— When you select one or more networks in Net Map and then switch to the List view, the list displays the
page with the first selected network.
— If you select one or more networks in the List view and then switch to the Net Map view, the first network is
also selected in Net Map. Although, if you select a network in the List view that is part of a Multiple
Networks block in Net Map, it is not selected when you switch to the Net Map view.

604 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv6 Networks

Adding a Network from Net Map

When you create networks from Net Map, you can view the address space to which you are adding a network, so you
can determine how much space is available and which IP addresses are not in use. When you mouse over an open
area, Net Map displays useful information, such as the largest possible network that fits in that area. In addition, you
can create networks without having to calculate anything. When you add a network, Net Map displays a netmask
slider so you can determine the appropriate netmask for the size of the network that you need. As you move the slider,
it displays network information, including the total number of addresses. After you select the netmask, you can even
move the new network around the open area to select another valid start address.
To add a network from the Net Map panel:
1. Do one of the following:
— Click the Add icon.
Net Map displays the netmask slider and outlines the open area that can accommodate the largest
network.
— Select an open area, and then click the Add icon.
Net Map displays the netmask slider and outlines the largest network that you can create in the open area
that you selected.
2. Move the slider to the desired netmask. You can move the slider to the netmask of the largest network that can
be created in the open area. You can also move the slider to the smallest network that can be placed in the
current zoom level of Net Map.
As you move the slider, Net Map displays the netmask. The outline in the network map also adjusts as you move
the slider. When you mouse over the outline, it displays the start and end address of the network.
3. After you set the slider to the desired netmask, you can drag the new network block around the open area to
select a new valid starting address. You cannot move the block to a starting address that is invalid.
4. Click Launch Wizard to create the network.
The Add Network wizard displays the selected network address and netmask.
5. You can add comments, automatically create reverse mapping zones, and edit the extensible attributes. (For
information, see Adding IPv6 Networks on page 1161.)
6. Save the configuration and click Restart if it appears at the top of the screen.
Grid Manager updates Net Map with the newly created network.

Viewing Network Details

From Net Map, you can focus on a specific network or area and view additional information about it. If you have a
network hierarchy of networks within network containers, you can drill down to individual leaf networks and view
their IP address usage.
1. Select a network or area.
2. Click the Open icon.
— If you selected a network container, Grid Manager displays it in the Net Map panel. You can drill down
further by selecting a network or open area and clicking the Open icon again.
— If you selected a block of multiple networks, Grid Manager displays the individual networks in the Net Map
panel. You can then select a network or open area for viewing.
— If you selected a leaf network, Grid Manager displays it in the Network List panel.
— If you selected an open area, Grid Manager displays an enlarged view of that area in the Net Map panel.
This is useful when you are creating small networks in an open area.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 605

IP Address Management

IPv6 Network List

The Network list panel is an alternative view of an IPv6 network hierarchy. For a given network, the panel shows all
the networks of a selected network view in table format. A network list displays only the first-level subnets. It does
not show further descendant or child subnets. You can open a subnet to view its child subnets. Subnets that contain
child subnets are displayed as network containers. If the number of subnets in a network exceeds the maximum page
size of the table, the network list displays the subnets on multiple pages. You can use the page navigation buttons
at the bottom of the table to navigate through the pages of subnets.
The IPAM home panel displays the following:
• Network: The network address.
• Comment: Information you entered about the network.
• IPAM Utilization: For a network, this is the percentage based on the IP addresses in use divided by the total
addresses in the network. You can use this information to verify if there is a sufficient number of available
addresses in a network. The IPAM utilization is calculated approximately every 15 minutes.
• Site: The site to which the IP address belongs. This is a predefined extensible attribute.
• Active Users: The number of active users on the selected network.
You can select the following columns for display:
• Disabled: Indicates whether the network is disabled.
• Leaf Network: Indicates whether or not the network is a leaf network.
• Other available extensible attributes
You can sort the list of subnets in ascending or descending order by columns. For information about customizing
tables in Grid Manager, see Customizing Tables on page 69.
You can also modify some of the data in the table. Double click a row of data, and either edit the data in the field or
select an item from a drop-down list. Note that some fields are read-only. For more information about this feature,
see Modifying Data in Tables on page 70.

Tip: If you select a network from the list and switch to the Net Map panel, the network is also selected in the network
map.

Filtering the Network List

You can filter the network list, so it displays only the networks you need. You can filter the list based on certain
parameters, such as network addresses, comments and extensible attributes. When you expand the list of available
fields you can use for the filter, note that the extensible attributes are those with a gray background.

Splitting IPv6 Networks into Subnets

You can create smaller subnets simultaneously within a network by splitting it. You do not have to configure each
subnet individually. You can create smaller subnets with larger netmasks. A larger netmask defines a larger number
of network addresses and a smaller number of IP addresses.
Note that you cannot split a network that is part of a shared network.
To split an IPv6 network:
1. From the Data Management tab, select the IPAM tab -> network check box, and then click Split from the Toolbar.
2. In the Split Network editor, do the following:
— Address: Displays the network address. You cannot modify this field.
— Netmask: Specify the appropriate netmask for each subnet.
— IPv6 Prefix Collector Network: If you split a network with prefix delegations that are not tied to specific
addresses, specify the network in which all prefix delegations are assigned. If you leave this field blank, the
server assigns all prefix delegations that are not tied to specific addresses to the first network.
— Immediately create: Select one of the following:

606 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing IPv6 Data

— Only networks with ranges and fixed addresses: Adds only the networks that have DHCP ranges and
fixed addresses.
— All possible networks: Adds all networks that are within the selected netmasks. You can select this
option only when you increase the CIDR by 8 bits.
— Automatically create reverse-mapping zone: Select this check box to have the appliance automatically
create reverse-mapping zones for the subnets. This function is enabled if the netmask of the network is a
multiple of four, such as 4, 12 or 16.
3. Click OK.

Joining IPv6 Networks

Joining multiple networks into a larger network is the opposite of splitting a network. You can select a network and
expand it into a larger network with a smaller netmask. A smaller netmask defines fewer networks while
accommodating a larger number of IP addresses. Joining or expanding a network allows you to consolidate all of the
adjacent networks into the expanded network. Adjacent networks are all networks that fall under the netmask of the
newly-expanded network.
To join or expand a network:
1. From the Data Management tab, select the IPAM tab -> network check box, and then click Join from the Toolbar.
2. In the Join Network editor, do the following:
— Address: Displays the network address. You cannot modify this field.
— Netmask: Enter the netmask of the expanded network.
— Automatically create reverse-mapping zone: Select this check box to configure the expanded network to
support reverse-mapping zones . The appliance automatically creates reverse-mapping zones only if the
netmask is between /4 through /128, in increments of 4 (that is, /4, /8, /12, and so on until /128).
3. Click OK.

Viewing IPv6 Data

To the configured IP addresses in an IPv6 network:
by selecting an IPv6 leaf network from the Network List panel
• For a leaf network that is not in a network container, from the Data Management tab, select the IPAM tab, and
then click the IPv6 network you want to view.
• For a leaf network that is in a network container, from the Data Management tab, select the IPAM tab ->
network_container -> network.
Grid Manager lists the configured IPv6 addresses. You can export and print the list. It displays the following
information about each IP address:
• IP Address: The name of the IPv6 DHCP object, which can be a DHCP range, fixed address, host configured for
DHCP, or a roaming host with an allocated IP address.
• Name: The name of the record associated with the IP address.
• DUID: The DHCP Unique Identifier (DUID) of the device that was assigned the IP address.
• Status: The status of the IPv6 object, such as Used or Unused.
• Type: The object type associated with the IP address, such as AAAA record, IPv6 Fixed Address, or Unmanaged.
• Usage: Indicates whether the IPv6 address is configured for DNS or DHCP.
• Exclude: (Applies only with Network Insight) Denotes whether the IP is excluded from discovery.
• Lease State: (Applies only with Network Insight) The lease state of the record, such as Active.
• First Discovered: (Applies only with Network Insight) The date and timestamp of the first occasion that NIOS
discovered the IP address.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 607

IP Address Management

• Last Discovered: (Applies only with Network Insight) The date and timestamp of the last occasion that NIOS
discovered the IP address.
• OS: The operating system of the IP.
• NetBIOS Name: The returned NetBIOS name from the last discovery.
• Device Type(s): Shows the device type for the device associated with the IP address.
• Fingerprint: The name of the DHCP fingerprint or vendor ID of the network device that was identified through
DHCP fingerprint detection. This field displays No Match for devices that do not have any DHCP fingerprint
information. For information about DHCP fingerprints, see DHCP Fingerprint Detection on page 1357.
• Comment: Displays comments about the record.
• Site: The site to which the IP address belongs. This is a predefined extensible attribute.
You can display all available extensible attributes. You can also sort the list of IP addresses in ascending or
descending order by IP Address only.
You can drill down further and view the records associated with an IP address. To view the associated records of an
IP address, select it and Grid Manager displays information about the IP address in the Related Objects and Audit
History tabs.

Related Objects
Grid Manager displays the following information about the records associated with the IP address:
• Name: The record name. For example, if the IP address belongs to a host record, this field displays the
hostname.
• Type: The object type. For example, AAAA Record, PTR Record, Host Record, IPv6 Fixed Address.
• Comment: Additional information that was entered in the record about the IP address.

Audit History
Grid Manager displays the following information about the last five actions performed on the selected IP:
• Timestamp: The day, date, and time of the operation.
• Action: The type of operation that was performed by the administrator.
• Object Type: The object type of the entry.
• Admin Name: The name of the administrator that performed the operation.
• Message: Description of the administrative activity.

Filtering the IP Address List

You can filter the IP address list, so it displays only the IP addressees you need. You can filter the list based on any
combination of extensible attributes and the parameters displayed in the IP address list, such as usage and type.
When you expand the list of available fields you can add to the filter, note that the extensible attributes are those with
the gray background.

Managing IPv4 and IPv6 Addresses

Grid Manager uses IP addresses as the entry point to the data set containing Infoblox host, DNS, DHCP, and other
information related to that address. You can view the data, modify it, assign extensible attributes to the objects
associated with the address, and convert DHCP lease types, such as changing a currently active dynamic lease to a
fixed address or host record.
You can view and manage IPv4 address data in the IP Map panel, and view and manage IPv4 and IPv6 data in the IP
List panel. You can do the following for IPv4 and IPv6 data from the IP List panel:
• Convert objects to other object types. For information, see Converting Objects Associated with IP Addresses on
page 609.

608 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv4 and IPv6 Addresses

• Reclaim IP addresses. For information, see Reclaiming Objects Associated with IPv4 and IPv6 Addresses on
page 612.
• Ping IP addresses. For information, see Pinging IP Addresses on page 612.
• Clear DHCP leases. For information, see Clearing Active DHCP Leases on page 612.
You can also print and export in CSV format the information displayed in any panel that supports these functions.

Converting Objects Associated with IP Addresses

The NIOS appliance provides a simple mechanism for converting unmanaged IP addresses to resource records, such
as host records and A or AAAA records. You can also convert the active lease of a dynamically assigned IPv4 or IPv6
address to a fixed address or host, and convert an IPv4 lease to an IPv4 reservation. Using the conversion
mechanism, you can keep the existing information of a network device during the conversion.
The appliance supports the following conversions for IPv4 objects:
• DHCP leases to fixed addresses, reservations, or host records
• Fixed addresses to reservations or host records
• Unmanaged addresses to host records, A records, PTR records, or fixed addresses
• A records to host records
• PTR records to host records
The appliance supports the following conversions for IPv6 objects:
• DHCP leases to fixed addresses or host records
• Fixed addresses to host records
• AAAA records to host records
• IPv6 PTR records to host records

Note: You cannot convert unmanaged IP addresses or leases served by Microsoft DHCP servers to host records.

Converting DHCP Leases

To create a fixed address, you bind an IPv4 address to a MAC address or an IPv6 address to a DUID. You can make
that binding by converting an active dynamically leased address to a fixed address. The lease conversion transforms
the temporary binding between the IPv4 address and MAC address or the IPv6 address and DUID in the dynamic lease
to a persistent one. The lease must be active so that the NIOS appliance has an IPv4-to-MAC address or IPv6-to-DUID
binding to convert into a fixed address.
The appliance uses the following rules when converting a DHCP lease:
• If an IPv4 DHCP lease is converted to a fixed address, the appliance copies the client identifier to the fixed
address, based on information in the lease. If the appliance finds the client identifier in the lease information,
the appliance includes it when it creates the host. If it finds the MAC address, the appliance includes it when it
creates the host. If it finds both, the appliance includes only the MAC address (default) when it creates the host.
• If an IPv6 DHCP lease is converted to a fixed address, the appliance copies the DUID to the fixed address.
• If you try to convert an IPv4 DHCP lease or a fixed address with a client identifier, not a MAC address, to a host,
the appliance displays an error message in the host editor. This ensures that you do not attempt this operation
and lose the data.
• You cannot create two IPv4 fixed addresses with the same client identifier or MAC address in the same network.
You cannot create two IPv6 fixed addressed with the same DUID in the same network.
• If the appliance receives a second IPv4 DHCP request with the same client identifier, it provides the same fixed
IP address if the lease is still binding.
Figure 13.9 illustrates converting a dynamic IPv4 lease to a fixed lease.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 609

IP Address Management

Figure 13.9 Converting a Dynamic IPv4 Lease to a Fixed Lease

Dynamic Address Leasing Fixed Address Leasing

DHCP Client DHCP Server DHCP Client DHCP Server

MAC: 01:01:01:01:01:01 NIOS Appliance MAC: 01:01:01:01:01:01 NIOS Appliance

1 Address Request 2 Appliance dynamically 6 Address Request

chooses an address
from a DHCP range.

3 Address Assignment 7 Appliance always assigns 

10.1.1.25 DHCP Range the client the same IP address.
... ... ...
10.1.1.20 -
10.1.1.27
4 Subsequent Dynamic
Address Assignments
10.1.1.30
... ... ...

10.1.1.22 5 Convert Lease 10.1.1.27

... ... ... Dynamic --> Fixed ... ... ...
01:01:01:01:01:01
to 10.1.1.27
10.1.1.27
10.1.1.27

An advantage of converting an active dynamic lease is that you do not need to learn the MAC address or DUID of the
device to which you want to assign an IP address and manually enter it in the fixed address configuration.
An IPv4 reservation is an address that you exclude from DHCP use because you intend to configure that address
manually on a device, such as a firewall, router, or printer. You can also convert an IPv4 fixed address or a dynamic
address with an active lease to a reservation.
When you convert an address in a DHCP range to a reservation, you reduce the total number of dynamically
assignable addresses in that range by one. Correspondingly, this reduces the number of allocated addresses needed
to exceed a high or low watermark threshold for that range.

Note: To return an IP address to its place in a DHCP range after converting it from an active dynamic lease to a fixed
address, reservation, or Infoblox host, delete the fixed address, reservation, or host to which you previously
converted the IP address. The IP address then becomes part of the DHCP range to which it first belonged.

You can convert IPv4 fixed addresses to reservations, as shown in Figure 13.10.

610 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv4 and IPv6 Addresses

Figure 13.10 Converting an IPv4 Dynamic Lease or Fixed Address to a Reservation

DHCP Client and Server Statically Configured Device and DHCP Server

DHCP Client DHCP Server Statistically Configured DHCP Server

MAC: 01:01:01:01:01:01 NIOS Appliance Device
MAC: 01:01:01:01:01:01 NIOS Appliance
1 Address Request 2 Appliance chooses an IP: 10.1.1.25
address from a DHCP
range or from a fixed
address definition.

DHCP Range
3 Appliance assigns
an address to the 10.1.1.20 - 5 Appliance excludes DHCP Addresses
DHCP client. 10.1.1.30 10.1.1.25 from
DHCP use and 10.1.1.20
10.1.1.25 marks its status  10.1.1.21
or
as “Used”.
Fixed Address 10.1.1.22
10.1.1.25 10.1.1.23
Convert 10.1.1.25 10.1.1.24
4
to a reserved 10.1.1.25
address with a null 10.1.1.25
MAC address:
...
00:00:00:00:00:00
10.1.1.30

To convert an object:
1. From the IP Map, select an IPv4 address or from the IP List panel, select an IPv4 or IPv6 address.
2. In the Related Objects tab, select the check box of the object, and then click Convert from the Toolbar or
navigation bar.
3. Select the object type to which you want to convert the object. Grid Manager displays the corresponding editor
for the object type.
4. For all IPv4 conversions, Grid Manager populates the discovered information in the corresponding editor.
Depending on the type of conversion, do one of the following:
— For host record conversions, see Choose one of the following from the Save & ... drop-down button menu:
on page 583.
— For IPv4 reservation conversions, see Modifying IPv4 Reservations on page 1134.
— For fixed address conversions, see Modifying IPv4 Fixed Addresses on page 1129.
— For A record conversions, see Modifying A Records on page 882.
— For PTR record conversions, see Modifying PTR Records on page 885.

Note: When you select an object for conversion, Grid Manager displays only the available conversion types for
the object. You must save the changes in the editor for the conversion to take place.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 611

IP Address Management

Reclaiming Objects Associated with IPv4 and IPv6 Addresses

You can use the reclaim IP function to delete all objects, except the active DHCP lease, that are associated with a
selected IP address. To delete a DHCP lease, use the clear lease function as described in Clearing Active DHCP Leases.
When you reclaim an IP address, Grid Manager deletes the associated objects and puts them in the Recycle Bin, if
enabled. You can reclaim any used and unmanaged IP addresses. You can also select multiple IP addresses for this
function. After you reclaim an IP address, the address status changes to Unused. You can then reassign the IP address
to other objects. For example, when you reclaim a fixed address, Grid Manager deletes the fixed address object and
puts it in the Recycle Bin. When you reclaim an IP address that is associated with a host record and the address is the
only address in the host, Grid Manager deletes the host record.
Grid Manager deletes all the objects that are associated with the selected IP addresses and puts them in the recycle
bin, with the following exceptions:
• When you reclaim IP addresses that are in a DHCP range, all the objects that are associated with the IP
addresses are deleted and the IP addresses remain in the DHCP range.
• When you select an IP address that is part of a host record, only the selected IP address is deleted from the
host. However, if the selected address is the only address in the host, Grid Manager deletes the host record.
Grid Manager does not reclaim the following:
• Unused IP addresses
• Bulk hosts
To reclaim an IP address:
1. From the IP Map or List panel, select the IP address you want to reclaim, and then click Reclaim from the Toolbar.
You can select multiple IP addresses.
2. In the Delete Confirmation dialog box, click Yes.
Grid Manager puts the deleted objects in the Recycle Bin, if enabled.

Pinging IP Addresses
You can find out whether an IP address is accessible and active by pinging the address. Grid Manager sends a packet
to the selected IP address and waits for a reply when you ping the address. You can ping individual IP addresses from
the IP Map and IP List panels. You can ping all IP addresses from the IP Map panel and all IP addresses on the selected
page from the IP List panel.
To ping an IPv4 or IPv6 address:
• From the IP Map or IP List panel, select the IP address that you want to ping, and then click Ping from the
Toolbar.
To ping all IPv4 addresses:
• From the IP Map panel, click Multi-ping from the Toolbar. Grid Manager pings all IP addresses displayed in the IP
Map panel and displays the ping status in the panel. When the ping or multi-ping is complete, the status bar
displays the number of active IP addresses detected through the ping. To close the ping status bar, click the
Close icon.
• From the IP List panel, click Multi-ping from the Toolbar. Grid Manager pings all IP addresses visible on the
selected page. When the ping or multi-ping is complete, the status bar displays the number of active IP
addresses detected on the selected page. To close the ping status bar, click the Close icon.

Clearing Active DHCP Leases

A DHCP lease specifies the amount of time that the DHCP server grants to a network device the permission to use a
particular IP address. You may sometimes need to terminate an active lease. The following are some of the reasons
for clearing active DHCP leases:
• When a network device is moved to another network.
• Reset a DHCP lease to fix other problems.
In Grid Manager, you can select multiple IP addresses and clear their active DHCP leases.

612 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Thresholds for IPAM Utilization

To clear an active lease:

1. From the IP Map or List panel, select the IP address for which you want to clear a DHCP lease, and then click Clear
-> Clear Lease from the Toolbar. You can select multiple IP addresses.
2. In the Clear DHCP Lease Confirmation dialog box, click Yes.

Configuring Thresholds for IPAM Utilization

You can define thresholds for IPAM utilization in a network or network container and configure the appliance to send
SNMP trap and email notifications to a designated destination when IPAM utilization in a network or network
container crosses the configured threshold. IPAM utilization for a network is the percentage based on the IP
addresses in use divided by the total addresses in the network and for a network container that contains subnets, it
is the percentage of the total address space defined within the container regardless of whether any of the IP
addresses in the subnets are in use. The appliance sends an SNMP trap and email notification only once when the
IPAM utilization in a network or network container exceeds the Trigger value and when it drops below the Reset value.
The default Trigger value is 95% and the default Reset value is 85%. The IPAM utilization notifications are sent for
IPv4 networks and IPv4 network containers only. The appliance updates the IPAM utilization data immediately for a
network container, but for a network it is updated every 15 minutes.
You can define thresholds for IPAM utilization at the Grid level and network level. The appliance applies the settings
hierarchically in a parent-child structure. By defining thresholds at a higher level, all networks can then inherit the
same settings and you do not have to redefine them for each network. For example, if you set the thresholds for IPAM
utilization at the Grid level, then the settings applies to all the network containers and networks in any network view.
However, if you override these settings at the network container or network level, then the settings applies to that
network or network container and any network within that network or network container in the same network view. If
you set the thresholds for an individual network, then it overrides settings at a higher level.

Note: Infoblox recommends that you do not enable SNMP traps and email notifications for IPAM utilization during
an upgrade, because if you have configured notifications you may have to unconfigure them during an
upgrade.

You can configure the thresholds for IPAM utilization at the Grid level and override them at the network level. To
configure the IPAM utilization thresholds at the Grid level, see Defining Thresholds for Traps on page 1369.
To configure the IPAM utilization thresholds for a IPv4 network, network container, or network template, complete the
following:
1. Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
click the Edit icon.
Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and click the Edit icon.
Network Template: From the Data Management tab, select the DHCP tab -> Templates tab -> DHCP_template
check box, and click the Edit icon.
2. In the editor, click Toggle Advanced Mode, select the IPv4 IPAM Utilization Notification tab, and then complete
the following:
— IPAM Utilization Notification: Click Override to override the inherited property, and specify the following:
— Enable SNMP Notifications: Select this for the appliance to send an SNMP trap to the trap receiver that
you define for the Grid when IPAM utilization crosses the configured threshold.
— Enable Email Notifications: Select this for the appliance to send an email notification to a designated
destination if IPAM utilization crosses the configured threshold.
— IPAM Threshold Settings: Click Override to override the inherited property, and specify the following:
— Trigger: Enter a Trigger value between 0 to 100. The appliance sends an SNMP trap and—if configured
to do so—sends an email notification to a designated destination when the IPAM utilization exceeds
the Trigger value. The default Trigger value is 95.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 613

IP Address Management

— Reset: Enter a Reset value between 0 to 100. The appliance sends an SNMP trap and —if configured to
do so—an email notification to a designated destination when the IPAM utilization drops below the
Reset value. The default Reset value is 85.
— Email Addresses: Click Override to override the inherited property. Click the Add icon, and then enter an
email address to which you want the appliance to send email notifications when IPAM utilization for the
network or network container crosses the configured threshold. You can create a list of email addresses.
3. Save the configuration and click Restart if it appears at the top of the screen.

About Network Insight

In some deployments, NIOS IPAM offers network discovery capabilities. NIOS discovery includes Network Discovery
and Network Insight, which is a superset of Network Discovery that supports SNMP and enables detailed viewing and
assessments of network devices in managed and unmanaged networks, including networks in routed paths, security
infrastructure devices, and networks within switched Ethernet segments.
Deployment of Network Insight discovery requires a separate Discovery license and one or more NIOS appliances
dedicated to discovery tasks. Types of discovered devices include Ethernet switches (including enterprise L3
switches), routers, wireless routers and access points, firewalls, hosts and other devices in end host networks, and
much more. Network Insight applies discovery in the following ways:
• Through specification of seed routers, which inform discovery of the various networks that should be
examined and catalogued.
• Through discovery of the various Object types you can create under IPAM and DHCP, including IPv4 and IPv6
Networks, Host Records, IPv4 reservations, DHCP ranges, and IPv4/IPv6 fixed addresses.
• An enhanced VM discovery allowing both scheduled VM discovery and immediate discovery of VMs.
For more information about network discovery, see the chapter IP Discovery and vDiscovery on page 617 and its
various sections.
For a complete discussion of Network Insight, see the chapter Infoblox Network Insight on page 653 and its various
sections.

Viewing Identity Mapping Information

You can view user information associated with networks, end-host devices, Active Directory domains, routers and
switches when you enable the Identity Mapping feature on the appliance. Access to user information related to
networks and devices help network administrators to understand how the network resources are consumed and by
whom. Each network user being mapped can use different devices to access their network environment. So using the
identity mapping feature and synchronizing servers, such as Microsoft servers and Cisco ISEs, on the Infoblox
appliance provide visibility of user interaction with their environments. By enabling this feature, you can monitor
domain users, the IP addresses they log on to, the login status, and the time duration of their current status in the
IPAM tab. For information about Identity Mapping for Active Directory users, see Configuring Identity Mapping on
page 1275 and how to collect about user and device information from Cisco ISEs, see Configuring Cisco ISE on NIOS
on page 1736. You can generate the user login history report to monitor user login activities in a given time frame.
For information, see User Login History Report on page 1515.
You can do the following in the Network Users tab:
• View active network users, as described inViewing Active Network Users on page 615.
• View user login history, as described in Viewing Network Users Login History on page 616.

614 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Identity Mapping Information

Enabling Identity Mapping

You must first enable the Identity Mapping feature to view user information of a network or device.
Complete the following to enable this feature:
1. From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
2. In the Grid Properties Editor, select the General tab -> Advanced tab, and then complete the following:
— Enable Network Users feature: Select this check box to enable the Identity Mapping feature on the
appliance. Note that the Network Users tab is available only after you enable this feature.

Note: On an Infoblox appliance, the Enable Network Users Feature option is disabled by default for all new
installations.

3. Save the configuration.

Viewing Active Network Users

You can view all the users who are currently active on a network in the Active Users tab.
Using the Action icon , you can do the following in the Active Users tab:
• Go To IPAM IP Address Details: Select this to open the IPAM Home page to view the network address of the
device. This option is greyed out for devices that have an IP address and is not part of an IPAM network.
• Go To DHCP Network Details: Select this to open the DHCP > Networks tab to view the network address of the
device. This option is greyed out for devices that have an IP address and not managed by the Grid.
• Go To IPAM Network Details: Select this to open the IPAM Map for the selected user. The page shows network
information in graphical format. This option is greyed out for devices that have an IP and not managed by the
Grid.
To view active users:
1. From the Data Management tab, select the Network Users tab > Active Users tab.
or
You can use the Action icon in the following tabs to open the Active Users dialog box:
IPAM tab: From the Data Management tab, select the IPAM tab, click the Action icon next to the respective
network and select Show Active Users.
DHCP tab: From the Data Management tab, select the DHCP tab > Networks tab, click the Action icon next to
the respective network and select Show Active Users.
Cloud tab:
• In the Networks tab, click the Action icon next to the respective network and select Show Active Users.
• In the VMs tab, click the Action icon and select Show Active Users.
DNS tab: From the Data Management tab, select the DNS tab > Zones tab > Records tab, click the Action icon
and select Show Active Users.
The Active Users tab or Active Users dialog box displays the following information:
— User Name: Displays the logon name of the user. When the same user logs in to the domain from multiple
clients, entry for each IP address is displayed separately. If multiple users logs in to the same domain, entry
for each user is listed separately.
— Domain: The name of the domain.
— First Seen: The timestamp when the user logged in to the network for the first time.
— IP Address: The IP address of the client.
— Data Source: The IP address of the Microsoft server or the API method.
— Data Source IP Address: Displays the source from which the data is collected. It can be Cisco ISE, Microsoft
server or the API method.
— Last Seen: The timestamp when the user was last seen accessing the network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 615

IP Address Management

— Last updated: Displays the timestamp when the user information was last updated.

Viewing Network Users Login History

You can view the login history of end-host devices, networks, and Active Directory domain users. You must first enable
the identity mapping feature to view user login information. For information about enabling Identity Mapping feature,
see Enabling Identity Mapping on page 615.
To view network user login history:
1. From the Data Management tab, select the Network Users tab -> User History tab.
Grid Manager displays the following information:
— User Name: The logon name of the user. When the same user logs in to the Active Directory domain from
multiple clients, entry for each IP address is displayed separately. If multiple users logs in to the same
Active Directory domain, entry for each user is listed separately.
— Domain: Name of the Active Directory domain.
— First Seen: The timestamp when the user logged in to the Active Directory domain for the fist time.
— Log Out Time: Displays the log out time of the user.
— IP Address: The IP address of the client.
— Data Source: The IP address of the Microsoft server or the API method.
— Status: Displays the status of the user. The status can be one of the following: Active (logged in), Logged
Out, and Timed Out.
— Active: The user is logged in and active.
— Logged Out: The user has logged out of the system.
— Timed Out: The user is logged in but has been idled for a certain period of time. The default is two
hours. You can configured this time interval, as described in on page 616.
— Last Seen: The timestamp when the user was last seen accessing the network.
— Last updated: The timestamp when the user information was last updated.

Configuring Active User Timeout Session

You can configure the amount of time that an active session of a user changes to timed out. When the idle session
time is reached, the user status changes to inactive status. The default idle time is 2 hours. You can change it to
minutes, hours, or days. The user status can be one of the following: Active, Logged Out, and Timed Out. For
information about how to view this status, see on page 616.
To configure active user timeout interval:
1. From the Grid tab -> Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
2. Select Microsoft Integration tab in the Grid Properties Editor and complete the following in the Basic tab:
— Assumed Network Users Time Out: Specify the time period after which the user status changes to Timed
Out. Select the time period in minutes, hours, or days from the drop-down list.
3. Save the configuration.

616 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 14 IP Discovery and vDiscovery
This chapter provides information about the Infoblox IP discovery and vDiscovery, and how you can use them to
detect, collect, and manage information about active hosts in predefined networks as well as virtual entities in
private, public, and hybrid clouds managed through CMPs (Cloud Management Platforms) such as VMware vCenter
servers and vSphere Hypervisor, OpenStack, and AWS (Amazon Web Services). It also explains how to integrate and
view discovered data from Trinzic Network Automation appliances.
This chapter includes the following sections:
• About Discovery on page 619
— Administrative Permissions on page 620
— IP Discovery Process on page 621
— Supported IP Discovery Methods on page 622
• Guidelines Before Starting a Discovery on page 625
— Database Updates on page 625
— Database Capacity on page 625
— HA Failover on page 626
• Configuring IP Discovery on page 626
— Guidelines for Starting and Scheduling IP Discovery on page 626
— Configuring and Starting an IP discovery on page 627
— Defining IP Discovery Method on page 627
— Scheduling IP Discovery on page 628
— Monitoring IP Discovery Status on page 630
• Configuring vDiscovery Jobs on page 630
— Selecting the vDiscovery Member on page 632
— Selecting the Endpoint Server on page 632
— Defining Network Views on page 633
— Defining Policies for Handling Discovered Data on page 634
— Scheduling vDiscovery Jobs on page 640
— Managing vDiscovery Jobs on page 641
• Integrating Discovered Data From Trinzic Network Automation on page 650

NIOS 7.3 NIOS Administrator Guide (Rev. A) 617

IP Discovery and vDiscovery

• Viewing Discovered Data on page 642

• Managing Discovered Data on page 645
— Managing Unmanaged Data on page 645
— Resolving Conflicting Addresses on page 647
— Clearing Discovered Data on page 649
— Clearing All Discovery Data on page 650

618 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Discovery

About Discovery

Note: The discovery features described in this chapter apply to NIOS Grid deployments that do not use the Discovery
license and its accompanying features under Network Insight. Network Insight provides the ability to discover,
query, and catalog routed and switched networks and the devices within them, including infrastructure
routers, enterprise switches, security devices such as firewalls, wireless access points, end host computer
systems, and more. For more information about Network Insight, see Infoblox Network Insight on page 653.

Infoblox provides IP discovery for detecting and obtaining information about active hosts in predefined networks,
and vDiscovery for discovering virtual entities and interfaces (such as vSwitch and vRouter) in private, public, and
hybrid clouds managed through CMPs (Cloud Management Platforms) such as VMware vCenter servers and vSphere
Hypervisor, OpenStack, and AWS (Amazon Web Services). You can configure multiple discovery tasks on one or more
discovering members.
• IP discovery: You execute an IP discovery (Data Management tab -> IPAM tab -> Discovery from the Toolbar) to
detect active hosts on specified networks in a network view. You can configure the appliance to perform an IP
discovery using one of the following protocols: ICMP (Internet Control Message Protocol), NetBIOS (Network
Basic Input/Output System), and TCP (Transmission Control Protocol). For more information, see Supported IP
Discovery Methods on page 622. You can start an IP discovery immediately after you configure it, schedule it for
a later date and time, or configure a recurring discovery based on a recurrence pattern. For information about
how to configure an IP discovery, see Configuring IP Discovery on page 626.
• vDiscovery: This is an extension to the former VM discovery, in which the NIOS appliance only discovers virtual
entities on VMware vCenter and vSphere servers. A vDiscovery job (from the Data Management tab -> IPAM tab ->
vDiscovery from the Toolbar, or Cloud tab -> any sub tab -> vDiscovery from the Toolbar) now detects virtual
entities and interfaces in private, public, and hybrid clouds that are managed through VMware vCenter servers
and vSphere Hypervisor, OpenStack, or AWS. You can define vDiscovery jobs through the vDiscovery Job wizard
and manage all configured vDiscovery jobs through the vDiscovery Job Manager. Note that for a specific
vDiscovery job, NIOS synchronizes successive discovered data (not the associated NIOS objects) with the data
in the targeted CMP. For example, if you change the IP address of a VM, this information is reflected in the next
discovery of the same vDiscovery job. If you terminate a VM, the VM is deleted from the NIOS database. If you
delete certain information on the CMP, the respective discovered data is removed from the NIOS database. Be
aware that if you change the parameters of a vDiscovery Job, the last discovered data from this job will be
automatically cleaned up so that the appliance can continue to synchronize data from one discovery to the next.
If you do not want to lose discovered data for a specific vDiscovery job, you should create a new vDiscovery job
for this new collection instead of modifying the current job. For information about how to configure vDiscovery
jobs for specific CMPs and how to manage them, see Configuring vDiscovery Jobs on page 630 and Managing
vDiscovery Jobs on page 641.

Note: For new installations, an IP discovery task is automatically created by default. You can choose to disable the
IP discovery after you have set up your appliance. However, you must configure and manually schedule
vDiscovery jobs in order for the appliance to detect and collect information about virtual entities in the clouds.
When you upgrade from a previous NIOS release to NIOS 7.2 and later, former VM Discovery tasks are divided
into separate vDiscovery jobs based on the server endpoints defined in the VM Discovery tasks. All new
vDiscovery jobs inherit the same discovery schedule from the old tasks. You must manually enable the new
vDiscovery schedules in order for the appliance to perform vDiscovery jobs. For information about how to
enable the vDiscovery schedule, see Scheduling vDiscovery Jobs on page 640.

After a discovery, the appliance updates the database with the discovered data based on the discovery configuration.
For example, you can configure the appliance to merge newly discovered data, consolidate managed data, or update
unmanaged data. The appliance also identifies unmanaged and conflict data after a discovery. Unmanaged data is
discovered data that is not configured for DNS or DHCP and has no associated NIOS objects. Conflict data is
discovered data that is configured for DNS or DHCP and has associated NIOS object or objects, but certain key values
are different than those in the NIOS database. For information about guidelines the appliance uses to update
discovered data, see Guidelines Before Starting a Discovery on page 625 and Guidelines for Configuring vDiscovery
Jobs on page 630.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 619

IP Discovery and vDiscovery

Grid Manager displays discovered data in the Discovered Data section of the IP address properties panel when you
drill down to individual IPs. For information about how to view and manage discovered data, see Viewing Discovered
Data on page 642 and Managing Discovered Data on page 645. The appliance records admin operations in the audit
log and discovery operations in the syslog.
Figure 14.1 shows a high-level perspective of the discovery processes. You can configure and initiate an IP discovery
from the Discovery Manager wizard and a vDiscovery from the vDiscovery Job wizard. You must first select a Grid
member that runs the discovery tasks. After you configure an IP discovery task and a vDiscovery job, the Grid Master
sends the discovery requests to the selected member. Based on the configuration of the discovery tasks, the selected
member runs the discovery and collects information about discovered hosts and virtual entities from the specified
networks and cloud platforms. The Grid member then reports the discovered results to the Grid Master. Based on the
discovery configuration, the Grid Master updates the database with discovered data.

Figure 14.1 High-Level Discovery Process

3 The Grid member scans

the specified networks and
CMPs.
2 The Grid Master sends
discovery requests to the
Grid member that runs the Network
discovery tasks. 10.0.0.0/8
1 User configures an IP
discovery task and a
vDiscovery job.
Network
Discovery Devices
Requests IP discovery

User views and

vDiscovery VMware
manages the
discovered data.
Grid Master Grid Member
10.1.1.11 Database 10.1.1.16 OpenStack

The Grid Master Discovered

6 Data
updates the database AWS
with discovered data,
based on the discovery
configuration. 5 The Grid member returns 4 In IP discovery, active hosts
information about detected respond to the discovery. In
active hosts and virtual vDiscovery, information about
entities. virtual entities in the specified cloud
platforms is retrieved.

Administrative Permissions
You can initiate a discovery and manage discovered data based on your administrative permissions. You must have
read/write permission to “Network Discovery” to initiate and manage IP discovery and vDiscovery. You must have at
least read-only permission to “All Tenants” and “All Network Views” to view discovered data in the VMs (by IP
Address) tab in the Cloud tab. To take actions on discovered data, such as resolving conflicts or clear unmanaged
data, you must have read/write permissions. For information about how to configure admin permissions, see About
Administrative Permissions on page 195.
Following are permission guidelines for initiating and controlling a discovery:
• Superusers can initiate and control a discovery on all networks and CMPs.
• Administrators with read/write permission to “Network Discovery” can initiate and control a vDiscovery job or
an IP discovery. For IP discovery, only the objects with IP addresses to which the administrators have read/write
permission are updated to include the discovered data.

620 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Discovery

After a discovery is completed, the following permission guidelines apply to viewing and managing discovered data:
• Superusers can view and manage all discovered data.
• Administrators with read/write permission to networks can view all discovered data. They can also add
unmanaged data to existing hosts, and resolve IP address conflicts.
• Only administrators with read/write permission to a DNS zone or specific record type can convert unmanaged
data to a host, fixed address, reservation, A record, or PTR record.
• Administrators with read-only permission to networks can only view discovered data. They cannot change any
discovered data.

IP Discovery Process
Once an IP discovery starts, the Grid member reports the discovery status, such as Completed, Running, Paused,
Stopped, or Error, in the Discovery Manager wizard and the Discovery Status widget on the Dashboard. In the
Discovery Status widget, Grid Manager reports the time when the discovery status was last updated and the numbers
of each type of discovered data. For information, see Discovery Status on page 153.
When an IP discovery starts, the appliance divides the IP addresses in a network into chunks, with each chunk
containing 64 contiguous IP addresses. The discovery process probes each IP address in parallel and in ascending
order, reports the detected information, updates the progress report, and then moves on to the next chunk until it
hits the last chunk of IP addresses. The appliance then updates the database with the discovered data.
An IP discovery scans the selected networks in the order the networks appear in the Discover Manager wizard.
You can configure discovery processes on the same network, but the same configuration cannot be shared between
two discovery processes.
Figure 14.2 illustrates how an IP discovery works.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 621

IP Discovery and vDiscovery

Figure 14.2 IP Discovery Process

Network 10.0.0.0/8
The Grid member scans
networks using a splitting
mechanism. Each IP chunk in a 10.0.0.1
network contains 64 contiguous 10.0.0.2 10.0.0.65
IP addresses. 10.0.0.3 10.0.0.66 10.0.0.130
. 10.0.0.67 10.0.0.131
. . 10.0.0.132
10.0.0.64 . .
10.0.0.129 .
1st IP Chunk
10.0.0.194
2nd IP Chunk
3rd IP Chunk
Discovery
Request

Network 10.0.1.0/24

Grid Master
10.1.1.11 10.0.1.1
Grid Member
10.0.1.2 10.0.1.65
10.1.1.16
10.0.1.3 10.0.1.66 10.0.1.130
Discovered . 10.0.1.67 10.0.1.131
Data . . 10.0.1.132
10.0.1.64 . .
Database
10.0.1.129 .
1st IP Chunk
10.0.1.194
2nd IP Chunk
The Grid member reports the 3rd IP Chunk
discovery status and discovered data.
Grid Manager displays the discovery
status in the Discovery Manager
widget and updates the database with
the discovered data.
The Grid member probes each IP address in each chunk,
reports the detected information, updates the progress
report, and then moves on to the next chunk until it hits the
last IP chunk in the last discovered network.

Supported IP Discovery Methods

When you perform an IP discovery, you can choose one of the following discovery methods:
• ICMP as described in ICMP.
• NetBIOS as described in NetBIOS.
• TCP as described in TCP on page 623.
• Full as described in Full on page 624.
These methods actively scan predefined networks and probe IP addresses. The Grid member listens for responses
from the IP addresses as proof of activities. The IP discovery scans through the specified network ranges and probes
IP addresses (except for the network, broadcast, and multicast address types) in each network, including the /31 and
/32 subnets. Note that the possible addresses in the /31 and /32 subnets can be used only as source addresses for
point-to-point links. In these cases, there are no broadcast or network addresses in the /31 and /32 subnets, and
the appliance can discover source addresses in these subnets.

622 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Discovery

ICMP
This method detects active hosts on a network by sending ICMP echo request packets (also referred to as pings) and
listening for ICMP echo responses. The ICMP discovery is a simple and fast discovery that detects whether an IP
address exists or not. It returns only the IP address and MAC address (only if the Grid member running the discovery
is on the same discovered network) of a detected host. The ICMP discovery might miss some active hosts on the
network due to security measures that are put in place to block ICMP attacks.
You configure the timeout value and the number of attempts in the Discovery Manager wizard. The ICMP discovery
method returns the following information for each detected host:
• IP address: The IP address of the host.
• MAC address: The discovery returns the MAC address only if the Grid member running the discovery is on the
same discovered network.
To use the ICMP discovery method, the ICMP protocol between the Grid member performing the discovery and the
target networks must be unfiltered.

NetBIOS
The NetBIOS method queries IP addresses for an existing NetBIOS service. This method detects active hosts by
sending NetBIOS queries and listening for NetBIOS replies. It is a fast discovery that focuses on Microsoft hosts or
non-Microsoft hosts that run NetBIOS services.
You configure the timeout value and the number of attempts in the Discovery Manager wizard. This method returns
the following information for each detected host:
• IP address: The IP address of the host.
• MAC address: Only if the discovered host is running Microsoft.
• OS: This value is set to Microsoft for an active host that has a MAC address in the NetBIOS reply.
• NetBIOS name: This value is set to the name returned in the NetBIOS reply.
To use the NetBIOS discovery method, ports 137 (UDP/TCP) and 139 (UDP/TCP) between the Grid member
performing the discovery and the target networks must be unfiltered.

TCP
The TCP discovery probes each active host on a list of TCP ports using TCP SYN packets. This method detects all active
hosts that generate SYN ACK responses to at least one TCP SYN. The discovery can determine the OS on a host by
analyzing how the host reacts to the requests on opened and closed ports. It then uses the TCP fingerprints to guess
the OS. To obtain a TCP fingerprint, IP discovery provides two scanning techniques, SYN and CONNECT.
When you use the SYN technique, the discovery sends a TCP SYN packet to establish a connection on a TCP port. If
the port is open, the host replies with a SYN ACK response. The discovery does not close the port connection.
The CONNECT technique is a three-way TCP handshake. The discovery starts with the same process as the SYN
technique by sending the TCP SYN packet. If the host replies with a SYN ACK response, the discovery then sends a
RST packet to close the connection. If the response contains a RST flag, it indicates that the port is closed. If there is
no reply, the port is considered as filtered. The TCP discovery is a deliberate and accurate discovery method. It can
basically detect all active hosts on a network provided that there are no firewalls implemented on the network.
You can select the TCP ports, the TCP scanning technique, and configure the timeout value and the number of
attempts in the Discovery Manager wizard. This method returns the following information for each detected host:
• IP address: The IP address of the host.
• MAC address: The discovery returns the MAC address only if the Grid member running the discovery is on the
same discovered network.
• OS: This is set to the highest probable OS reported in the response.
To use the TCP discovery method, the TCP port and a specific set of ports between the Grid member and the
discovered networks must be unfiltered. The default set of ports is defined by the factory settings.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 623

IP Discovery and vDiscovery

Full
The full discovery method is a combination of an ICMP discovery, a NetBIOS discovery, a TCP discovery, and a UDP
scan. This method starts by sending an ICMP echo request. If no IP address on the network responds to the ICMP
request, the discovery ends. If there is at least one response to the ICMP echo request, a NetBIOS discovery starts. A
TCP discovery then follows by skipping through the active hosts that the NetBIOS discovery detects. The TCP
discovery also handles the NetBIOS-detected hosts that have no MAC addresses. This method also performs a UDP
scan to determine which UDP ports are open.
You configure the timeout value and the number of attempts in the Discovery Manager wizard. The full discovery
method returns the following information for each detected host:
• IP address
• MAC address
• OS
• NetBIOS name
To use the full discovery, all the filter and firewall requirements in the ICMP, NetBIOS, and TCP discovery methods
apply.
The following is a summary of the supported IP discovery methods:

Discovery Type Returned Data Guideline Mechanism

ICMP • IP address Use ICMP for a rough and fast ICMP echo request and
• MAC address discovery reply

NetBIOS • IP address Use NetBIOS for discovering NetBIOS query and reply
• MAC address Microsoft networks or
• OS non-Microsoft networks that run
some NetBIOS services
• NetBIOS name
TCP • IP address Use TCP for an accurate but slow TCP SYN packet and SYN
• MAC address discovery ACK packet
• OS
Full • IP address Use Full for a general and 1. ICMP echo request and
• MAC address comprehensive discovery reply
• OS 2. NetBIOS query and
reply
• NetBIOS name
3. TCP SYN packet and
SYN ACK packet

The method you select to run an IP discovery determines the kind of information the discovery returns and the time
it takes to complete an IP discovery. If time is a concern, the following are factors you may consider when configuring
an IP discovery:
• The timeout value
• The number of attempts
• The number of ports the discovery scans
• The size of network you want to discover

624 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Guidelines Before Starting a Discovery

Guidelines Before Starting a Discovery

Consider the following guidelines before you start a discovery.

Database Updates
After the Grid Master receives discovery data from the Grid member, it integrates the data based on the following
rules:
• For a discovered host with a new IP address, the appliance marks the IP address “unmanaged.”
• For a discovered host associated with one of the following, the appliance updates the data of the associated
object:
— A fixed address reservation or host address reservation
— A host address not configured for DHCP services
— A fixed address or host address with the same MAC address as that of the discovered host
— An A or PTR record
— A DHCP lease with the same MAC address as that of the discovered host
• For a DHCP lease that does not have any associated object, such as a fixed address or host record, the
appliance updates the IP address with the discovered data. When the lease expires and the IP address has no
associated objects, the appliance marks the IP address “unmanaged”. When the lease expires and the IP
address is associated with the same MAC address, the appliance preserves the discovered data.
• For a discovered host associated with one of the following, the appliance updates all data except the MAC
address and marks the IP address as a conflict. For information, see Resolving Conflicting Addresses on page
647.
— A fixed address with a different MAC address than that of the discovered host
— A DHCP lease with associated objects and with a different MAC address than that of the discovered host
— An Infoblox host address configured for DHCP services and with a different MAC address than that of the
discovered host
• For a discovered host that is part of a DHCP range but does not have a fixed or leased address or is not within an
exclusion range, the appliance assigns a DHCP range conflict to the IP address.
• For a discovered host through a vDiscovery, the appliance adds the discovered data to the database. The data is
displayed in the IP Map and IP List panels, the Discovered Data tab of an object editor, and the Discovered Data
section of the IP Address panel.
• The OS of an IP address obtained by an IP discovery supersedes that obtained by a vDiscovery, and the newly
discovered name of a host supersedes the last discovered data.
• When a vDiscovery cannot obtain the IP address of a virtual entity, it does not return any discovered data for the
entity.
• Only the objects with IP addresses to which the administrators have read/write permission are updated to
include the vDiscovery data.

Database Capacity
When the Grid Master database reaches its maximum capacity (the maximum capacity varies based on the appliance
model), the Grid Master stops updating the database and requests that the Grid member stop the discovery. When
the discovering Grid member database reaches its capacity, the Grid member pauses the discovery. The appliance
displays a dialog to inform you that the discovery pauses. The Grid member resumes the discovery once the database
falls below its capacity. When a discovery pauses because of capacity issues, you cannot resume the discovery or
start a new discovery. You can check the capacity of your appliance database before starting a discovery.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 625

IP Discovery and vDiscovery

HA Failover
In an HA pair, if the Grid Master fails over to the passive node, the passive node takes over and continues with the
discovery from the last known state. If an independent appliance fails, the appliance stops the discovery process and
keeps the discovery in a paused state. The appliance resumes the discovery once it starts up again.

Configuring IP Discovery
You must have read/write permission to Network Discovery to initiate a discovery. After you start a discovery, you
cannot change the configuration of the discovery, but you can start the discovery process immediately or schedule it
for a later date. You can also configure a recurring discovery that repeats on a regular basis. For information, see
Configuring and Starting an IP discovery on page 627 and Scheduling IP Discovery on page 628. The appliance saves
the configuration of the last discovery.
When you start an IP discovery from the IPAM Home, Net Map or Network List panel, you can select the networks on
which you want the discovery to run. When you start an IP discovery from the IP Map or IP List panel, the discovered
network is the one to which the IP addresses belong. You can include additional networks when you configure the IP
discovery from the Discovery Manager wizard. You can run an IP discovery on multiple networks in one network view.

Guidelines for Starting and Scheduling IP Discovery

After you configure a discovery, you can start the discovery process immediately or schedule it for a later date. You
can also configure a recurring discovery that repeats on a regular basis. When you start a discovery immediately or
schedule for a later date after you configure it, the discovery happens only once and it will not be repeated. To repeat
a discovery regularly, you can configure a recurring discovery. A recurring discovery occurs repeatedly based on the
schedule you have configured. For more information about how to start a discovery immediately or schedule it for a
later date, see Configuring and Starting an IP discovery on page 627 and Scheduling IP Discovery on page 628.
You can configure IP discovery tasks independent of each other and each one contains a specific set of networks and
discovery settings.
Note the following guidelines about immediate, regular and recurring IP discovery tasks:
• You cannot run regular and recurring discovery processes concurrently.
• If a recurring discovery is scheduled to start when a discovery is in progress, the recurring discovery will be
postponed to the next schedule time. The current recurring discovery will not be performed.
• You can pause and resume all discovery tasks.
• You cannot start a discovery when another one has been paused.
• You cannot use the start command to start a recurring discovery.
• Discovery permissions are applicable to all discovery tasks.

626 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IP Discovery

Configuring and Starting an IP discovery

To start an IP discovery immediately after you configure it:
1. From the Data Management tab, select the IPAM tab, and then select Discovery -> Discover Now from the Toolbar.
2. In the Discovery Manager wizard, click the General tab, and then complete the following in the Basic tab:
— Current Status: Displays the last discovery status and timestamp. This data is read-only.
— Member Name: Click Select Member. In the Member Selector dialog box, select the Grid member from
which you want to run the discovery. You can also use filters or the Go to function to find a specific member.
For information, see Using Filters on page 76 and Using the Go To Function on page 81.
— Merge the discovered data with existing data: When you select this check box, the appliance merges the
discovered data with the existing data. It appends newly discovered data to existing data and preserves the
existing data when there is no newly discovered data. This check box is selected by default.

Note: If you clear this check box, the appliance replaces the existing data with the newly discovered data and if
there are no newly discovered values for some fields, the appliance removes the existing values for these
fields and the fields become empty.

— Update discovered data for managed objects: Select this check box if you want the appliance to update the
data of existing managed objects such as A records, PTR records, host records, and fixed addresses, with
the discovered data. If you clear this check box, the appliance updates only the unmanaged objects. This
check box is selected by default.
3. Click Save to save the discovery configuration. Note that you must save the configuration before you can start a
discovery.
4. Click Start to start the IP discovery. You can also do one of the following:
— Restore to Defaults: Restore the discovery configuration using the default values.
— Pause: Stop a running discovery.
— Resume: Resume the discovery that has been stopped.
— Save: Save the discovery configuration.
— Close: Cancel the configuration. If you have started a discovery, the discovery runs in the background when
you click Close. For information, see Running Tasks in the Background on page 100.

Note: Once you start a discovery, you cannot change the discovery configuration. After you click Start, the button
changes to Pause. You can click Pause to pause a discovery. When the discovery is paused, the button changes
to Resume. You can click Resume to continue the paused discovery.

Defining IP Discovery Method

To configure the IP discovery method you want to use:
1. From the Data Management tab, select the IPAM tab, and then select Discovery -> Discover Now from the Toolbar.
2. In the Discovery Manager wizard, click the IPv4 Device Discovery tab, and then complete the following in the
Basic tab:
— Mode: Select the IP discovery method you want to use. For information, see Supported IP Discovery
Methods on page 622. If you select TCP or FULL, ensure that you configure the TCP ports in the Advanced
tab. The default is FULL.
— Click the Add icon to add networks. In the Network Selector dialog box, select the network view and
networks. Use SHIFT+click and CTRL+click to select multiple networks. You can also use filters or the Go to
function to find a specific network. For information, see Using Filters on page 76 and Using the Go To
Function on page 81.
You can do the following in the table:
— Click the Add icon again to add more networks.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 627

IP Discovery and vDiscovery

— Select a network or multiple networks in the network table and click Delete to delete them.
— Click the Export icon to export the data in CSV format.
— Click the Print icon to print the data.
— Disable: Select this to exclude an IP discovery task. IP discovery is enabled by default.
3. If you select TCP or FULL in Mode, click the Advanced tab and complete the following:
— TCP Scan Technique: Select the TCP technique you want to use for the discovery. The default is SYN. For
information, see TCP on page 623.
— In the port table, select the check box of the port you want to configure. You can select all ports by clicking
the check box in the header.
Optionally, you can click the Add icon and complete the following to add a new service to the list.
— Port: Enter the port number you want to add to the list. You must enter a number between 1 and 65535.
— Service: Enter the name of the service.
You can also delete a specific TCP port in the list. You can select multiple ports for deletion.
— Timeout (ms): Enter the timeout value in milliseconds for the discovery. The timeout value determines how
long the discovery waits for a response from an IP address after probing it. The minimum is 5 and the
maximum is 4000. The default is 1000.
— Attempts: Enter the number of times you want the discovery to probe an IP address when scanning a
network. The minimum is 1 and the maximum is 5. The default is 2.
4. Click Save to save the discovery configuration. Note that you must save the configuration before you can start a
discovery.
5. Click Start to start the IP discovery. You can also do one of the following:
— Restore to Defaults: Restore the discovery configuration using the default values.
— Pause: Pause a running discovery.
— Resume: Resume the discovery that has been stopped.
— Save: Save the discovery configuration.
— Close: Cancel the configuration. If you have started a discovery, the discovery runs in the background when
you click Close. For information, see Running Tasks in the Background on page 100.
You can do the following after a discovery is complete:
• View the discovery status. You can view the current discovery status in the Discovery Status widget on the
Dashboard. For information, see Dashboards on page 117.
• View the discovered data. For information, see Viewing Discovered Data on page 642.
• Manage the discovered data. For information, see Managing Discovered Data on page 645.

Scheduling IP Discovery
After you configure a discovery (as described in Configuring and Starting an IP discovery on page 627), you can
schedule to run a one-time IP discovery at a later date and time. You can also schedule a recurring IP discovery by
configuring a recurrence pattern. The appliance automatically starts a recurring discovery based on the configured
schedule and detects any newly added or removed networks. Note that you can only schedule the start of a discovery,
you cannot schedule it to pause, stop, or resume. After a scheduled discovery starts, you can then pause, stop, or
resume it.
You can schedule only one IP discovery at a time. Once you schedule a discovery, you cannot change the configuration
until the task is cancelled or executed. You can however disable a recurring discovery. When you disable a recurring
discovery, it will not recur during the scheduled interval.

628 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IP Discovery

To schedule a one-time IP discovery for a specific date and time:

1. From the Data Management tab, select the IPAM tab, and then select Discovery -> Discover Now from the Toolbar.
or
From the Discovery Status widget, select Discover Now from the drop-down list, and then click Discovery
Manager.
2. In the Discovery Manager wizard, click the Schedule icon at the top of the wizard. In the Schedule Change panel,
click Later, and then specify a date, time, and time zone. Click Schedule Start to schedule the discovery. If
applicable, you can select Click here to view/manage the scheduled items to reschedule a discovery or view all
scheduled discoveries.
To schedule a recurring IP discovery:
1. From the Data Management tab, select the IPAM tab, and then select Discovery -> Schedule Discovery from the
Toolbar.
or
From the Discovery Status widget, select Schedule Discovery from the drop-down list, and then click Discovery
Manager.
2. In the Discovery Manager wizard, complete the following in the scheduler:
— Disable: Select this check box to disable recurring IP discovery. When you select this check box, IP discovery
will not recur during the scheduled interval. Clear the check box to enable recurring IP discovery.
If you select Hourly, complete the following:
— Schedule every hour(s) at: Enter the number of hours between each update instance. You can enter a value
from 1 to 24.
— Minutes past the hour: Enter the number of minutes past the hour. For example, enter 5 if you want to
schedule the rule update five minutes after the hour.
— Time Zone: Select the time zone for the scheduled time from the drop-down list.
If you select Daily, you can select either Every day or Every Weekday and then complete the following:
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also select a
time from the drop-down list by clicking the time icon.
— Time Zone: Select the time zone for the scheduled time from the drop-down list.
If you select Weekly, complete the following:
— Schedule every week on: Select any day of the week.
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also select a
time from the drop-down list by clicking the time icon.
— Time Zone: Select the time zone for the scheduled time from the drop-down list.
If you select Monthly, complete the following:
— Schedule the day of the month: Enter the day of the month and the monthly interval. For example, to
schedule the rule update on the first day after every 2 months, you can enter Day 1 every 2 month(s).
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also select a
time from the drop-down list by clicking the time icon.
— Time Zone: Select the time zone for the scheduled time from the drop-down list.
3. Click Save to save the configuration.
If the discovery task fails during a scheduled interval, the task stops and will not continue for the corresponding
occurrence. The scheduled task resets and the discovery starts at the next scheduled time. For example, when you
configure a recurring discovery to occur every five hours, discovery starts at the following hours on each day: 00:00,
05:00, 10:00, 15:00, and 20:00. If the discovery scheduled for 05:00 fails, the discovery starts at the next recurrence,
which is at 10:00. For information about failed discovery, see Guidelines for Starting and Scheduling IP Discovery on
page 626.
The following examples explain when a recurring discovery starts based on your configuration:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 629

IP Discovery and vDiscovery

Example 1
When you configure a recurring discovery to occur every five hours, the discovery starts at the following hours on each
day: 00:00, 05:00, 10:00, 15:00, and 20:00. The first occurrence on each day starts at 00:00.

Example 2
When you configure a recurring discovery to occur every two days during a week, the discovery starts on the following
days every week: Monday, Wednesday, Friday, and Sunday. The first occurrence starts on Monday of each week.

Monitoring IP Discovery Status

You can monitor IP discovery status through the Discovery Status widget on the Dashboard. You can also start, pause,
resume, and stop a discovery from the widget. For information, see Discovery Status on page 153.

Configuring vDiscovery Jobs

A vDiscovery job retrieves information about virtual entities in cloud environments that are managed through CMPs
such as VMware, OpenStack, and AWS. You must first select a member to run the vDiscovery job. To ensure that the
job is executed properly, verify the connection between the discovering member and the discovered endpoint. If you
select HTTPS as the protocol for communication, you must upload either an SSL CA (Certified Authority) certificate or
a self-signed SSL certificate to the Grid. For information about how to upload a certificate, see Managing Certificates
on page 63.
Note that when you disable any virtual entities or interfaces on the CMP, the appliance excludes them from the
vDiscovery job. In situations where the discovering member you select to perform vDiscovery jobs is disconnected
from the Grid Master, the member continues to execute vDiscovery jobs based on the configured schedule. Newly
discovered data replaces previously discovered data. The last set of discovered data is considered the most
up-to-date and is sent to the Grid Master when the member reconnects with the Grid Master.
When you configure vDiscovery jobs, you can enable the Infoblox NIOS appliance to automatically create DNS records
for discovered IP addresses of VM instances that are served by the NIOS appliance. For more information about this
feature, see Creating DNS Records for Newly Discovered VMs on page 636.
Before you configure and start a vDiscovery job, there are a few guidelines to consider. For more information, see
Guidelines for Configuring vDiscovery Jobs.

Guidelines for Configuring vDiscovery Jobs

Consider the following guidelines before starting a vDiscovery job:
• Discovered data through a specific vDiscovery job can only be modified or deleted by the same vDiscovery
job. If you create a different vDiscovery job to discover the same network and some of the information in the
network has changed, the newly discovered data and the original discovered data (now old data) co-exist in
the database. The old data is deleted only when you run the original discovery job again. For example,
vDiscovery job “AWSJob1” discovers IP address 10.0.0.11 with VM name “corp100.” This discovered data
is stored in the NIOS database. You subsequently create a new vDiscovery Job “AWSJob2” to discover the
same IP but now the VM name has been changed to “corp200.” The discovered VM name for 10.0.0.11 is
now “corp200.” Both VM names “corp100” and “corp200” exit in the database until you run AWSJob1
again, and “corp100” will be removed from the database.
• Cloud Extensible Attributes:
— To merge discovered cloud extensible attributes into NIOS, you must have at least one cloud license
(Cloud Network Automation or Cloud Platform) installed in the Grid. However, if you want to view the
discovered cloud data in the Cloud tab of Grid Manager, you must have the Cloud Network Automation
license installed on the Grid Master. Otherwise, even though the cloud data is merged into the NIOS
database, you cannot view it through Grid Manager. For information about Cloud Network Automation,
see Deploying Cloud Network Automation on page 361.

630 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring vDiscovery Jobs

— In addition, ensure that you select the auto consolidation options when defining policies for how to
handle the discovered cloud extensible attributes, as described in Defining Policies for Handling
Discovered Data on page 634. Note that only cloud extensible attributes for managed objects are
updated. To update cloud extensible attributes for unmanaged objects, you can first convert the
unmanaged objects to managed objects. For more information, see Managing Unmanaged Data on
page 645.
• When you select VMware as the endpoint server for the vDiscovery job, consider the following:
— Typically, vDiscovery does not collect data about “Network” from VMware vSphere and vCenter servers.
Therefore, you must first define a network in NIOS in order to discover IPs in the network.
— However, if you use vCenter to define a network as “IP_Pool,” which contains the CIDR for the network,
vDiscovery is able to collect this data and translate it into a network. NIOS then creates the network and
updates it with corresponding Cloud extensible attributes.
• If you use an AWS Elastic IP address and select AWS as the endpoint server for the vDiscovery job, you must
first manually create the network in NIOS before launching the vDiscovery job in order to discover the
Elastic IP.
• You cannot delete discovered tenants, networks, and VMs through the vDiscovery process. Conflict
management is not supported for these objects. Note the following:
— Discovered subnets are always created as managed networks. Pools of IP addresses (public pools)
when discovered are translated into managed networks. Any discovered public IP that is not linked to a
pool is marked as unmanaged data in NIOS, unless there is a corresponding network already created.
— Tenant and VM information is merged into NIOS through cloud extensible attributes, only if there is a
cloud license (Cloud Network Automation or Cloud Platform) installed in the Grid. Properties for
unmanaged tenants and VMs are always updated while properties for managed tenants and VMs are
updated only if auto-consolidation of tenant and VM information is selected when you configure the
vDiscovery job. For information about auto-consolidation options, see Defining Policies for Handling
Discovered Data on page 634.
• Properties of a VM address (such as interface name, network encapsulation, segmentation, VLAN ID) can
only be updated through cloud extensible attributes, depending on the policies you select when
configuring a vDiscovery task. To properly integrate discovered VM address properties with NIOS, ensure
that you do one of the following:
— Define cloud extensible attributes for these properties through your cloud adapter. For information
about how to define cloud extensible attributes, refer to the Quick Start Guide for your cloud adapter,
available on the Support site.
— Convert unmanaged VM addresses to managed so discovered cloud extensible attributes can be
merged into NIOS. For more information, see Converting Unmanaged Data on page 646.
• Unmanaged objects in NIOS are updated with newly discovered data and stay as unmanaged objects.
Managed objects in NIOS that have no conflict with newly discovered data are updated and stay as
managed objects.
• If there is conflict between managed objects in NIOS and newly discovered data, the managed objects are
not updated and stay as managed objects while a conflict is flagged for these objects. For information
about how to resolve the conflict, see Resolving Conflicting Addresses on page 647.
• NIOS does not automatically remove unmanaged objects that were discovered in the past but do not exist
in current discoveries. This can happen if your network topology has changed in between discoveries. You
can manually remove these unmanaged objects if you do not want them to stay in the database. For
information about how to remove these objects, see Clearing Unmanaged Data on page 646 and Clearing
Discovered Data on page 649.
• For delegated DNS and DHCP objects, changes are handled by the delegated Cloud Platform Appliance
based on the scope of delegation. Discovered data is still updated by the Grid Master.
To create a new vDiscovery job, complete the following tasks:
1. Name the new job and select a member to perform the vDiscovery, as described in Selecting the vDiscovery
Member on page 632.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 631

IP Discovery and vDiscovery

2. Select a cloud platform for the vDiscovery, as described in Selecting the Endpoint Server on page 632.
3. Define network views for public and private IP addresses, as described in Defining Network Views on page 633.
4. Define policies for handling discovered data, as described in Defining Policies for Handling Discovered Data on
page 634.
5. Optionally, you can enable NIOS to automatically create DNS records for newly discovered VMs using their IP
addresses, as described in Creating DNS Records for Newly Discovered VMs on page 636.
6. Schedule the vDiscovery job, as described in Scheduling vDiscovery Jobs on page 640.

Selecting the vDiscovery Member

To create a new or modify an existing vDiscovery job:
1. For a new vDiscovery job: From the Data Management tab, select the IPAM tab, then select vDiscovery -> New from
the Toolbar; or from the Cloud tab, select vDiscovery -> New from the Toolbar.
or
To modify an existing job: From the Data Management tab, select the IPAM tab and click vDiscovery -> Discovery
Manager from the Toolbar, or from the Cloud tab, select vDiscovery -> Discovery Manager from the Toolbar. In the
vDiscovery Job Manager editor, click the Action icon (shown as a gear in each row) next to a selected job and
select Edit from the menu.
2. In step one of the vDiscovery Job wizard or in the General tab of the vDiscovery Job Properties editor, complete
the following:
— Job Name: Enter the job name for this vDiscovery. It might be helpful to use a name that is unique to this
specific discovery if you plan to configure multiple vDiscovery jobs.
— Member: Click Select to choose the Grid member that will perform the vDiscovery job. If only a single
member is active, the appliance name automatically appears here. When you select a Cloud Platform
Appliance to perform vDiscovery, it communicates directly with the CMPs to obtain information that is not
available through the provisioning process from the cloud adapter.
— Comment: Enter information to describe this discovery.
The new job will not execute until you have completed all configuration steps in the wizard. You will not be
able to save this job until you have completed all job settings.
3. Click Next to select an endpoint server on which you want to perform the vDiscovery job, as described in Selecting
the Endpoint Server on page 632, or save the configuration after you have modified data in this tab.

Selecting the Endpoint Server

1. For a new vDiscovery job: From the Data Management tab, select the IPAM tab, then select vDiscovery -> New from
the Toolbar; or from the Cloud tab, select vDiscovery -> New from the Toolbar.
or
To modify an existing job: From the Data Management tab, select the IPAM tab and click vDiscovery -> Discovery
Manager from the Toolbar, or from the Cloud tab, select vDiscovery -> Discovery Manager from the Toolbar. In the
vDiscovery Job Manager editor, click the Action icon (shown as a gear in each row) next to a selected job and
select Edit from the menu.
2. In step two of the vDiscovery Job wizard, or in the Endpoint tab of the vDiscovery Job Properties editor, complete
the following:

Note: You might lose some discovered data if you modify any of the following parameters for an existing
vDiscovery job. To avoid this, create a new vDiscovery job instead.

— Server Type: Choose one of the following server type for this vDiscovery:

632 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring vDiscovery Jobs

— AWS: Collects information available for the AWS service endpoint. You can perform vDiscovery jobs
through a proxy server in an AWS deployment, including Amazon Route 53. For more information, see
Configuring Proxy Servers on page 442.
— OpenStack: When you select this server type, vDiscovery discovers network information stored in
Neutron servers, VM instance information in Nova servers, and tenant or project information in
Keystone servers.
— VMware: Supports VMware vCenter and vSphere servers v5.0 and later. Collects information for all
virtual entities running on the specified servers.
Depending on the server type you select, other options in this step change accordingly, as follows:
For AWS, complete the following:
— Service Endpoint: This is typically the regional service endpoint for the desired Amazon region.
Example: ec2.us-west-1.amazonaws.com. For more information about AWS service endpoints, refer to
the Infoblox Installation Guide for vNIOS for AWS, available on the Infoblox Support site.
— Port: Enter the port you want to use for the vDiscovery job.
— Protocol: The protocol used for AWS is always over SSL. AWS provides certificates that is linked to the
CA. By default, this certificate is embedded in NIOS and used as a reference for the CA when connecting
to AWS. You can also upload a new certificate as described in Managing Certificates on page 63. If you
upload a new certificate, the embedded certificate will be overwritten by the new one.
— Access Key ID and Secret Access Key: Enter the Access Key ID and Secret Access Key for the AWS service
endpoint. This is the secret key pair for the administrator account that executes the discovery job. For
more information, refer to the Infoblox Installation Guide for vNIOS for AWS, available on the Infoblox
Support site.
For OpenStack, complete the following:
— Keystone Server IP: Enter the Keystone Server IP address.
— Keystone Server Port: Enter the Keystone Server Port value.
— Protocol: Select HTTP or HTTPS as the protocol. When you select HTTPS, you must upload the
corresponding SSL CA certificate to the Grid in order for NIOS to communicate with OpenStack, as
described in Managing Certificates on page 63.
— Username and Password: Enter the username and password of the administrative account that was
configured on OpenStack. When you configure the administrative account, ensure that you have
authorization to obtain device information on a wide network basis.
For VMware, complete the following:
— Host: Enter the host name of the VMware server.
— Port: Enter the port number of the VMware server.
— Protocol: Select HTTP or HTTPS as the protocol. When you select HTTPS, you must upload the
corresponding SSL CA certificate in order for NIOS to communicate with the VMware server, as
described in Managing Certificates on page 63.
— Username and Password: Enter the username and password of the administrative account that was
configured on the specified VMware server. When you configure the administrative account, ensure
that you have authorization to obtain device information.
1. Click Next to define the network views to which discovered data belongs for both public and private IP addresses,
as described in Defining Network Views.

Defining Network Views

To track overlapping networks and IP address ranges so you can discover specific networks and IP addresses, you can
associate one or more network views with a Grid member or Cloud Platform Appliance that is selected to run the
vDiscovery. You can then define a specific network view to which discovered data for public and private IP addresses
belongs if the network view is not automatically detected. If no network view is specified, the default network view is
used.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 633

IP Discovery and vDiscovery

For Network Insight, when you discover networks using multiple discovery interfaces, you must configure network
views so you can associate each discovery interface with an available network view. Note that on the same
discovering member, each discovery interface must have a unique network view association.
1. For a new vDiscovery job: From the Data Management tab, select the IPAM tab, then select vDiscovery -> New from
the Toolbar; or from the Cloud tab, select vDiscovery -> New from the Toolbar.
or
To modify an existing job: From the Data Management tab, select the IPAM tab and click vDiscovery -> Discovery
Manager from the Toolbar, or from the Cloud tab, select vDiscovery -> Discovery Manager from the Toolbar. In the
vDiscovery Job Manager editor, click the Action icon (shown as a gear in each row) next to a selected job and
select Edit from the menu.
2. In step three of the vDiscovery Job wizard, or in the Network View tab of the vDiscovery Job Properties editor,
complete the following:
• Under the For Public IP Addresses section, select one of the following options the appliance uses if the
network view is not automatically detected:
— This Network View: From the drop-down list, specify a network view to which discovered data for public
IP addresses belongs. The default is the default network view. You cannot create a new network view
for this option.
— The tenant’s network view (if it does not exist, create a new one): Select this only if at least one cloud
license is installed in the Grid. When you select this, discovered data for public IP addresses belongs to
the tenant’s network view. If the network view does not exist, the appliance creates it (only if a cloud
license is installed in the Grid). The appliance uses tenant information of a discovered public IP
address to create a new NIOS network view for all discovered objects (primarily subnets) for that
tenant. For example, AWS tenants by default are associated with the user account’s 12-digit account
number (such as 2233441247523), which is the identifier for all objects that are created by that
account in AWS. That tenant value becomes the identifier for the new network view as its objects are
discovered by NIOS.
• Under the For Private IP Addresses section, select one of the following options the appliance uses if the
network view is not automatically detected:
— This Network View: From the drop-down list, select a network view to specify a network view to which
discovered data for private IP addresses belongs. The default is the default network view. You cannot
create a new network view for this option.
— The tenant’s network view (if it does not exist, create a new one): Select this only if at least one Cloud
Platform Appliance is active or a cloud license is installed in the Grid. When you select this, discovered
data for private IP addresses belongs to the tenant’s network view. If the network view does not exist,
the appliance creates it (only if a cloud license is installed in the Grid). The appliance uses tenant
information of a discovered private IP address to create a new NIOS network view for all discovered
objects (primarily subnets) for that tenant. For example, AWS tenants by default are associated with the
user account’s 12-digit account number (such as 2233441247523), which is the identifier for all
objects that are created by that account in AWS. That tenant value becomes the identifier for the new
network view as its objects are discovered by NIOS.
3. Click Next to configure how you want the appliance to handle discovered data, as described in Defining Policies
for Handling Discovered Data.

Defining Policies for Handling Discovered Data

In this step, you define how the appliance handles discovered data.
1. For a new vDiscovery job: From the Data Management tab, select the IPAM tab, then select vDiscovery -> New from
the Toolbar; or from the Cloud tab, select vDiscovery -> New from the Toolbar.
or

634 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring vDiscovery Jobs

To modify an existing job: From the Data Management tab, select the IPAM tab and click vDiscovery -> Discovery
Manager from the Toolbar, or from the Cloud tab, select vDiscovery -> Discovery Manager from the Toolbar. In the
vDiscovery Job Manager editor, click the Action icon (shown as a gear in each row) next to a selected job and
select Edit from the menu.
2. In step four of the vDiscovery Job wizard, or in the Data Consolidation tab of the vDiscovery Job Properties editor,
complete the following:
Under When inserting discovered into NIOS, select one or both of the following:
— Merge the discovered data with existing data: When you select this check box, the appliance merges the
discovered data with the existing data. It appends newly discovered data to existing data and preserves the
existing data when there is no newly discovered data. This check box is selected by default.

Note: If you clear this check box, the appliance replaces the existing data with the newly discovered data and if
there are no newly discovered values for some fields, the appliance removes the existing values for these
fields and the fields become empty.

— Update discovered data for managed objects: Select this check box if you want the appliance to update
discovered data for all corresponding NIOS objects (if they exist in NIOS). If you do not select this check
box, the appliance updates only the discovered data for unmanaged objects. None of the managed data will
be updated. This check box is selected by default.
— For every newly discovered IP address, create: Select this check box to enable NIOS to automatically create
or update DNS records for discovered VM instances (except for cloud adapters such as AWS or DDNS) if the
records were originally created by vDiscovery. For more information about this feature, see Creating DNS
Records for Newly Discovered VMs on page 636.
— Host: Select this to automatically create Host records for discovered VMs.
— A & PTR Record: Select this to automatically create A and PTR records for discovered VMs. Note that the
DNS zones and reverse-mapping zones to which the records belong must exist in NIOS before the
vDicsovery job is executed. Otherwise, vDiscovery does not create the records.
— The DNS name will be computed from the formula: Enter the formula that NIOS uses to create the DNS
records for each discovered VM address. For example, if there are two IP addresses associated with a
VM, NIOS creates two DNS records, or a host record with two IP addresses, depending on your
configuration. You must use the syntax of ${parameter name} for the formula. 
For AWS, OpenStack, and VMware cloud platforms, this field supports the following parameters:
vm_id, vm_name, discovered_name, tenant_ID, tenant_name, subnet_id, subnet_name,
network_id, network_name, vport_name, ip_address, ip_address_octet1 or 1,
ip_address_octet2 or 2, ip_address_octet3 or 3, ip_address_octet4 or 4. Note that it
does not support IPv6 addresses. 
For example, when you enter ${vm_name}.corp100.com and the discovered vm_name = XYZ, the DNS
name for this IP becomes XYZ.corp100.com. When you enter ${discover_name} here and the
discovered name for the IP is ip-172-31-1-64.us-west-1.compute.internal, the DNS name for
this IP is ip-172-31-1-64.us-west-1.compute.internal.
Under When discovered data is linked to managed data, select any combination of the following.

Note: Tenants and VMs are managed objects when they have NIOS objects, such as Host records or fixed
addresses, associate with them. Otherwise, they are unmanaged objects. The appliance always updates
properties for all unmanaged objects.

— Auto-consolidate on managed Tenant’s properties: When you select this check box, the appliance updates
properties with discovered data for managed tenants, as well as unmanaged tenants (NIOS always update
unmanaged tenants). When you clear this check box, the appliance does not update discovered data for
managed tenants. This check box is selected by default.
— Auto-consolidate managed VM’s properties: When you select this check box, the appliance updates
properties with discovered data for managed VMs, as well as unmanaged tenants (NIOS always update
unmanaged tenants). When you clear this check box, the appliance does not update discovered data for
managed VMs. This check box is selected by default.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 635

IP Discovery and vDiscovery

— Auto-consolidate Cloud EAs on managed data: When you select this check box, NIOS updates discovered
extensible attribute values for managed objects that contain cloud extensible attributes, only if a cloud
license is installed in the Grid. To update cloud extensible attributes for unmanaged objects, convert the
objects to managed objects in NIOS. For more information, see Managing Unmanaged Data on page 645.
3. Click Next to schedule this vDiscovery job and specify when the job should start, as described in Scheduling
vDiscovery Jobs on page 640.

Creating DNS Records for Newly Discovered VMs

When you configure the policies NIOS uses to handle discovered data, you can enable NIOS to automatically create
or update DNS records for discovered IP addresses of VM instances. NIOS automatically adds Host records or A and
PTR records for the discovered VMs based on your configuration. You can also enter a formula that NIOS uses to create
the DNS name for the discovered IP based on its VM parameters such as VM name or discovered name. By doing so,
NIOS is able to discover public and private IP addresses by looking up the corresponding DNS names.
Discovered data includes IP addresses for the VMs and the associated information such as VM ID, VM Name, Tenant
ID, and others. Note that corresponding zones must already exist in order for NIOS to add DNS records. Otherwise,
NIOS does not add any DNS records and it logs a message in the syslog. For information about how to enable this
feature, see Defining Policies for Handling Discovered Data on page 634.
NIOS automatically adds DNS records based on the following conditions:
• The corresponding DNS zones must already exist in the NIOS database. NIOS does not automatically create
DNS zones for the records.
• To create a PTR record, the corresponding reverse-mapping zone must exist.
• A DNS zone cannot be associated with more than one DNS view. NIOS does not create DNS records for
zones that are associated with multiple DNS views.
• NIOS adds new DNS records only if the VM name for the discovered IP address is available and there is no
conflict with information about the associated network view.
On subsequent vDiscovery, if an IP for a VM is removed, the corresponding DNS records is removed. If the IP for a VM
is changed, the IP address in the corresponding DNS record is changed accordingly. If the DNS record name template
is changed, all the DNS recorded are replaced with the DNS records using the new template. All administrative actions
for these change are recorded in the Audit log. Summary of the changes are logged in the syslog.
The following table captures some scenarios about how vDiscovery handles various actions and what the outcome is
for the information on the Cloud Platform appliance and in the NIOS database. All the scenarios in the table use the
following template: $(discovered_name).

Note: vDiscovery updates only records that are created by the vDiscovery process. It does not create or update DNS
records that are originally created by other admin users.

Cloud Platform Cloud Platform NIOS Data

NIOS Data after
Actions and Conditions Data before Data after before vDiscovery
vDiscovery vDiscovery vDiscovery
• Add new VM (vma) on No data for vma 10.10.10.1 Zone: corp1.com Zone: corp1.com
Cloud Platform appliance vma.corp1.com Host record:
• Automatic creation of Host vma.corp1.com
records (10.10.10.1)
• In NIOS: existing zone
corp1.com; no DNS
records

636 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring vDiscovery Jobs

Cloud Platform Cloud Platform NIOS Data

NIOS Data after
Actions and Conditions Data before Data after before
vDiscovery
vDiscovery vDiscovery vDiscovery
• Add new VM (vma) on No data for vma 10.10.10.1 Zone: corp1.com Zone: corp1.com
Cloud Platform appliance vma.corp1.com Host record: Host record:
• Automatic creation of Host vma.corp1.com vma.corp1.com
records (10.10.10.1) (10.10.10.1)
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by vDiscovery or admin)
• Add new interface to 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
existing VM (vma) with the vma.corp1.com vma.corp1.com Host record: Host record:
same discovered name on vma.corp1.com vma.corp1.com
Cloud Platform appliance 10.10.10.2
(10.10.10.1) (10.10.10.1,
• Automatic creation of Host vma.corp1.com
10.10.10.2)
records
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by vDiscovery)
• Add new interface to 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
existing VM (vma) with the vma.corp1.com vma.corp1.com Host record: Host record:
same discovered name on vma.corp1.com vma.corp1.com
Cloud Platform appliance 10.10.10.2
(10.10.10.1) (10.10.10.1)
• Automatic creation of Host vma.corp1.com
records
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by admin)
• Add a new interface to 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
existing VM (vma) with a vma.corp1.com vma.corp1.com Host record: Host record:
different discovered name vma.corp1.com vma.corp1.com
(vma-if2) on the Cloud 10.10.10.2
(10.10.10.1) (10.10.10.1)
Platform appliance vma-if2.corp1.com
Host record:
• Automatic creation of Host vma-if2.corp1.co
records m (10.10.10.2)
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by vDiscovery)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 637

IP Discovery and vDiscovery

Cloud Platform Cloud Platform NIOS Data

NIOS Data after
Actions and Conditions Data before Data after before
vDiscovery
vDiscovery vDiscovery vDiscovery
• Add a new interface to 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
existing VM (vma) with a vma.corp1.com vma.corp1.com Host record: Host record:
different discovered name vma.corp1.com vma.corp1.com
(vma-if2) on the Cloud 10.10.10.2
(10.10.10.1) (10.10.10.1)
Platform appliance vma-if2.corp1.com
Host record:
• Automatic creation of Host vma-if2.corp1.co
records m (10.10.10.2)
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by admin)
• Remove existing VM (vma) 10.10.10.1 No data for vma Zone: corp1.com Zone: corp1.com
on Cloud Platform vma.corp1.com Host record:
appliance vma.corp1.com
• Automatic creation of Host (10.10.10.1)
records
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by vDiscovery)
• Remove existing VM (vma) 10.10.10.1 No data for vma Zone: corp1.com Zone: corp1.com
on Cloud Platform vma.corp1.com Host record: Host record:
appliance vma.corp1.com vma.corp1.com
• Automatic creation of Host (10.10.10.1) (10.10.10.1)
records
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by admin)
• Remove existing interface 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
(10.10.10.2) from VM vma.corp1.com vma.corp1.com Host record: Host record:
(vma) with different vma.corp1.com vma.corp1.com
discovered name 10.10.10.2
(10.10.10.1) (10.10.10.1)
(vma-if2) on Cloud vma-if2.corp1.c
Platform appliance om Host record:
vma-if2.corp1.co
• Automatic creation of Host m (10.10.10.2)
records
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by vDiscovery)

638 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring vDiscovery Jobs

Cloud Platform Cloud Platform NIOS Data

NIOS Data after
Actions and Conditions Data before Data after before
vDiscovery
vDiscovery vDiscovery vDiscovery
• Remove existing interface 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
(10.10.10.2) from VM vma.corp1.com vma.corp1.com Host record: Host record:
(vma) with different vma.corp1.com vma.corp1.com
discovered name 10.10.10.2
(10.10.10.1) (10.10.10.1)
(vma-if2) on Cloud vma-if2.corp1.c
Platform appliance om Host record: Host record:
vma-if2.corp1.co vma-if2.corp1.co
• Automatic creation of Host m (10.10.10.2) m (10.10.10.2)
records
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by admin)
• Update record name (from 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
vma to vm1) for the vma.corp1.com vm1.corp1.com Host record: Host record:
existing interface vma.corp1.com vm1.corp1.com
(10.10.10.1) on Cloud (10.10.10.1) (10.10.10.1)
Platform appliance
• Automatic creation of Host
records
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by vDiscovery)
• Update record name (from 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
vma to vm1) for the vma.corp1.com vm1.corp1.com Host record: Host record:
existing interface vma.corp1.com vma.corp1.com
(10.10.10.1) on Cloud (10.10.10.1) (10.10.10.1)
Platform appliance
Host record:
• Automatic creation of Host vm1.corp1.com
records (10.10.10.1)
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by admin)
• Automatic creation of Host 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
records vma.corp1.com vm1.corp1.com Host record: Host record:
• Change FQDN template vm_name: ABC vm_name: ABC vma.corp1.com ABC.corp1.com
from ${discover_name) to (10.10.10.1) (10.10.10.1)
${vm_name}.corp1.com
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by vDiscovery)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 639

IP Discovery and vDiscovery

Cloud Platform Cloud Platform NIOS Data

NIOS Data after
Actions and Conditions Data before Data after before
vDiscovery
vDiscovery vDiscovery vDiscovery
• Automatic creation of Host 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
records vma.corp1.com vm1.corp1.com Host record: Host record:
• Change FQDN template vm_name: ABC vm_name: ABC vma.corp1.com vma.corp1.com
from ${discover_name) to (10.10.10.1) (10.10.10.1)
${vm_name}.corp1.com Host record:
• In NIOS: existing zone ABC.corp1.com
corp1.com; existing Host (10.10.10.1)
record (originally created
by admin)
• Change vDiscovery task 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
configuration from vma.corp1.com vma.corp1.com Host record: A record:
creation of Host record to vma.corp1.com vma.corp1.com
A and PTR records (10.10.10.1) (10.10.10.1)
• In NIOS: existing zone
corp1.com; existing Host
record (originally created
by vDiscovery)
• Change vDiscovery task 10.10.10.1 10.10.10.1 Zone: corp1.com Zone: corp1.com
configuration from vma.corp1.com vma.corp1.com Host record: Host record:
creation of Host record to vma.corp1.com vma.corp1.com
A and PTR records (10.10.10.1) (10.10.10.1)
• In NIOS: existing zone A record:
corp1.com; existing Host vma.corp1.com
record (originally created (10.10.10.1)
by admin)

Scheduling vDiscovery Jobs

You can enable the appliance to start a vDiscovery immediately after you configure it, schedule it for a later date and
time, or configure a recurring discovery based on a recurrence pattern. Note that all scheduled vDiscovery jobs are
executed in queue based on the order of the schedule in the vDiscovery Job Manager. Therefore, a scheduled
vDiscovery might be delayed if there are other jobs being executed before its scheduled start time.
1. For a new vDiscovery job: From the Data Management tab, select the IPAM tab, then select vDiscovery -> New from
the Toolbar; or from the Cloud tab, select vDiscovery -> New from the Toolbar.
or
To modify an existing job: From the Data Management tab, select the IPAM tab and click vDiscovery -> Discovery
Manager from the Toolbar, or from the Cloud tab, select vDiscovery -> Discovery Manager from the Toolbar. In the
vDiscovery Job Manager editor, click the Action icon (shown as a gear in each row) next to a selected job and
select Edit from the menu.
2. In step five of the vDiscovery Job wizard, or in the Schedule tab of the vDiscovery Job Properties editor, complete
the following:
— Enable: To ensure that the scheduled vDiscovery job takes place, select this check box. When you upgrade
from a previous version of NIOS, you must select this check box after the upgrade to ensure that the
previously configured discovery tasks are being executed at the scheduled time.
If you select Once, complete the following:
— Choose a Start Date using the date picker.
— Time Zone: Select the time zone for the scheduled time from the drop-down list.

640 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring vDiscovery Jobs

If you select Hourly, complete the following:

— Schedule every hour(s) at: Enter the number of hours between each update instance. You can enter a value
from 1 to 24.
— Minutes past the hour: Enter the number of minutes past the hour. For example, enter 5 if you want to
schedule the rule update five minutes after the hour.
— Time Zone: Select the time zone for the scheduled time from the drop-down list.
If you select Daily, you can select either Every day or Every Weekday and then complete the following:
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also select a
time from the drop-down list by clicking the time icon.
— Time Zone: Select the time zone for the scheduled time from the drop-down list.
If you select Weekly, complete the following:
— Schedule every week on: Select any day of the week.
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also select a
time from the drop-down list by clicking the time icon.
— Time Zone: Select the time zone for the scheduled time from the drop-down list.
If you select Monthly, complete the following:
— Schedule the day of the month: Enter the day of the month and the monthly interval. For example, to
schedule the rule update on the first day after every 2 months, you can enter Day 1 every 2 month(s).
— Time: Enter a time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also select a
time from the drop-down list by clicking the time icon.
— Time Zone: Select the time zone for the scheduled time from the drop-down list.
3. Save the vDiscovery job. The appliance lists all vDiscovery jobs in the vDiscovery Job Manager, from which you
can manage jobs that have not been executed, including modifying selected jobs or deleting some. For more
information about how to manage vDiscovery jobs, see Managing vDiscovery Jobs on page 641.

Managing vDiscovery Jobs

You can view all configured vDiscovery jobs or modify some of the settings for selected ones in the vDiscovery Job
Manager. You can also add a new vDiscovery job by clicking the Add icon.
To view or modify vDiscovery jobs:
1. From the Data Management tab, select the IPAM tab, then select vDiscovery -> Discovery Manager from the
Toolbar; or from the Cloud tab, select vDiscovery -> Discovery Manager from the Toolbar.
2. The appliance displays the following information in the vDiscovery Job Manager:
— Name: The name of the vDiscovery job.
— Status: The current status of the vDiscovery job. Grid Manager displays an icon and descriptive information
about the status. You can hover you mouse over the icon to view the current status, as follows:
— Inactive: The configured job exists but is currently inactive.
— Idle: Waiting for the next discovery schedule before the job is executed.
— Ready: The job is in queue for execution based on the configured scheduled.
— Running: The job is being executed at the moment.
— Discovery Task Completed: The job is completed successfully. It will return to the Ready state for the
next scheduled discovery time.
— Discovery Task Completed failed: The job is completed but failed during the process. It will return to the
Ready state for the next scheduled discovery time.
— Canceled: The job was cancelled while it was being executed. It will return to the Ready state for the
next scheduled discovery time.
— Schedule: Displays the configured schedule for the selected job.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 641

IP Discovery and vDiscovery

— Public IP’s Network View: The name of the network view to which discovered data for public IP addresses
belongs.
— Private IP’s Network View: The name of the network view to which discovered data for private IP addresses
belongs.
— Member: The Grid member that performs the vDiscovery job.
— Last Run: The timestamp when the selected vDiscovery job was last performed.
3. Click the Action icon (shown as a gear in each row) next to a selected job, and you can do one of the following:
— Edit: Modify the vDiscovery job settings in the vDiscovery Job Properties editor. The editor displays the
following tabs: General, Endpoint, Network View, Data Consolidation, and Schedule. Click the tab that
contains information you want to modify, and then modify the information as described in Configuring
vDiscovery Jobs on page 630.
— Delete: Remove the vDiscovery job from the list.
— Start: Start vDiscovery now for the selected job.

Note: The appliance might display an AMQP error when you first start a newly created vDiscovery job. This is due
to the start-on-demand mechanism experiencing a delay in executing the job. Wait a few seconds and
start the job again.

— Stop: Stop and terminate the vDiscovery job that is in progress. You cannot resume this discovery once you
stop it. All discovered data remains intact in the database.
4. Click Close to close the vDiscovery Job Manager.

Viewing Discovered Data

After an IP discovery and a vDiscovery, you can view discovered data in the Discovered Data section when you drill
down to a specific IP address in the Net Map, Net List, IP Map or IP List panel. For information about IP Map and IP
List, see IP Map on page 594 and IP Address List on page 595.
You can also view discovered data for Cloud specific VMs in the Cloud tab. Note that you must install the Cloud
Network Automation license on the Grid Master to view the Cloud tab.

Viewing IPAM Discovered Data

To view discovered data in the IPAM tab:
1. In the top navigation bar, select the network view to which discovered data belongs.
2. From the Data Management tab, select the IPAM tab
3. In the IPAM home page, select the network you want to view discovered data and click the link.
4. In the IP List of IP Map panel, click the IP address link to drill down to the IP address properties panel.
5. In the Discovered Data section, click the Configure icon to specify data to be displayed in the Discovered Data
tab.
6. Select fields from the Available list and click the arrow key to move them to the Selected list and vice versa. You
can use CTRL+Click or SHIFT+Click to select multiple fields at one time.
You can also change the order in which the fields are displayed by moving the fields up and down in the
Selected list. To move a field up in the list, select it and click the Up arrow. To move a field down, select it and
click the Down arrow.
7. Click the Configure icon again, and the Discovered Data section displays the fields you have specified. Note the
fields you select appears for all IP addresses in the network.
Depending on the source of the discovered data, when you modify certain DNS and DHCP objects, Grid Manager can
display some of the following discovered data (if any) in the Discovered Data tab:

642 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Discovered Data

• NetBIOS Name: The name returned in the NetBIOS reply or the name you manually register for the discovered
host.
• OS: The operating system of the detected host or virtual entity. The OS can be one of the following:
— Microsoft for all discovered hosts that have a non-null value in the MAC addresses using the NetBIOS
discovery method.
— A value that a TCP discovery returns.
— The OS of a virtual entity on a vSphere server.
• Discovered MAC Address: The discovered MAC address for the host. This is the unique identifier of a network
device. The discovery acquires the MAC address for hosts that are located on the same network as the Grid
member that is running the discovery. This can also be the MAC address of a virtual entity on a specified
vSphere server.
• Discovered DUID: For IPv6 address only. The DHCP unique identifier of the discovered host. This is an optional
field, and data might not be included.
• Last Discovered: The timestamp when the IP address was last discovered.
• First Discovered: The timestamp when the IP address was first discovered.
• Discovered Name: The name of the network device associated with the discovered IP address.
• Discoverer: Specifies whether the IP address was discovered by Network Automation or NIOS discovery process.
If you imported data from Trinzic Network Automation appliances, Grid Manager displays the following information,
if available. For information about the data imported from Trinzic Network Automation appliances, see Integrating
Discovered Data From Trinzic Network Automation on page 650.
• Attached Device Description: A textual description of the switch that is connected to the end device.
• Attached Device Address: The IPv4 or IPv6 address of the switch that is connected to the end device.
• Attached Device Model: If a reverse lookup was successful for the IP address associated with this switch, the
device model is displayed here.
• Attached Device Name: If a reverse lookup was successful for the IP address associated with this switch, the
host name is displayed here.
• Attached Device Port Description: A textual description of the switch port that is connected to the end device.
• Attached Device Port Name: The name of the switch port connected to the end device.
• Attached Device Vendor: The vendor name of the switch port connected to the end device.
• Attached Device Port: The number of the switch port connected to the end device.
• Attached Device Type: Identifies the switch that is connected to the end device.
• Device Vendor: The vendor name of the end device.
• Device Model: The device model of the end device.
• Device Management IP: The IPv4 or IPv6 address of the end device that is connected to the switch.
• Device Port Type: The port type for the end device.
• Device Port Name: The port name for the end device.
• Device Type(s): Identifies the device type.
• Port Duplex: The negotiated or operational duplex setting of the switch port connected to the end device. You
can modify this in the IPv6 fixed address and AAAA record editors.
• Port Link: The link status of the switch port connected to the end device. Indicates whether it is connected.
• Port Speed: The interface speed, in Mbps, of the switch port. You can modify this in the IPv6 fixed address and
AAAA record editors.
• Port Type: The switch port type.
• Port Status: The operational status of the switch port. Indicates whether the port is up or down.
• Open Port(s): Ports that are open.
• VLAN Description: The description of the VLAN of the switch port that is connected to the end device.
• VLAN Name: The name of the VLAN of the switch port.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 643

IP Discovery and vDiscovery

• VLAN ID: The ID of the VLAN of the switch port.

For IP addresses discovered through a vDiscovery, Grid Manager displays the following additional information, if
available:
• Virtual Host Adapter: The name of the physical network adapter through which the virtual entity is connected to
the appliance.
• Virtual Datacenter: The name of the vSphere datacenter or container to which the virtual entity belongs.
• Virtual Cluster: The name of the VMware cluster to which the virtual entity belongs.
• Virtual Entity Name: The name of the virtual entity.
• Virtual Entity Type: The virtual entity type. This can be blank or one of the following: Virtual Machine, Virtual
Host, or Virtual Center. Virtual Center represents a VMware vCenter server.
• Virtual Host: The name of the VMware server on which the virtual entity was discovered.
• Virtual Switch: The name of the switch to which the virtual entity is connected.
• Virtual Machine Name: The name of the VM instance.
• Virtual Machine ID: The ID of the VM.
• Virtual Machine Tenant ID: The tenant ID to which the VM belongs.
• Virtual Machine Port Group: The port group to which the VM belongs.
• Attached Virtual Switch Name: The name of the virtual switch to which the VM is connected.
• Attached Virtual Switch ID: The ID of the virtual switch to which the VM is connected.
• Attached Virtual Switch Type: The type of the virtual switch. This can be standard or distributed.
• Attached Virtual Switch IPv6 Enabled: Indicates that virtual switch that has IPv6 enabled.
• Attached Virtual Port Name: The name of the virtual adapter on the virtual switch to which the VM is connected.
• Attached Virtual Port MAC Address: The MAC address of the virtual adapter on the virtual switch to which the VM
is connected.
• Attached Virtual Port Link Status: The link status of the virtual adapter on the virtual switch to which the VM is
connected.
• Attached Virtual Port Configured Speed: The configured port speed of the virtual adapter on the virtual switch to
which the VM is connected.
• Attached Virtual Port Configured Mode: The configured mode of the virtual adapter on the virtual switch to
which the VM is connected.
• Attached Virtual Port Configured Speed: The actual port speed of the virtual adapter on the virtual switch to
which the VM is connected.
• Attached Virtual Port Configured Mode: The actual mode of the virtual adapter on the virtual switch to which the
VM is connected.
• Network Segment Type: The type of network segment to which the VM is connected.
• Network Segment Name: The name of the network segment to which the VM is connected.
• Network Segment ID: The ID of the network segment to which the VM is connected.
• Network Segment Port Group: The port group of the network segment to which the VM is connected.
• Network Segment Available Ports: The number of available ports reported by the virtual switch to which the VM
is connected.
• Attached Virtual Switch VTEP Type: The type of VTEP (Virtual Tunnel Endpoint) in the virtual switch that is
connected to the VM. This can be VXLAN or STT.
• Attached Virtual Switch VTEP IP: The IP address of the VTEP in the virtual switch that is connected to the VM.
• Attached Virtual Switch VTEP Port Group: The port group of the VTEP in the virtual switch that is connected to the
VM.
• Attached Virtual Switch VTEP VLAN: The VLAN of the VTEP in the virtual switch that is connected to the VM.
• Attached Virtual Switch VTEP DHCP Server: The DHCP server of the VTEP in the virtual switch that is connected to
the VM.

644 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Discovered Data

• Attached Virtual Switch VTEP Multicast: The multicast address of the VTEP in the virtual switch that is connected
to the VM.
• Physical Host IP Address: The IP address of the physical node on which the VM is hosted.
• Physical Host Name: The name of the physical node on which the VM is hosted.
• Physical Host MAC Address: The MAC address of the physical node on which the VM is hosted.
• Physical Host CIDR Subnet: The subnet mask of the physical node on which the VM is hosted.
• Physical Host ‘s NIC Names: The list of all physical port names used by the virtual switch on the physical node
on which the virtual machine is hosted. Valid values are eth1, eth2, eth3, and so on .

Viewing Discovered Data for Cloud VMs

You can view discovered data for cloud specific VMs after performing a vDiscovery job. Note that you must have at
least read-only permission to “All Tenants” and “All Network Views” to view the VMs tab.
To view discovered data for cloud VMs, see Viewing All Cloud VMs on page 392.

Managing Discovered Data

In addition to viewing the discovered data, you can do the following to manage the discovered data:
• Manage an unmanaged address by adding it to a host, converting it to managed data, or clearing its unmanaged
status. Note that for Cloud Network Automation, you can convert discovered data to NIOS objects within a
delegated scope. For information, see Managing Unmanaged Data on page 645.
• Resolve conflicting addresses. For information, see Resolving Conflicting Addresses on page 647.
• Clear discovered data for a network view, network, IP address, or cloud tenant. For information, see Clearing
Discovered Data on page 649.
• You can also clear all discovered data collected by a specified vDiscovery job. For information see Clearing All
Discovery Data on page 650.

Managing Unmanaged Data

You can manage unused and unmanaged addresses by doing one of the following:
• Add to an existing host, as described in Adding to an Existing Host on page 645.
• Convert to a fixed address, host, A record, or PTR record, as described in Converting Unmanaged Data on page
646. Note that for Cloud Network Automation, you can convert discovered data to NIOS objects within a
delegated scope.
• Clear the unmanaged status, as described in Clearing Unmanaged Data on page 646.

Note: You cannot convert unmanaged IP addresses served by Microsoft DHCP servers to host records.

Adding to an Existing Host

You can add an unmanaged address, including all its information, to an existing host. You can select the desired host
to which you want to add the unmanaged address.
To add an unmanaged address to an existing host:
1. From the IP Map or List panel, select an unmanaged address you want to add to a host, and then click Add -> Add
to Existing Host from the Toolbar.
2. In the Select Host dialog box, select a host from the table. You can also search for a host using filters or the Go
to function. For information, see Using Filters on page 76 and Using the Go To Function on page 81. Click the
Select icon to select the desired host.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 645

IP Discovery and vDiscovery

Note: Depending on the page size configuration, the search results are limited to the page size that you set. If
the search results exceed the page size limit, the appliance displays an error message to inform you to
refine your search criteria or to change the page size limit. In the Host Record editor, complete the
information as described in Choose one of the following from the Save & ... drop-down button menu: on
page 583.

3. Save the configuration and click Restart if it appears at the top of the screen.

Converting Unmanaged Data

You can convert an unmanaged address to a host, an A or AAAA record, a PTR record, or a fixed address.
To convert an unmanaged address:
1. In the IP Map or List panel, select an unmanaged address you want to convert, and then select Convert from the
Toolbar.
2. In the drop-down list, select the type of address to which you want to convert the unmanaged address. For IPv4
addresses, you can select To Host, To A Record, To PTR Record, or To Fixed Address. For IPv6 addresses, you can
select To Host, To AAAA, To PTR Record, or To IPv6 Fixed Address.
Depending on the record type you select, Grid Manager displays the corresponding editor. It also populates the
attributes of the unmanaged address in the editor. Enter the appropriate information in the editor.
3. Save the configuration and click Restart if it appears at the top of the screen.

Note: After the conversion, the status of the unmanaged address changes to Used.

The following are some conditions for a conversion:

• A and AAAA records: You must select a DNS zone when converting an unmanaged address to an A or AAAA
record.
• PTR record: You must select a DNS zone when converting an unmanaged address to a PTR record.
• IPv4 and IPv6 Fixed Address: Grid Manager displays a confirmation dialog box to ensure that you want to create
a fixed address for the unmanaged address.
• IPv4 and IPv6 Host record: You can use the unmanaged address to enable a host record for DNS or DHCP.

Clearing Unmanaged Data

Unmanaged objects are objects that are not configured for DNS or DHCP and do not have any corresponding NIOS
objects such as fixed addresses, DNS records, or host records. You can clear unmanaged data if you do not want it to
appear in the discovered data. Any unmanaged data that was discovered in a previous discovery can be removed.
When you clear an unmanaged IP address, the status of the IP address changes to Unused.
Note that for cloud deployments, you can remove an unmanaged VM only when all the VM related properties are
removed first. When the VM is removed, the tenant pointing to this VM will also be removed automatically. For
information about cloud deployments, see Deploying Cloud Network Automation on page 361.
To clear unmanaged data:
1. For IP addresses: From the Data Management tab -> IPAM tab, select an unmanaged IP address in the IP Map or
List panel.
For networks: From the Data Management tab -> IPAM tab -> IP Map or List panel, select a network in which you
want to clear all unmanaged addresses.
For Cloud tenants: From the Cloud tab -> Tenants tab, select a tenant for which you want to clear unmanaged
data.
For Cloud VMs: From the Cloud tab -> VMs tab, select a VM for which you want to clear unmanaged data.
2. Click Clear -> Clear Unmanaged Data or Clear All Unmanaged Data from the Toolbar.
3. In the Clear Unmanaged Data confirmation dialog box, click Yes. The appliance clears data that has no
corresponding NIOS objects such as fixed addresses, DNS records, or host records.

646 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Discovered Data

Note: When you clear unmanaged addresses in a given network view, all unmanaged IPv4 and IPv6 addresses of all
networks in the network view are cleared. When you select an entire network or a specific network in the IP
Map or List panel, all the unmanaged addresses in the network are cleared. After you clear the unmanaged
data, the status of the IP addresses changes to Unused.

Resolving Conflicting Addresses

Conflicts happen when discovered data does not match existing IP address data. The IP Map panel and the Cloud tab
-> VMs tab display conflicting addresses with a red background. The IP List panel displays Conflict as the status for all
conflicting addresses. For objects that have multiple conflicts, Grid Manager lists each of them in a bulleted list in the
Resolve multiple conflicts dialog. You can select a conflict, in any order, to begin resolving each issue. After you
resolve the selected issue, Grid Manager returns to the Resolve multiple conflicts dialog so you can resolve other
issues.
Depending on the conflict, you can do one of the following to resolve it:
• For a DHCP lease conflict, you can clear the existing lease and create either a fixed address or a reservation for
the IP address. You can also keep the existing data and clear the discovered data. For information, see
Resolving DHCP Lease Conflicts.
• For a fixed address conflict, you can either keep the existing fixed address data or update the existing data with
the discovered data. For information, see Resolving Fixed Address Conflicts on page 648.
• For a DHCP range conflict, you can create a fixed address, create a reservation, or clear the discovered data. For
information, see Resolving DHCP Range Conflicts on page 648.
• For a host conflict, you can either keep the existing host record data or update the existing data with the
discovered data. For information, see Resolving Host Conflicts on page 648.
• For a VM affiliation conflict, you can either update all the displayed objects to be affiliate with the discovered
data or keep the current affiliation and clear the conflict. For information, see Resolving VM Affiliation Conflicts
on page 649.
You must resolve conflicting addresses individually. You cannot resolve multiple conflicts at the same time.

Note: Once the conflict is resolved, the status of the IP address changes depending on how you resolved the conflict.

To resolve a conflict:
1. In the IP Map or List panel, select a conflicting address, and then click Resolve Conflict from the Toolbar.
2. The Resolve Conflict dialog box displays the reason of the conflict and lists the existing information and
discovered information of the address in the Description field. Depending on the type of conflict, the appliance
displays the corresponding resolution options. You can compare the existing and discovered data and decide
how you want to resolve the conflict.

Resolving DHCP Lease Conflicts

When an IP address has a DHCP lease and the discovered MAC address is in conflict with the existing MAC address,
the IP address has a DHCP lease conflict.
To resolve a DHCP lease conflict:
1. In the Resolve Conflict or Resolve multiple conflicts dialog, Grid Manager displays the nature of the conflict and
the discovered data versus the current data. Select one of the following to resolve the conflict:
— Clear lease and create fixed address from discovered data: Clears the existing DHCP lease and creates a
fixed address with the discovered data. The Fixed Address editor appears with the discovered data
populated.
— Clear lease and create a reservation from discovered data: Clears the existing DHCP lease and creates a new
reservation using the discovered data. The Reservation editor appears with the discovered data populated.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 647

IP Discovery and vDiscovery

This option does not apply to leases served by Microsoft DHCP servers because they do not support
Infoblox reservations. For information about managing DHCP data served by Microsoft servers, see Chapter
36, Managing Microsoft DHCP Services, on page 1301.
— Keep the existing and ignore this conflict: Keeps the current DHCP lease for the address and ignores the
lease conflict.
2. Click OK or Resolve (when you have multiple conflicts). If you have multiple conflicts, Grid Manager returns to the
Resolve multiple conflicts dialog so you can resolve other conflicts.

Resolving Fixed Address Conflicts

When the discovered MAC address of an IPv4 address does not match its existing MAC address, or when the DUID of
an IPv6 address does not match its existing DUID, the IP address has a fixed address conflict.
To resolve a fixed address conflict:
1. In the Resolve Conflict or Resolve multiple conflicts dialog, Grid Manager displays the nature of the conflict and
the discovered data versus the current data. Select one of the following to resolve the conflict:
— Keep fixed address and clear discovered data: Keeps the existing fixed address and clears the discovered
data.
— Update fixed address with discovered data: Updates the existing fixed address data with the discovered
data.
2. Click OK or Resolve (when you have multiple conflicts). If you have multiple conflicts, Grid Manager returns to the
Resolve multiple conflicts dialog so you can resolve other conflicts.

Resolving DHCP Range Conflicts

When an IP address is in a DHCP range and does not match an existing DHCP lease, fixed address, or exclusion range
and it shows an active state during a discovery, the IP address has a DHCP range conflict.
To resolve a DHCP range conflict:
1. In the Resolve Conflict or Resolve multiple conflicts dialog, Grid Manager displays the nature of the conflict and
the discovered data versus the current data. Select one of the following to resolve the conflict:
— Create a fixed address: Creates a fixed address with the discovered data.
If the fixed address is served by a Microsoft server, but is outside of a scope, you must then navigate to the
Fixed Address editor and assign the fixed address to the appropriate Microsoft server.
— Create a reservation: Creates a reservation with the discovered data. This creates an Infoblox reservation
and therefore cannot be used for IP addresses served by Microsoft servers. Note that you cannot convert an
IPv6 address to a reservation.
— Clear discovered data: Clears the discovered data and no object is created for the IP address.
2. Click OK or Resolve (when you have multiple conflicts). If you have multiple conflicts, Grid Manager returns to the
Resolve multiple conflicts dialog so you can resolve other conflicts.

Resolving Host Conflicts

When the MAC address of an IPv4 address that belongs to a host record a does not match its existing MAC address,
or when the DUID of an IPv6 address that belongs to a host record does not match its existing DUID, the IP address
has a host conflict.
1. In the Resolve Conflict or Resolve multiple conflicts dialog, Grid Manager displays the nature of the conflict and
the discovered data versus the current data. Select one of the following to resolve the conflict:
2. In the Resolve Conflict dialog box, select one of the following:
— Keep host record and clear discovered data: Keeps the existing data and clears the discovered data.
— Update host record with discovered data: Updates the existing host record data with the discovered data.
3. Click OK or Resolve (when you have multiple conflicts). If you have multiple conflicts, Grid Manager returns to the
Resolve multiple conflicts dialog so you can resolve other conflicts.

648 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Discovered Data

Resolving VM Affiliation Conflicts

When an IP address contains objects that are affiliated with a VM that is not the same as the discovered VM, this IP
address has a VM affiliation conflict.
To resolve a VM affiliation conflict:
1. In the Resolve Conflict or Resolve multiple conflicts dialog, Grid Manager displays the nature of the conflict and
the discovered affiliation versus the current affiliation. Select one of the following to resolve the conflict:
— Update all the displayed objects to be affiliate to the discovered affiliation: Update all associated objects in
this IP address to affiliate with the discovered affiliation.
— Keep the current affiliation(s) and clear the conflict: Keeps the existing data and clear the conflict.
2. Click OK or Resolve (when you have multiple conflicts). If you have multiple conflicts, Grid Manager returns to the
Resolve multiple conflicts dialog so you can resolve other conflicts.

Resolving MAC Address Conflicts

When the MAC address of an existing IP address does not match the MAC address of the discovered data, the object
has a MAC address conflict.
To resolve a MAC address conflict:
1. In the Resolve Conflict or Resolve multiple conflicts dialog, Grid Manager displays the nature of the conflict and
the discovered data versus the current data. Select one of the following to resolve the conflict:
— Change the configured MAC address to be the same as the discovered MAC address: Change the MAC
address to the discovered MAC address.
— Keep fixed address and ignore this conflict: Keep the fixed address and ignore the discovered data.
2. Click OK or Resolve (when you have multiple conflicts). If you have multiple conflicts, Grid Manager returns to the
Resolve multiple conflicts dialog so you can resolve other conflicts.

Clearing Discovered Data

You can clear previously discovered managed data for selected IPv4 or IPv6 networks. This action is useful, for
example, if your network topology has changed since the last discovery and you want to discover new data on the
network or cloud platform. You may perform this action whether or not the network is in a managed or unmanaged
state.

Note: This action clears only the discovered data that is supported in the Discovered Data section for an IP address.
It does not clear any NIOS objects or information such as tenants, networks, or VMs for a cloud platform. If a
discovered IP address has the same IP as an existing NIOS object (such as a fixed address, DNS record, or host
record), the appliance removes this IP address.

To clear discovered data:

1. In the IP Map or List panel, select a network, and then click Clear -> Clear Discovered Data from the Toolbar.
2. In the Clear Discovered Data dialog box, click Yes.
You can also clear discovered data on all networks in a network view as follows:
1. In the IP Map or List panel, select a network, and then click Clear -> Clear Discovered Data from the Toolbar.
2. In the Clear Discovered Data dialog box, click Yes.

Note: When you clear all discovered data in a given network view, all imported discovered data for managed
addresses in all IPv4 and IPv6 networks in the network view are cleared.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 649

IP Discovery and vDiscovery

You can also clear discovered data for a specific discovery job, as follows:
1. From the Cloud tab -> VM tab, select Discovery Manager from the Toolbar.
2. In the vDiscovery Job Manager dialog, click the Action icon (shown as a gear in each row) next to the selected
vDiscovery job, and then select Clear Discovered Data.
3. In the Clear Discovered Data dialog box, click Yes. The appliance clears all the discovered managed data that is
collected by the specified vDiscovery job.

Clearing All Discovery Data

You can clear all the discovered data, whether managed or unmanaged, for a specific vDiscovery job. This action
removes only the discovered data, not the associated NIOS objects, collected by the specified vDiscovery job only. It
does not remove any discovered data collected through Network Insight or other non vDiscovery tasks.

Note: If the same data is collected by the specified vDiscovery job and another non vDiscovery job such as Network
Insight or IP discovery, the discovered data remains intact and will not be removed.

To clear all discovered data for a specific vDiscovery job, do the following:
1. From the Cloud tab -> VM tab, select Discovery Manager from the Toolbar.
2. In the vDiscovery Job Manager dialog, click the Action icon (shown as a gear in each row) next to the selected
vDiscovery job, and then select Clear All Discovery Data.
3. In the Clear Discovered Data dialog box, click Yes. The appliance clears all the discovered managed and
unmanaged data that is discovered by the specified vDiscovery job.

Integrating Discovered Data From Trinzic Network Automation

Trinzic Network Automation appliances discover and track IPv4 and IPv6 network devices and provide information
about the discovered IP addresses. You can integrate IPv4 and IPv6 discovered data into the NIOS appliance
database, and then view the data in the IP List panel of Grid Manager as well as in the Discovered Data tab of certain
DNS and DHCP object editors. For information about Trinzic Network Automation IP discovery and how to import
discovered data from a Trinzic Network Automation appliance to the NIOS appliance, refer to the Trinzic Network
Automation Administrator Guide.

Note: The NIOS appliance does not import IPv6 leases that contain prefixes and link-local IPv6 addresses. This data
is discarded during an import.

The appliance can import the following IPv4 and IPv6 data that Network Automation discovers:
• IP Address: The discovered IPv4 or IPv6 address.
• Discovered MAC Address: The MAC address of the discovered host.
• Last Discovered: The date and time the IP address was last discovered.
• NetBIOS Name: The name returned in the NetBIOS reply or the name you manually register for the discovered
host.
• OS: The operating system of the detected host.
• First Discovered: The date and time the IP address was first discovered.
• Discoverer: Specifies whether the IP address was discovered by a Network Automation discovery process.
• Discovered Name: The name of the network device associated with the discovered IP address.
• Attached Device Description: A textual description of the switch that is connected to the end device.
• Attached Device Address: The IP address of the switch that is connected to the end device.
• Attached Device Name: If a reverse lookup was successful for the IP address associated with this switch, the
host name is displayed here.

650 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Integrating Discovered Data From Trinzic Network Automation

• Attached Device Port Description: A textual description of the switch port that is connected to the end device.
• Attached Device Port Name: The name of the switch port connected to the end device.
• Attached Device Port: The number of the switch port connected to the end device.
• Attached Device: Identifies the switch that is connected to the end device.
• Port Duplex: The negotiated or operational duplex setting of the switch port connected to the end device.
• Port Link: The link status of the switch port connected to the end device. Indicates whether it is connected.
• Port Speed: The interface speed, in Mbps, of the switch port.
• Port Status: The operational status of the switch port. Indicates whether the port is up or down.
• VLAN Name: The name of the VLAN of the switch port.
• VLAN: The ID of the VLAN of the switch port.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 651

IP Discovery and vDiscovery

652 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 15 Infoblox Network Insight
This chapter provides information about Infoblox Network Insight, which unites network discovery for geographically
dispersed networks, infrastructure devices and network assets with the Infoblox IPAM (IP Address Management)
solution. Through discovery, Network Insight provides automated, comprehensive, and accurate data about your
network devices and their attributes so you can have better visibility in your network infrastructure, including the
virtual network infrastructure, and manage it more efficiently.
This chapter describes how you use Network Insight to detect and manage information about network infrastructure
devices, how to provision and de-provision networks, and how to manage and provision device ports, including
switched Ethernet.
It includes the following sections:
• About Network Insight on page 656
— Consolidator and Probes on page 658
— Deployment Guidelines for Consolidator and Probes on page 659
— Supported Discovery Methods on page 659
— Starting Discovery on page 663
— Managing Discovery on page 664
• Discovering VRF Virtual Networks on page 665
— Special Considerations for Managing VRF Virtual Networks on page 665
— VRF Deployment Guidelines on page 666
• Administrative Permissions for Discovery on page 673
• Defining the Discovery Member Type on page 675
• Mapping Discovery Interfaces to Network Views on page 675
• Starting and Stopping the Discovery Service on page 674
— Starting the Discovery Service on page 674
— Stopping the Discovery Service on page 674
• Configuring Discovery Properties on page 676
— Defining Basic Polling Settings for the Grid on page 677
— Defining Advanced Polling Settings for the Grid on page 678
— Configuring SNMP1/v2 Credentials for Polling on page 680
— Configuring SNMPv3 Properties on page 680
— Configuring CLI Discovery Properties on page 681
— Defining CLI Credentials Settings for Objects on page 682
— Testing SNMP and CLI Credentials on page 683
— Defining Seed Routers for Probe Members on page 684

NIOS 7.3 NIOS Administrator Guide (Rev. A) 653

Infoblox Network Insight

• Excluding IP Addresses from Discovery on page 685

— Quick Exclusion of IPs from Discovery on page 685
— Creating a New IPAM Object and Excluding it from Discovery on page 686
— Excluding IP Addresses in Grid Manager on page 687
• Discovering Devices and Networks on page 687
— Using Discover Now to Discover an Existing Object on page 689
— Smart Folders and Discovered Devices on page 689
— Using the Device Selector on page 689
— Tips for Quick Navigation on page 691
• Managing Discovered Data on page 691
— Converting Unmanaged Devices to Managed Devices on page 692
— Converting Unmanaged Networks to Managed Status on page 693
— Converting Unmanaged Networks under IPAM to Managed Status on page 694
— Converting Unmanaged Interfaces to Managed Status on page 696
— Converting Unmanaged IP Addresses to Managed Status on page 697
— Converting Unmanaged Assets to Managed Status on page 698
• Viewing Discovered Devices and their Properties on page 698
— Viewing the Complete List of Discovered Devices on page 698
— Viewing Discovered VRFs and Mapping Network Views on page 700
• Accessing Detailed Device Information on page 701
— Viewing Interface Information for Discovered Devices on page 701
— Determining Interface Capabilities on page 702
— Viewing Networks Associated with Discovered Devices on page 704
— Modifying Networks on page 705
— Viewing IP Addresses Associated with Discovered Devices on page 706
— Viewing Router Redundancy Information on page 707
— Viewing Assets Associated with Discovered Devices on page 708
— Viewing Components of Discovered and Managed Devices on page 710
• Viewing Discovery Status on page 710
— Analyzing Discovery Status on page 711
• Executing Discovery Diagnostics on page 712
— Viewing the Management State of IPs in Discovered Networks on page 713
• Disabling Discovery for a Network on page 713
• Adding Discovery Device Support on page 714
• Port Control Features in Network Insight on page 714
— About Port Reservations on page 715
• Editing Interfaces in a Device on page 716
— Editing Multiple Interfaces on page 717
— Editing Multiple Interfaces from the Devices Page on page 719
— Inline Interface Editing on page 719
• Provisioning and De-Provisioning Networks on page 720
— De-provisioning Networks on page 721
— Troubleshooting Port Control Tasks on page 723
• Creating Port Reservations for IPAM Objects on page 723
— Editing Port Reservation Settings for IPAM Objects on page 725

654 NIOS Administrator Guide (Rev. A) NIOS 7.3

 — Defining Port Reservations for an Infoblox Grid Member on page 726
— Defining Port Reservations for an HA Pair on page 726
— Editing Port Reservation Settings for an Infoblox Grid Member on page 729
— Defining Device Information on page 729
• Defining Blackout Periods on page 731
— Defining Blackout Periods for the Grid on page 731
— Defining Blackout Periods for Networks on page 732
• Defining Port Configuration Blackout Periods on page 733
— Defining Port Configuration Blackouts for the Grid on page 733
— Defining Port Configuration Blackouts for Networks on page 734
• Conflict Resolution in Network Insight on page 736
— Resolving Port Reservation Conflicts on page 737
— Resolving Multiple Conflicts on page 738

NIOS 7.3 NIOS Administrator Guide (Rev. A) 655

Infoblox Network Insight

About Network Insight

Infoblox Network Insight provides discovery features for detecting and managing devices in your network
infrastructure. You can use discovery to collect device data and manage it through Grid Manager. For more
information about device management, see Managing Discovered Data on page 691.
You can view the operating state of all discovered network infrastructure devices and newly discovered IP networks,
including but not limited to routers, firewalls, load balancers, Ethernet L2/L3 switches, end hosts, end host networks,
VRF (Virtual Routing and Forwarding) virtual networks, and single and multipoint VPNs. Network Insight makes it easy
to manage and secure your enterprise network by detecting all interfaces for every discovered device and providing
specific information about them. For information about discovering VRF virtual networks, see Discovering VRF Virtual
Networks on page 665.
The Infoblox IPAM feature set also provides control mechanisms by including and excluding networks and IP
addresses for discovery. You can schedule and define when discovery takes place on any network, and define
blackout periods during which no discovery tasks occur. Infoblox IPAM and DHCP functions also extend network
control to assigning of discovered switch and router interfaces to IPAM objects such as IP networks, IP reservations,
and host records. The assignments are called port reservations and are part of a feature set called port control,
managed through Grid Manager. For more information, see Port Control Features in Network Insight on page 714.

Supported Appliances for Network Insight

Network Insight is supported on the following physical appliances: ND-800, ND-1400, ND-2200 and ND-4000; and
the following virtual appliances: ND-VM-800, ND-VM-1400, and NV-VM-2200. All appliances that perform discovery
require a Discovery license. Appliances with this license only perform discovery tasks and do not perform core DNS
or DHCP functions.
Discovery appliances that only detect devices and collect device data are called Probes, which are members of the
Infoblox Grid, separately dedicated to the tasks of polling and discovery of networks and devices. A separate
appliance, called the Consolidator, aggregates and organizes all collected device information from the Probes and
synchronizes with the Grid Master. For more information, see Consolidator and Probes on page 658.
You can configure supported appliances as the Consolidator and Probes, as illustrated in Figure 15.1 on page 657.
The Consolidator aggregates discovered data it collects from Probes and transfers the data to the Grid Master for
device management and reporting purposes.
In the Grid, the Grid Master synchronizes data among all Grid members through encrypted VPN tunnels.
Communications between the Consolidator and Probes are also through encrypted VPN tunnels. The default source
and destination UDP port number for VPN tunnels in a Grid is 1194. You can use the default port number or change
it for VPN communications. Note that all the VPN tunnels in the Grid use the same port number you have chosen.

656 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Network Insight

Figure 15.1 Network Insight Appliances Added as Grid members

The Consolidator collects discovered

data from all Probes and transfers
the data to the Grid Master.

Consolidator
Probe
Grid Master
Encrypted IP Networks, Routers,
VPN Tunnels Firewalls, Load
Probe Balancers, End Hosts,
VRF-based Virtual
Networks, etc.
The Probes poll network devices,
collect discovered data, and send
the data to the Consolidator.

Note: The default source and destination UDP port

number for all VPN tunnels in a Grid is 1194.

Network Insight appliances use SNMP and other protocols to discover and catalogue a diverse assortment of device
types, including the following: routers, enterprise switches, firewalls and security appliances, load balancers,
enterprise printers, wireless access points, VoIP concentrators, application servers, VRF-based virtual networks, and
end hosts.
Network Insight provides a tool for administrators to gather key information about networks, including the discovery
of routed paths and the host clouds behind enterprise switches, even in organizations where an Infoblox deployment
already exists. In Figure 15.2, an appliance running discovery connects to an enterprise router, and uses its
information to determine more about the networks that exist deeper within the unmanaged network, termed the
discovery domain in this example.

Figure 15.2 Discovery in Action

sets
As
To

Path
Col
lec 23
Discovery 17 tio . 0/
2
.16 6 .3
n

Domain .19 2 .1 Managed

2.0 17
/30 Domain
Assets

172.16.2.0/24
To

192.168.13.64/30
Switch-Router

Discovery Grid Members

Member (Probe) (serve DHCP and DNS
Seed
in managed domain)
Router
As indicated in Figure 15.2, discovery can trace through multiple hops and perform device discovery at every step,
filling out the maps of unmanaged networks for the administrator.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 657

Infoblox Network Insight

The collection of unmanaged network information extends to the networks of distribution Ethernet switches. Data
collection also includes end hosts and application/file servers connected to edge switches in enterprise offices.
Discovery uses the term assets to describe these devices. For more information, see Viewing Assets Associated with
Discovered Devices on page 708.
The Probes return discovery data to the Consolidator, which synchronizes device information with the Grid Master.
Once information about discovered networks and devices resides on the Grid Master, you can convert unmanaged
networks and devices to managed objects, adding them to the NIOS database.
You can also configure the appliance to send SNMP and email notifications when it discovers unmanaged devices
and networks. For information about how to enable SNMP and email notifications for discovered unmanaged objects,
see Setting SNMP and Email Notifications on page 1371. You can also manage these notifications by configuring the
maximum number of unmanaged objects the appliance detects before it sends notifications and how often it notifies
about these events. For information about how to configure these parameters, see Defining Seed Routers for Probe
Members on page 684.
You provide one or more routers as seed routers to act as the initial gateways for discovering other networks and their
devices in the discovery domain (an example appears in Figure 15.2). You can also use DHCP routers (e.g., routers
serving DHCP leases) as seed routers to aid in faster discovery.
When you create new networks, you can optionally provision them onto devices and perform discovery on them. Once
you create the network, discovery can locate, poll and catalogue the network devices comprising the networks. This
information is then synchronized with the Grid Master. For more information, see Discovering Devices and Networks
on page 687.

Note: For comprehensive coverage of port control features in Grid Manager, see Port Control Features in Network
Insight on page 714 and its various subsections.

You can also exclude networks and IP addresses from discovery. The basic principle is that some devices do not need
to be discovered, perhaps because they are already managed as part of a Grid and hence should not be subjected to
discovery; because a device does not support SNMP; or for other organizational reasons. In Figure 15.2, networks
172.16.2.0/24 and 172.16.3.0/23 are excluded from discovery because they are already fully managed by a Grid.
For more information, see Excluding IP Addresses from Discovery on page 685.
You can define scheduled time periods in which Network Insight does not perform discovery operations in the
network. These time periods are called discovery blackouts. All protocols associated with discovery (SNMP, CLI
through Telnet and SSH, port scanning, fingerprinting and Ping sweeps) can be shut off during discovery blackout
periods. This prevents discovery protocols from occupying network bandwidth during periods of peak usage. Network
Insight does not communicate with devices in any way during a discovery blackout period. For more information on
discovery blackouts, see Defining Blackout Periods on page 731. Network Insight also provides a second type of
blackout period for port configuration tasks, during which no tasks to change device port settings will execute. For
more information, see Defining Port Configuration Blackout Periods on page 733.

Consolidator and Probes

Consolidator–The central repository of discovery data for the entire managed network. The Consolidator is a single
appliance that contains data about all devices detected through discovery. The Consolidator communicates with the
Grid Master as a normal Grid Member and transfers all its data to the Grid Master, as indicated in Figure 15.1. The
Consolidator compiles information from one or more associated Probe appliances. The Consolidator appliance
requires the Discovery license. If you have one or more Probe appliances or virtual appliances, the Consolidator
performs no discovery on its own. If you plan to use a single dedicated appliance for discovery, that appliance must
be licensed for discovery and be configured as a Consolidator. Note that the Grid Master cannot be licensed as a
Consolidator.
Probes–A Probe is a Network Insight appliance or virtual appliance that performs the direct querying, probing and
polling of network devices and the initial data collection. Probe appliances also require the Discovery license.
Infoblox recommends using one or more Probe appliances with the Consolidator. Each Probe can override the Grid
level discovery credentials with its own discovery credentials.
Data synchronization occurs continuously between the Consolidator and all associated Probe appliances and
between the Consolidator and the Grid Master.

658 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Network Insight

Note: You assign each Probe appliance to a single network view, and multiple Probe appliances can share the same
network view. You can change network view assignments for Probe appliances at any time. On ND-1400,
ND-2200, ND-4000, ND-VM-1400, and ND-VM-2200 Network Insight appliances, you can assign multiple VLAN
interfaces on the same Probe to different network views.

Consolidator-Probe Appliance–You may also choose to operate a Consolidator-Probe appliance as a single discovery
system. In this deployment, the appliance operates as both a Consolidator and a Probe, performs all discovery
operations, aggregates all databases within it, and synchronizes with the Grid Master.
Standalone discovery appliances cannot be installed in a network that already has existing Probes and a
Consolidator. For more information, see Defining the Discovery Member Type and Mapping Discovery Interfaces to
Network Views on page 675.

Deployment Guidelines for Consolidator and Probes

When you wish to install and deploy discovery appliances, use the following installation guidelines:
• Installing a Standalone in the Grid–Before you designate an appliance as a standalone discovery
appliance, no previously installed Probes should be present on the network and joined to the Grid. If you
install a new appliance intended as a standalone, in a network that already has one or more Probe
instances (perhaps for testing or evaluation purposes), before discovery service is stopped on the Probe
instances, the new “standalone” appliance automatically detects the Probe instances and start as a
Consolidator appliance, preventing it from acting to probe and detect devices as a standalone appliance.
Consolidators cannot be assigned to network views or to discovery in network objects such as IPv4 or IPv6
network containers.
• Converting a Consolidator to a Standalone–Also consider the example of a Consolidator appliance
operating with one or more instances running as Probes, each with respective Discovery licenses. If you
wish to convert the Consolidator to a standalone discovery appliance, stop the discovery service on all
associated probes. Then, stop and restart the discovery service on the Consolidator appliance. The
appliance is selectable for discovery of network objects, acting as a standalone discovery appliance.
• Adding new Probe Instances to a Standalone deployment–Finally, consider the use of a standalone
discovery appliance to which you wish to associate a new Probe instance or instances. This process
converts a standalone to a Consolidator. After the new Probe instances join the Grid, stop the discovery
service on the standalone discovery appliance. Then, start the discovery service on the new Probe or
Probes. Next, restart the discovery service on the previously defined standalone appliance. It detects the
newly active Probe instances and activate as a Consolidator.
• In all cases, you must maintain proper Discovery licensing.

Supported Discovery Methods

When you perform a discovery, you can choose any or all of the following discovery methods:
• SNMPv1/v2c device polling as described in SNMP on page 660.
• SNMPv3 device polling as described in SNMP on page 660.
• CLI device querying as described in CLI on page 660.
• ICMP Ping Sweep and Smart Subnet Ping Sweep as described in ICMP on page 660.
• TCP as described in TCP on page 661.
• NetBIOS as described in NetBIOS on page 661.
These methods actively scan predefined networks and probe IP addresses. The appliance listens for responses from
the IP addresses as proof of activity. The IP discovery scans through the specified network ranges and probes IP
addresses (except for the network, broadcast, and multicast address types) in each network, including the /31 and
/32 subnets. Note that addresses in the /31 and /32 subnets can be used only as source addresses for point-to-point
links and loopbacks. In these cases, no broadcast or network addresses exist in the /31 and /32 subnets, and the
appliance can discover source addresses in these subnets.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 659

Infoblox Network Insight

SNMP

Note: Infoblox does not recommend using vendor default SNMP credentials on network devices. Should you need
to use vendor defaults for a given device type, you enter those values in the list of SNMP credentials on the
Grid Master.

Network Insight supports discovery of devices and networks through SNMPv1/v2c and through SNMPv3 protocols.
Discovery acquires information from standard SNMP MIB object IDs (OIDs) to correctly identify and catalogue devices.
You enter or import lists of SNMP credentials with which the appliances query devices on the network to perform
discovery.
SNMPv1 and SNMPv2c protocols are combined into a set termed SNMPv1/v2 for discovery. SNMPv1/v2 discovery
requires standard read community strings to be stored on the Grid Master.
Accounts using SNMPv3 use a standard suite of authentication and security protocols. If Network Insight uses
SNMPv3 to collect data from devices supporting the protocol, you can define specific user credentials with
combinations of authentication and protocol support, and the unique keys for each protocol. Network Insight also
supports multiple entries for the same username string, enabling checking of similar SNMPv3 credentials that use
different authentication and security protocols.
Some devices found by discovery may not have known SNMP credentials or credentials that are entered into the sets
of SNMP credentials defined for discovery.

Note: SNMP Credentials from the Grid or from the Member credential list are always tried in the specified order
unless a credential is associated with a host, fixed address or reservation being discovered.

CLI

Note: CLI is optional for discovery but is required for all Port Control operations. Discovery can perform CLI data
collection to collect information for specific device types. SNMP is required for all device discovery.

Network Insight enables the use of dynamically created and closed Telnet and SSH command-line sessions to log in,
query, and configure ports using each device’s command-line syntax. Network Insight does so without requiring
extensive configuration from the user. You need to provide known admin account login information and any Enable
passwords for devices in the networks to be discovered. CLI credentials are required for port reservation and port
configuration operations under Grid Manager. You enter CLI credentials into Grid Discovery Properties (Grid –> Grid
Manager –> click Edit –> Grid Discovery Properties) to be inherited by discovery Probe members, and as necessary for
each discovery Probe member. You can also override them for individual IPAM objects (fixed addresses, hosts and
IPv4 reservations) and test the CLI credentials against devices for correctness. For more information, see Testing
SNMP and CLI Credentials on page 683.

ICMP
Discovery uses different variations of Ping traces to perform higher-performance, brute-force device discovery. ICMP
is the last resort when devices do not support SNMP management protocols or an SNMP credential is lacking.
The ICMP Smart Ping Sweep option enables brute-force subnet Ping sweeps on IPv4 networks. Subnet ping sweeps
are used as a last resort in the discovery process. A subnet ping sweep is performed if Network Insight is unable to
identify any network devices in a given subnet. Subnet ping sweeps are performed no more that once per day, and
will end the ping sweep on a given subnet once Network Insight discovers a network device and is able to collect data
from it. You can configure the timeout value (Ping Sweep Timeout) and the number of attempts (Ping Sweep
Attempts).

Note: Smart subnet ping sweeps are not performed on subnets larger than /22. Ping sweeps of any kind do not
apply on IPv6 networks because of the greater scale of network addresses in the IPv6 realm.

Complete Ping Sweep differs from the Smart Subnet ping sweep in the following ways:

660 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Network Insight

• The discovery ping sweep runs only against the specified range.
• The sweep runs regardless of the range size.
• The sweep runs regardless of the number of discovered devices within the specified range.
Discovery also performs automatic Ping traceroutes when needed for path collection. Path collections run without
user intervention or configuration.

TCP
TCP scanning probes each active host on a list of TCP ports using TCP SYN packets. This method detects all active
hosts that generate SYN ACK responses to at least one TCP SYN. The discovery can determine the OS on a host by
analyzing how the host reacts to the requests on opened and closed ports. It then uses the TCP fingerprints to guess
the OS. To obtain a TCP fingerprint, IP discovery provides two scanning techniques, SYN and CONNECT.
When you use the SYN technique, the discovery sends a TCP SYN packet to establish a connection on a TCP port. If
the port is open, the host replies with a SYN ACK response. The discovery does not close the port connection.
The CONNECT technique is a three-way TCP handshake. The discovery starts with the same process as the SYN
technique by sending the TCP SYN packet. A response containing a RST flag indicates that the port is closed. If the
host replies with a SYN ACK response, discovery sends a RST packet to close the connection. If there is no reply, the
port is considered filtered. TCP scanning is a deliberate and accurate discovery method, enabling detection of all
active hosts on a network provided that there are no firewalls blocking TCP packet exchanges.
You can choose the TCP ports and the TCP scanning technique in the Discovery Manager wizard. This method returns
the following information for each detected host:
• IP address: The IP address of the host.
• MAC address: The discovery returns the MAC address only if the Probe member running the discovery is on the
same discovered network.
• OS: This is set to the highest probable OS reported in the response.
To use the TCP discovery method, the TCP port and a specific set of ports between the Probe member and the
discovered networks must be unfiltered. The default set of ports is defined by the factory settings.

TCP Port Scanning

By enabling port scanning, Network Insight probes the list of TCP ports enabled in the Advanced tab, to determine
whether they are open. You can control some settings for port scanning behavior, including the choice of a TCP
scanning technique.
• Profile Device: If enabled, Network Insight attempts to identify the network device based on the response
characteristics of its TCP stack, and uses this information to determine the device type. In the absence of SNMP
access, the Profile Device function is usually the only way to identify devices that do not support SNMP. If you
disable Profile Device, devices accessible via SNMP are still correctly identified; all other devices are assigned a
device type of Unknown. Profile Device is disabled by default for discovery polling.
The Profile Device option uses the editable list of TCP protocol ports from the Grid Discovery Properties –>
Polling –> Advanced tab as its profile, and polls each of the ports enabled in that list, using the configured
timeout value and the number of polling attempts for each port.
For more information, see Defining Seed Routers for Probe Members on page 684.
Should you disable Port Scanning, discovery attempts no port probes other than SNMP on any device.

NetBIOS
The NetBIOS method queries IP addresses for an existing NetBIOS service. This method detects active hosts by
sending NetBIOS queries and listening for NetBIOS replies. It is a fast discovery that focuses on Microsoft hosts or
non-Microsoft hosts that run NetBIOS services.
NetBIOS discovery returns the following information for each detected host:
• IP address: The IP address of the host.
• MAC address: Listed only if the discovered host is running Microsoft, otherwise blank.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 661

Infoblox Network Insight

• OS: This value is set to Microsoft for an active host that has a MAC address in the NetBIOS reply.
• NetBIOS name: This value is set to the name returned in the NetBIOS reply.
To use the NetBIOS discovery method, ports 137 (UDP/TCP) and 139 (UDP/TCP) between the Grid member
performing the discovery and the target networks must be unfiltered.
The following table summarizes the supported discovery methods:

Discovery Type Returned Data Guideline Mechanism

Smart IPv4 • IP address Apply on known subnetworks on ICMP echo request and
Subnet Ping • MAC address which no devices are readily reply.
Sweep found. Limited to networks of /22
and smaller.
Complete Ping • IP address Last resort for discovery. Use ICMP ICMP echo request and
Sweep • MAC address for a rough and fast discovery. reply, ICMP traceroute.
Enables path tracing.
NetBIOS • IP address Use NetBIOS for discovering NetBIOS query and reply.
• MAC address Microsoft networks or
non-Microsoft networks that run
• OS
some NetBIOS services
• NetBIOS name
TCP • IP address Use TCP for an accurate but slow TCP SYN packet and SYN
• MAC address discovery ACK packet.
• OS
Port Scanning/ • Open and Closed TCP Disabled by default, use for Scans specified list of TCP
Profile Device ports non-SNMP devices. ports, using TCP SYN
• IP Address packet.

SNMPv1/v2 • Open and Closed TCP Most important protocols for Queries and collects
SNMPv3 ports discovery. Ensure you have the system OIDs such as
• IP Address SNMP credentials necessary for SysDescr and sysUpTime.
probing devices using SNMP.
• System Description
• System Up Time
• Routing Neighbors
• Routing and
Forwarding Tables
• ARP tables
• SNMP credentials
CLI (Device • Similar data set to Requires correctly defined admin Uses standard
Command-Line SNMP login tuples and Enable device-language scripts
by Telnet or SSH) • May be used instead passwords where needed for and configured Telnet or
of, or in combination device types. SSH connection settings to
with, SNMP You may test credentials against collect discovery data.
devices and assign CLI credentials
to individual objects, overriding
Grid-level and Network-level
credential settings.

662 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Network Insight

vDiscovery • IP address Add the VMware vSphere servers The appliance

• MAC address on which you want to perform the communicates with the
vDiscovery. vSphere servers to collect
• OS
For information about how discovery data on virtual
• Discovered name machine instances.
execute a vDiscovery, see
• Virtual entity type Configuring vDiscovery Jobs on
• Virtual entity name page 630.
• Virtual cluster
• Virtual datacenter
• Virtual switch
• Virtual host
• Virtual host adapter

Starting Discovery
To ensure a successful discovery, complete the following:
1. In the Grid, install valid Discovery licenses on the Network Insight supported members that will later become the
Consolidator and Probes. For information about how to install licenses, see Managing Licenses on page 478.
2. When you join the discovery members to the Grid, the first member automatically becomes the Consolidator
while the others become Probes. If you want to change the roles of these members after they join the Grid, you
can re-define their member types, as described in Defining the Discovery Member Type on page 675. If you have
only one discovery member, it automatically becomes the Consolidator-Probe appliance after it joins the Grid.
For more information about the Consolidator and Probes, see Consolidator and Probes on page 658.
3. Configure applicable admin permissions for managing discovery and discovered data. For more information, see
Administrative Permissions for Discovery on page 673.
4. Define discovery interfaces and map them to corresponding network views. This step is especially important for
discovering VRF virtual networks. For more information, see Mapping Discovery Interfaces to Network Views on
page 675.
5. Configure Grid discovery properties such as defining polling settings and configuring SNMP and CLI credentials.
For more information, see Configuring Discovery Properties on page 676. Note that you can override the Grid
settings at the member and network levels.
6. Optionally, you can configure seed routers and map them to the corresponding network views. You can also use
the default gateways for associated DHCP ranges and networks as seed routers for discovery by selecting the Use
DHCP Routers as Seed Routers in the General -> Advanced tab of the Grid Discovery Properties editor. For more
information, see Defining Seed Routers for Probe Members on page 684 and Defining Advanced Polling Settings
for the Grid on page 678.

Note: You must map each discovery interface, seed, and VRF to its respective network view in order to have a
successful discovery for virtual routing instances.

7. Specify a network view, network container, or network to be discovered. For more information, see Discovering
Devices and Networks on page 687.
8. Optionally, define IP address exclusions when you want to exclude certain IPs from a discovery for various
reasons. For more information, see Excluding IP Addresses from Discovery on page 685.
9. Define blackout periods when you do not want the appliance to perform discovery. For information about how to
configure blackout periods, see Defining Blackout Periods on page 731.
10. Start the discovery service on the Consolidator and Probes to begin discovery, as described in Starting the
Discovery Service on page 674. The Probe members continue to discover network devices within the defined
networks.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 663

Infoblox Network Insight

Managing Discovery
After you start the discovery service, you can do the following to manage the discovery and discovered data:
• Monitor the discovery status, as described in Viewing Discovery Status on page 710.
• Execute discovery diagnostics to test the connection of a discovery member, as described in Executing
Discovery Diagnostics on page 712.
• Stop discovery on a specific network, as described in Disabling Discovery for a Network on page 713.
• View a complete list of discovered devices, their associated interfaces, networks, IP addresses, assets, and
components. For more information, see Viewing Discovered Devices and their Properties on page 698.
• Resolve conflicts for discovered data, as described in Conflict Resolution in Network Insight on page 736.
• Provision and de-provision networks and manage port configurations, as described in Port Control Features
in Network Insight on page 714.

664 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Discovering VRF Virtual Networks

Discovering VRF Virtual Networks

You can configure Network Insight to discover network devices that are configured or deployed within VRF (Virtual
Routing and Forwarding) virtual networks. Using Network Insight to discover virtual networks provides visibility into
your entire virtual network infrastructure, which allows you to view and manage overlapping IP addresses,
VRF-specific data, and discovered end hosts. Note that a virtual network can consist of one or more physical devices
that are configured to route packets using separate and distinct routing processes. Multiple routing tables can coexist
on the same physical device or virtual device context, and traffic is exchanged among those devices using multiple
routing tables.
Depending on your network topology, there are a few ways you can use Network Insight for VRF network management.
To use Network Insight effectively in the network, review the different deployment scenarios and configure Network
Insight accordingly, as described in VRF Deployment Guidelines on page 666.
In addition, before you start a discovery for VRF virtual networks, ensure that you have reviewed the guidelines listed
in Special Considerations for Managing VRF Virtual Networks.

Special Considerations for Managing VRF Virtual Networks

When you define discovery settings and perform management of VRF virtual networks, consider the following:
• If you limit the context of the SNMP community string in an individual VRF to the context of only that VRF,
Network Insight will not be able to determine that the device it has discovered inside that VRF is the same
device it has found inside other virtual networks. This may result in extra, un-correlated devices in the network.
For information about how to configure SNMP credentials, see Configuring SNMP1/v2 Credentials for Polling on
page 680 and Configuring SNMPv3 Properties on page 680.
• Network Insight will become aware of some devices inside of virtual networks from the route and ARP tables of
routers that it manages. Without network connectivity into those virtual networks through a virtual discovery
interface, Network Insight cannot discover all the devices or manage them. To create the necessary connectivity,
you must configure a Network Insight discovery interface to be part of the VRF.
• Network Insight collects and parses the ARP and routing information from within a VRF context, but this data will
not be used for further discovery unless the VRF virtual network is associated with a network view that is
mapped on a discovery interface. For more information about how to map network views to discovery interfaces,
see Mapping Discovery Interfaces to Network Views on page 675.
• Global VRFs are labeled as: "default(IOS)" for IOS, "default" for Nexus and "master" for JunOS.
• For discovery and periodic polling on Juniper devices through an interface that is not in the Juniper default VRF
(master), the query must use a special “default@credential” format. This setting assumes that users do not
have management interfaces in a VRF. Your defined SNMP credentials for VRF-aware Juniper devices must use
syntax similar to: "@credential". (Note that when querying VRF-aware Juniper devices via an interface that is in
the default VRF, a plain community string can be used without the “@” character.)
• When configuring Network Insight to discover networks that employ route-leaking, discovery ranges for each
network view should only be defined to include IP addresses that belong to that network view. In other words,
any given Device IP should only fall within the discovery ranges of one network view. If discovery ranges are
defined such that a device can be discovered by two different network views, the device may also be discovered
via an unexpected network view. For information about how to define discovery ranges, see Discovering Devices
and Networks on page 687.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 665

Infoblox Network Insight

VRF Deployment Guidelines

The topology of your network helps determine how you deploy Network Insight for VRF network management. To use
Network Insight effectively in the network, you must possess some knowledge about your network so you can decide
how to configure Network Insight to reach all the virtual networks you want to discover and manage. This section
describes some common VRF-related network types for which you can deploy Network Insight.
Using the following three network types, all examples in this section help you define the number of network views
and discovery interfaces so you can reach all locations in your network.
1. VRF Network Type 1: A network with a management VRF and several isolated production VRFs that
include VRF-aware devices in the network.
2. VRF Network Type 2: A network with a shared service deployment VRF (shared VRF) and several isolated
production VRFs that include VRF-aware devices in the network. The production VRFs share routes with
the shared VRF, a practice also called route-leaking.
3. VRF Network Type 3: A network with several VRF-ignorant devices that reside in different L3 spaces,
with no management VRF.
VRF Network Type 1 has the following characteristics:
• A management VRF that reaches all VRF instances throughout the network.
• Isolated production VRFs (all VRFs can route to/from the management VRF but not to one another).
• The management VRF has complete visibility to all VRF instances in the network.

666 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Discovering VRF Virtual Networks

VRF Network Type 2 has the following characteristics:

• Uses a shared services deployment VRF to offer network services to the other production VRFs (shared VRF).
• All VRFs are reachable from the shared VRF, but VRFs cannot reach each other through the shared VRF or
between each other.
• The production VRFs (Red, Yellow, Green) share routes with the shared services VRF (Blue).
• The shared VRF has complete visibility to all VRF instances.

VRF Network Type 3 has the following characteristics:

• Devices have management IPs only inside their respective networks.
• The routers in the network are VRF-aware; the switches are VRF-ignorant.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 667

Infoblox Network Insight

Defining Network Views and Discovery Interfaces

In all three deployment types, you decide whether you want one or multiple network views based on how your
network operates, as outlined in the three network types above. You can also consider the following guidelines:
• When all infrastructure devices for the network are reachable through a management VRF or a shared services
VRF, and you do not need extended discovery capabilities to discover and/or manage end hosts, you can use a
single network view. You also use a single virtual discovery interface to connect to the same 802.1q ID as the
management VRF network. You can then discover and analyze all VRF-aware devices on the management VRF.
• If you want your devices end host and downstream device information separated for viewing and reporting, then
you will want to use network views for each virtual network. Doing so is helpful for visual purposes, but it is not
required.
• If you want ping sweeps, port scanning, fingerprinting and other discovery services into end hosts within each
of your VRF networks, you must define multiple network views, one for each of your VRF networks; and each of
which requires an associated virtual discovery interface and discovery ranges.

Deploying Network Insight in VRF Network Type 1: All Devices on a Management Network
The following figure shows an example of integrating Network Insight with Network Type 1. In this network
deployment type, a single virtual discovery interface can manage all VRF instances’ identification of ARP entries,
because Network Insight needs only one discovery interface into the Management VRF.

You configure the following for this example:

• Network View: Create one network view for the management VRF.

668 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Discovering VRF Virtual Networks

• Discovery Interface: Add the active discovery interface to the management VRF and tag it with the corresponding
802.1q VLAN value.
• Discovery Ranges: Define IP discovery ranges for the management network.
• All discovered VRFs must be associated with the network view configured for the management VRF.

Deploying Network Insight in VRF Network Type 1: All Devices on a Management Network (Part 2)
The following figure shows the same topology for Network Type 1, but using multiple discovery interfaces and
multiple network views.
In this example, the switch must be configured with the trunk port ‘facing’ Network Insight to forward Network
Insight’s tagged 802.1q traffic to the appropriate destination networks (VLAN 5, VLAN 10, VLAN 20 and VLAN 30 in
this example).
The encapsulated sub-interfaces are defined using the correct values on each port; the virtual discovery interfaces
on Network Insight match these values.

You configure the following for this example:

• Network Views: Create a network view for each network (Management, Red, Yellow, Green).
• Discovery Interfaces: Create virtual discovery interfaces for each VRF network.
• Discovery Ranges: Define IP discovery ranges for each VRF network.
• The discovered VRF instances must be associated with the network views to which they belong. For more
information, see Viewing Discovered VRFs and Mapping Network Views on page 700.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 669

Infoblox Network Insight

Deploying Network Insight in VRF Network Type 2: All VRFs Reachable from a Shared Services
VRF
This example illustrates the use of a shared service VRF between the distribution routers in the network and how
Network Insight integrates into such a topology.
All virtual networks are reachable through a shared VRF, to which Network Insight may connect using a single virtual
discovery interface and reach all other VRFs from the one to which it is connected. Each Router in this topology also
shares routes between the VRFs.

You configure the following for this example:

• Network View: Use one network view for the shared VRF.
• Discovery Interface: Create a virtual discovery interface on the network view. Use a single virtual discovery
interface in Network Insight, and connect through the facing switch to the shared VRF using the tagged 802.1q
value. There is a 1:1 ratio between network views and discovery interfaces.
• Discovery Ranges: Define IP discovery ranges in the single network view for all VRFs.
• All discovered VRFs must be associated with this network view.
If you want your device end hosts and downstream devices information separated, then use network views for each
virtual network. This is helpful for viewing and reporting but it is not required. In this example, only a single network
view is applied.

670 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Discovering VRF Virtual Networks

Deploying Network Insight in VRF Network Type 2: All VRFs Reachable from a Shared Services
VRF (Part 2)
In this version of the VRF Network Type 2 deployment, you use multiple network views and multiple discovery
interfaces in a 1:1 ratio, with the same requirements for trunking and switch VLAN sub interfaces.

Network Insight

You configure the following for this example:

• Network Views: Create a network view for each network (e.g., Management, Red, Yellow, Green).
• Discovery Interfaces: Create virtual discovery interfaces for each VRF network.
• Discovery Ranges: Define IP discovery ranges in Network Insight for each VRF network.
• The discovered VRF instances must be associated with the network views to which they belong. For more
information, see Viewing Discovered VRFs and Mapping Network Views on page 700.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 671

Infoblox Network Insight

Deploying Network Insight in VRF Network Type 3: Devices Reside in Disconnected Networks
In the final example, trunking is in use between Network Insight and its facing gateway switch into the managed
network. This topology requires the use of multiple network views as all VRF networks are completely separate and
cannot be reached through any management virtual network.

You configure the following for this example:

• Network Views: Create a network view for each network (e.g., Management, Red, Yellow, Green).
• Discovery Interfaces: Create virtual discovery interfaces for each VRF network.
• Discovery Ranges: Define IP discovery ranges for each VRF network.
• The discovered VRF instances must be associated with the network views to which they belong. For more
information, see Viewing Discovered VRFs and Mapping Network Views on page 700.
Each of the network views requires a single virtual discovery interface using 802.1q tagging as indicated in the figure.
When defining the virtual discovery interfaces, use the 802.1q tag from the network devices. The primary differences
are as follows:
• All devices do not have a management IP address in the so-called management VRF.
• The routers are VRF-aware while the switches are not.
• No VRF shares routes between any of the VRFs.

672 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Administrative Permissions for Discovery

Administrative Permissions for Discovery

You can start a discovery and manage discovered data based on your administrative permissions. For more
information, see About Administrative Permissions on page 195.
Initiating and controlling a discovery requires specific administrative permissions. The following are permission
guidelines for initiating and controlling a discovery:
• The IPAM Discovery Admin role provides a pre-configured list of permissions by which assigned admin accounts
may perform discovery tasks. Administrators with these permissions can initiate and control discovery on any
existing network. By default, the IPAM Discovery Admin role supports the following permissions:
— All permissions associated with the Network Discovery feature set (active if you do not have a Network
Insight license)
— Read-Only on all Network Views, network containers, networks and ranges
— Read-Only on all hosts
— Read-Only on all Members
— Read-Write Network Discovery permissions
— Editing network, network container or range discovery properties: Read-Only for each type. For member
assignment, the user also needs additional read-only permission for the assigned member
— Editing fixed address, host or reservation discovery properties: Read-only for each type
— Excluding an IP address or an IP Range (from the Network Editor ‘s Discovery Exclusions tab or from the
IPAM IP List view): read-only permission for the network
— Defining discovery and port configuration blackouts at the Grid and Network levels
— Discover Now for Network, DHCP Range, IP address or device: Read-Only permission for each.
• If the user does not possess the Network Discovery permission, all Network Insight permissions and operations
are disabled.
• A Port Control permission under the IPAM Permissions type allows you to add a Read/Write or Deny permission
for a device; a network; a network container; or network view. You can also add a global RW/Deny port control
permission for all network views.
— If the user does not possess the Port Control permission, the user cannot provision networks, de-provision
networks, perform port reservations or configure interfaces. All non-Superuser accounts must have the Port
Control permission to create port control tasks for any affected objects.
• Superusers can initiate and control discovery on all networks. Some discovery functions require superuser
permissions:
— Grid Discovery properties
— Uploading, Viewing and deletion of device support bundles
— Launching Discovery Diagnostics
— Launching Discovery Status
Similar to Network Discovery, devices and end hosts found through discovery can undergo conversion from
unmanaged status to managed status. This entails converting an unmanaged IP address to a host, an A record or
AAAA record, a PTR record, or to a fixed address.
• Administrators with read/write permission to a DNS zone or specific record type can convert unmanaged data to
a host, fixed address, reservation, A record, or PTR record.
• IPAM Discovery admins can convert unmanaged networks to managed networks and can change discovery
settings for networks.
• For unmanaged networks: users may Delete, Convert (to managed), Clear Unmanaged Data and Clear
Discovered Data if one of the following is true:
— User has read-write permission for the network
–or–
— User has Network Discovery permission plus Read-Only for the network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 673

Infoblox Network Insight

After a discovery is complete, the following permission guidelines apply to viewing and managing discovery data:
• Superusers can view and manage all discovered data.
• Administrators with read permission to networks can view all discovery data without editing.
• If a user has read-only permissions for a device’s management IP address, the device is visible in the Data
Management –> Devices tab.
For more information on configuring admin user accounts and working with permissions, see the sections under
Managing Administrators on page 183. For information about discovery permissions, see Administrative Permissions
for Network Insight Tasks on page 241.

Starting and Stopping the Discovery Service

Note: The discovery service can only be started on Grid members that are configured as the Consolidator or Probe
(i.e. the Grid members with valid Discovery installed).

Each discovery member requires separate Discovery licenses, and must have a running discovery service. Consider
the following before starting or stopping the discovery service:
• The Grid Master does not run the discovery service.
• Appliances running a Discovery license and the discovery service do not support HA pairs.
• Discovery Probe appliances appear as Grid members in Grid Manager.
• All appliances running discovery must have the Discovery license installed before starting the service.
• Appliances running discovery do not run core network services such as DNS and DHCP. Discovery
appliances may also run the NTP service.
• If you expect to run a single appliance in the Grid for discovery, the appliance is designated as a
Consolidator, and also performs Probe discovery operations.
• When you add a new Grid member with a Discovery license, the appliance is set automatically to the
following:
— A Consolidator, if no other discovery member exists in the Grid.
— A Probe, when at least one discovery appliance exists in the Grid

Note: When a member joins the Grid and applies a Discovery license for the first time, the admin user needs to log
off and log in again to Grid Manager to see the discovery-enabled functionality.

For information about discovery configuration at the service level, see Configuring Discovery Properties on page 676.

Starting the Discovery Service

To start the discovery service on a licensed Consolidator or Probe appliance:
1. From the Grid tab, select the Grid Manager tab, and click the Services tab.
2. Click the Discovery icon to display the list of members running the discovery service.
3. Select the discovery member or members for which you wish to start the service.
4. Expand the Toolbar and click Start.
The appliance asks you to verify that you want to proceed with starting the service for the selected member.
5. Click Yes.

Stopping the Discovery Service

To stop the discovery service on the Consolidator or Probe appliance:

674 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Defining the Discovery Member Type

1. From the Grid tab, select the Grid Manager tab, and click the Services tab.
2. Click the Discovery icon to display the list of members running the discovery service.
3. Select the discovery member or members for which you wish to stop the service.
4. Expand the Toolbar and click Stop.
The appliance asks you to verify that you want to proceed with stopping the service for the selected member.
5. Click Yes.

Defining the Discovery Member Type

Before using Network Insight to discover devices and networks, you must first define the consolidator and probes in
your Grid and specify the discovering interfaces on these members. For information about how to map discovery
interfaces to network views, see Mapping Discovery Interfaces to Network Views on page 675. Note that when you
first join a discovery member to the Grid, the first discovery member that joins the Grid automatically becomes the
Consolidator and all other discovery members become Probes. If you have only one discovery member in the Grid, it
becomes the Consolidator-Probe standalone discovery appliance.
On some occasions, you may wish to change an appliance with a Discovery license to a Consolidator or to a Probe, or
change a Consolidator to a standalone discovery appliance. To make any of these changes, you must first stop the
discovery service on the appliance. For more information, see Starting and Stopping the Discovery Service on page
674.
To define the discovery appliance type:
1. From the Grid tab, select the Grid Manager tab, and click the Services tab.
2. Click the Discovery icon to display the list of members running the discovery service.
3. Select the discovery member for which you wish to change the appliance type.
4. Expand the Toolbar and click Edit –> Member Discovery Properties.
5. In the General tab of the Member Discovery Properties editor, choose the Member Type:
— Polling: Turns the appliance into a discovery Probe appliance.
— Consolidator: Turns the appliance into a discovery Consolidator appliance.
— Unassigned: Disables the discovery feature on the appliance.

Note: You cannot change the member type when the discovery service is running. Stop the discovery service first
before changing the discovery member type.

6. Save the configuration. If you wish to change the interface over which the appliance sends and receives discovery
traffic, see Mapping Discovery Interfaces to Network Views on page 675.

Mapping Discovery Interfaces to Network Views

Discovery Probe members must have a designated interface or interfaces over which all discovery traffic exchanges
take place. You may designate one or multiple discovery interfaces on each Probe member. You can specify the LAN1,
LAN2, MGMT, and VLAN ports as the discovery interfaces. These ports must first be defined in the member network
settings before they can be used for discovery. Note that when you configure VLANs on Network Insight appliances,
the VLANs are used for discovery only. They do not support other core network services. On ND-1400, ND-2200,
ND-4000, ND-VM-1400, and ND-VM-2200 Network Insight appliances, you can assign multiple VLAN interfaces on the
same Probe to different network views.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 675

Infoblox Network Insight

To discover VRF virtual networks, you must discover their corresponding routes. In order to identify discovered data
by routes, you associate each discovery interface with a network view. You must have a network view configured for
each discovery interface, and you cannot share the same network view with multiple discovery interfaces on the same
Probe member. However, discovery interfaces on different Probe members can share the same network view.
To map discovery interfaces to their respective network views, complete the following:
1. From the Grid tab, select the Grid Manager tab, and then click Discovery.
2. In the Services tab, select the check box of the Probe member you want to configure, and then Click Edit –>
Member Discovery Properties in the Toolbar.
3. In the Member Discovery Properties editor, select the General tab and complete the following:
— Discovery Interfaces: Discovery members must have a designated interface or interfaces over which
discovery traffic takes place. By default, appliances use the LAN1 port for discovery traffic. You may
designate other ports such as the LAN2, MGMT, and VLAN ports as the discovery interfaces. These ports
must first be defined in the member network settings before they can be used for discovery. You cannot
modify the discovery interface settings while the discovery service is running on the appliance.

Note: The VLAN interfaces you configured on any Network Insight appliances are used for discovery only. Other
services are not supported on these appliances for VLANs. For information about how to define network
interfaces on the appliance, see Configuring Ethernet Ports on page 443.

The Discovery Interfaces table displays all interfaces you have configured on the member. To discover using
multiple interfaces, you must associate each interface with an available network view. A single default network
view exists in NIOS by default. All networks created or discovered for NIOS management must be part of a
network view. If more than one network view exists in the Grid, you can map a network view other than the
default view to the interface. This essentially serves to allow one or more discovery members to perform
discovery on separate routing domains, because a network view is comprised of a single routing domain with its
own networks. If you do not want to use a configured interface as the discovery interface, simply leave the
network view empty or unassigned for that interface. When you first set up an interface, no network view is
assigned to the interface by default.
The appliance displays the following for each interface you configure on the Probe member. To modify the
network view for an interface, click the Network View column and select the network view you want to associate
with the corresponding interface.
• Interface: Displays the name of the interface. You cannot modify this field. Discovery supports the LAN1,
LAN2, MGMT, and VLAN interfaces. You must first define these interfaces for the member before using them
for discovery.
• VLAN Tag: Displays the VLAN tag or ID for the corresponding VLAN interface. This field is left blank for all
physical interfaces. You cannot modify this field.
• Network View: Displays the current network view with which the interface is associated. An interface is not
associated with any network view and this field is left blank by default, which means the interface is not
used as a discovery interface. To modify the network view, click the Network View column for the
corresponding interface and select the network view you want to reassign to the interface from the
drop-down list. The appliance associates an interface with the default network view if you have not
configured additional network views.
4. Save the configuration.

Configuring Discovery Properties

To ensure successful discovery, complete the following configurations for the Grid and Grid members that are acting
as the Consolidator and Probes before you start a discovery:
• Define the basic polling methods, such as SNMP collection, CLI collection, and others for the Grid. For more
information, see Defining Basic Polling Settings for the Grid on page 677.

676 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Discovery Properties

• Define advanced polling settings for TCP scanning and Ping sweeps if you have selected these polling
methods. You can also select to use DHCP routers as seed routers or log discovery events to the syslog
while configuring advanced polling settings. For more information, see Defining Advanced Polling Settings
for the Grid on page 678.
• Configure SNMP and CLI credentials if you have selected SNMP Collection and CLI Collection as the polling
methods. For more information, see Configuring SNMP1/v2 Credentials for Polling on page 680.
• Enable discovery or port configuration blackout periods, as described in Defining Blackout Periods on page
731 and Defining Port Configuration Blackout Periods on page 733.

Note: You must be a superuser to configure discovery properties for the Grid. Some settings, such as seed router
definition, take place only on Probes.

Defining Basic Polling Settings for the Grid

Grid polling settings apply to all Probe members and all discovery networks that are assigned to a Probe. You can
override the Grid settings at the Probe member and network levels. Only superusers can modify Grid-wide discovery
settings.
To defining basic polling settings or to override Grid settings on Probe members and networks, complete the
following:
1. For Grid: From the Grid tab-> Grid Manager tab -> Discovery service, select Edit -> Grid Discovery Properties from
the Toolbar.
For members: From the Grid tab-> Grid Manager tab -> Discovery service, select Edit -> Member Discovery
Properties from the Toolbar.
For networks: From the IPAM tab, select the network check box and click the Edit icon.
2. In the Grid Discovery Properties, Member Discovery Properties, or (IPv4 or IPv6) Network editor, click the Polling
tab, and then complete the following in the Basic tab:
For Probe members and networks, click Override to override the Grid settings.
— SNMP Collection: Select this to execute SNMP protocols to discover and collect information such as
traceroute/path collection, vendor and model, SNMP credential collection, routing and ARP tables, switch
port data, and VLAN configuration data. If you disable SNMP collection, previously discovered data remains
available for viewing; no new data is added and no existing data is removed. Note that some devices may
not support SNMP, and some devices also may not enable SNMP by default.
— CLI Collection: Select this if you expect to use Network Insight to discover devices that support CLI
connectivity through Telnet or SSH and that you possess admin account information. NIOS can use device
admin account logins to query network devices for discovery data collection, including IP configuration,
port configuration, routing and forwarding tables, and much more. You must also provide the
command-line credentials information as the credentials in the Grid Discovery Properties editor.

Note: CLI Collection is the default polling method if SNMP is enabled on the member.

— Port Scanning: Select this to probe the TCP ports. Ensure that you go to the Advanced tab to configure more
settings for this option. Should you disable Port Scanning, NIOS attempts no port probes other than SNMP
on any device.
— Profile Device: If enabled, NIOS attempts to identify the network device based on the response
characteristics of its TCP stack, and uses this information to determine the device type. In the absence
of SNMP access, the Profile Device function is usually the only way to identify non-network devices. If
disabled, devices accessible via SNMP are identified correctly; all other devices are assigned a device
type of Unknown. Profile Device is disabled by default for network polling.
— Smart IPv4 Subnet Ping Sweep: Select this to execute Ping sweeps only on subnetworks that are known to
exist but no IPs can be fond within the subnet, such as through ARP or other means.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 677

Infoblox Network Insight

— Complete Ping Sweep: Select this to enable brute-force subnet Ping sweeps on IPv4 networks. An ICMP ping
is broadcast to all addresses in a subnet. Subnet ping sweeps are used as a last resort in the discovery
process. Perform a subnet ping sweep if NIOS cannot identify any network devices in a given subnet.
Subnet ping sweeps should be performed no more that once per day, and will stop on a given subnet once
NIOS Discovery locates a network device and is able to collect data from it. Ensure that you configure
advanced settings for this option in the Advanced tab.

Note: Note: NIOS will not perform Smart Subnet ping sweeps on subnets larger than /22. NIOS also will not
perform Ping sweeps on IPv6 networks because of the dramatically greater scale of network addresses in
the IPv6 realm. The Complete ping sweep differs from the Smart Subnet ping sweep in the following ways:
the Complete ping sweep will run only against the specified range; the sweep will run regardless of the
range size; and the sweep will run regardless of the number of discovered devices within the specified
range.

— NetBIOS Scanning: Select this to enable NIOS to collect the NetBIOS name for endpoint devices in the
network. This feature can be enabled only by users with SysAdmin privileges. This feature is globally
disabled by default (and also for device groups) to prevent unexpected scanning of the network by a new
collector.
— Automatic ARP Refresh Before Switch Port Polling: Select this to enable refreshing of ARP caches on
switches and switch-routers in the managed network before NIOS performs polling of switch ports. Enabling
this feature applies only to switched Ethernet devices. This feature enables more accurate detection of all
endpoint devices on L2 switches. Without ARP refresh, some endpoint devices may not be detected. This
feature is globally disabled by default. Individual ANPs can also be set to enable or disable this feature.
— Switch Port Data Collection: Select this to enable the Probe member to poll L2 enterprise switches. You can
completely disable switch port polling by deselecting this check box. You can also separately schedule
polling for switch port data collection as follows:
— Periodic Polling: Define regular polling time periods. Choose a polling interval of 30 or more Minutes or
in between1 and 24 Hours.
— Scheduled Polling: Schedule recurrent polling based on hourly, daily, weekly or monthly time periods.
Choosing this option, click the Calendar icon and a Polling Schedule editor appears; click the Edit icon
to make scheduling changes. Choose a recurrence pattern of Once, Hourly, Daily, Weekly or Monthly; in
all cases you must choose an Execution Time.
3. Save the configuration.

Defining Advanced Polling Settings for the Grid

If you have selected any basic polling settings that involve the TCP scanning and Ping sweeps, you must configure
additional settings to ensure that these polling methods function properly in a discovery. Advanced SNMP polling
settings consist of choosing the TCP Scan Technique, along with a number of specialized settings for Ping Sweeps
and other operations.
To defining advanced Grid-wide polling settings for TCP scanning and Ping sweeps, complete the following:
1. For Grid: From the Grid tab-> Grid Manager tab -> Discovery service, select Edit -> Grid Discovery Properties from
the Toolbar.
For members: From the Grid tab-> Grid Manager tab -> Discovery service, select Edit -> Member Discovery
Properties from the Toolbar.
For networks: From the IPAM tab, select the network check box and click the Edit icon.
2. In the Grid Discovery Properties, Member Discovery Properties, or (IPv4 or IPv6) Network editor, click the Polling
tab, and then complete the following in the Advanced tab:
For Probe members and networks, click Override to override the Grid settings.
— TCP Scan Technique: Select the TCP technique you want to use for the discovery. The default is SYN. For
more information, see TCP on page 661.

678 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Discovery Properties

— SYN: Select this to quickly perform scans on thousands of TCP ports per system, never completing
connections across any well-known port. SYN packets are sent and the poller waits for a response while
continuing to scan other ports. A SYN/ACK response indicates the protocol port is listening while a RST
indicates it is not listening. The SYN option presents less impact on the network.
— CONNECT: Select this to scan IPv6 networks. Unlike the SYN option, complete connections are
attempted on the scanned system and each successive TCP protocol port being scanned.
In the port table, select the check boxes of the TCP ports you want to discover. You can select all ports by
clicking the check box in the header.
Optionally, you can click the Add icon and complete the following to add a new port to the list.
— Port: Enter the port number you want to add to the list. You must enter a number between 1 and 65535.
— Service: Enter the name of the service.
You can also delete a specific TCP port in the list, or select multiple ports for deletion.
— Purge expired assets data after: Removes records of discovered assets that are no longer reachable after a
specified period of time. The default is set to one day.
— Purge expired device data after: Removes records of discovered network infrastructure devices that are no
longer reachable after a specified period of time. The default is set to seven days, a more forgiving value
given that devices sometimes require maintenance, upgrades or repairs, or in cases where hosts leave the
network on long trips.
— ARP Aggregate Limit: Determines the largest ARP table collectible by discovery. The default is set to 30 ARP
table entries (MAC Addresses).
— Route Limit: Limits the size of the routing table that discovery is required to collect from any given device.
Some routers can have tables in the hundreds of thousands of entries, and collecting such a large body of
data can impose performance problems in the network and in discovery data collection. This setting
defaults to 3000, and automatically excludes BGP routes from collection. Consult Infoblox Technical
Support before making changes to this value.
— Ping Sweep Timeout (ms): Period of time allowed, in milliseconds, before a Ping times out to any given
device. Default is 1000 ms.
— Ping Sweep Attempts: The number of attempts on each address in a Ping sweep before the sweep
continues.
— Ping Sweep Frequency: Defaults to 1, because ping sweep should not be executed more than once a day
when the feature is enabled at the grid level or for a given discovery range. This setting affects the Smart
Ping Sweep and Complete Ping Sweep features under Grid Discovery Properties.
— ARP Cache Refresh: Defines the time period between ARP refreshes by Network Insight across all switch
ports. Before any other switchport polling and discovery operations take place (including any global
discovery polling operations initiated by the administrator), another ARP refresh is carried out by the Probe
appliance regardless of the time interval. The default is five minutes, because switch forwarding tables are
frequently purged from LAN switching devices. (The default on Cisco switches is five minutes/300 seconds.)
Network Insight primarily uses ARP Cache refreshes to improve the accuracy of end-device discovery.
Without this feature, some endpoints may not be discovered and cataloged.
— Ignore Conflict Duration: Used when resolving conflicts and when choosing the option to Ignore the conflict
when resolving it. The length of time during which conflicts is ignored is defined with this settings.
Increments can be defined in Hours or Days.
— Number of discovered unmanaged IP addresses per notification: The maximum number of unmanaged IP
addresses that the appliance discovers before it sends SNMP and email notifications, if enabled. The
appliance resets the counter after it hits this number and sends notifications. The default is 20.
— Interval between notifications for discovered unmanaged IP addresses: This number determines how often
the appliance sends SNMP and email notifications, if enabled, when it discovers the maximum number of
unmanaged IP addresses (configured for Number of discovered unmanaged IP addresses per notification).
This is the time interval between two notifications for discovered unmanaged objects. Select the time unit
from the drop down menu. The default is five minutes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 679

Infoblox Network Insight

— Disable discovery for networks not in IPAM: Enabling this setting disallows Network Insight from executing
discovery on any infrastructure networks that are not presented in the Infoblox IPAM system; e.g. present
and managed in a network view or network container.
— Authenticate and poll using SNMPv2c or later only: For credential discovery and device polling exclusively
using SNMPv2c and up, preventing use of SNMPv1, enable this check box.
— Use DHCP Routers as Seed Routers: Select this so the Probe members can use the default gateways for
associated DHCP ranges and networks as seed routers to more quickly discover and catalogue all devices
(such as endpoint hosts, printers and other devices). All such default gateways are automatically leveraged
by discovery, and no further configuration is necessary unless you wish to exclude a device from usage.

Note: Check for a list of configured DHCP seed routers for any discovery Probe member in the Seed tab –>
Advanced tab of the Member Discovery Properties editor.

— Log IP Discovery events in Syslog: Sends a message to the configured Syslog service when an IP address of
an active host is discovered.
— Log network discovery events in Syslog: Sends a message to the configured Syslog service when a network
discovery process takes place in the Grid.
3. Save the configuration.

Configuring SNMP1/v2 Credentials for Polling

Note: You can test SNMPv1/v2c and SNMPv3 credentials against any device or any IP address, at the Grid level or
from any Probe member or network view. For more information, see Configuring SNMPv3 Properties on page
680 and Testing SNMP and CLI Credentials on page 683.

1. From the Grid tab, select the Grid Manager tab, and then click Discovery.
2. For the Grid: Click Edit –> Grid Discovery Properties in the Toolbar.
For the Probe member: Select the member check box, and then lick Edit –> Member Discovery Properties in the
Toolbar.
3. Click the Credentials tab. To override Grid settings for a Probe member, click Override.
4. Click the Add icon to add a new community string entry to the list. Click the Read Community cell and enter a text
string that the management system sends together with its queries to the network device during discovery.
A community string is similar to a password in that the discovered device accepts queries only from
management systems that send the correct community string. Note that this community string must exactly
match the value that is entered in the managed system. If you have a substantial list of community strings in
this list and need to find a specific string, enter the value in the Go To field and click Go. To remove a community
string entry, select the check box and click the Delete icon.
5. Optionally, you can test the credentials you added to the list by selecting a community string check box and
clicking Test Credentials, as described in Testing SNMP and CLI Credentials on page 683.
6. To export the entire list of community strings in a table file readable by a spreadsheet program, click the Export
icon and choose Export Data in Infoblox CSV Import Format. To export all data in a different format, click the
Export icon and choose Export Visible Data.

Configuring SNMPv3 Properties

SNMPv3 allows the use of two secret keys for every credential–one for authentication, and another for encryption.
Network Insight allows flexible application of keys–authentication but no encryption, for example. You define users
in one of three ways:
• SNMPv3 user, with no authentication or privacy credentials
• SNMPv3 user, with authentication but no privacy credentials

680 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Discovery Properties

• SNMPv3 user, with both authentication and privacy credentials

You can import sets of SNMPv3 credentials from an Infoblox CSV Import format data file.
1. From the Grid tab, select the Grid Manager tab, and then click Discovery.
2. For the Grid: Click Edit –> Grid Discovery Properties in the Toolbar.
For the Probe member: Select the member check box, and then lick Edit –> Member Discovery Properties in the
Toolbar.
3. Click the Credentials tab -> SNMPv3 tab. To override Grid settings for a Probe member, click Override.
4. Click the Add icon to add a new SNMPv3 authentication entry to the list. Enter the Name for the new credential;
followed by the Auth Protocol, Auth Password, Privacy Protocol, Privacy Password, and the Order value, which
is the order used for attempting use of the SNMP credentials. You can press Tab to navigate across the fields for
the credential entry.
5. If you have a substantial list of SNMPv3 entries and need to find a specific entry, enter the value in the Go To field
and click Go.
6. To remove an SNMPv3 authentication entry: select the check box and click the Delete icon.
7. To export the entire list of community strings in a table file readable by a spreadsheet program, click the Export
icon and choose Export Data in Infoblox CSV Import Format.
a. To export just the subset of data that is visible in the dialog, click the Export icon and choose Export Visible
Data.
b. A Show Passwords option allows the secret keys to be visible in the import.

Configuring CLI Discovery Properties

SNMP protocols provide a powerful means of querying devices for broad arrays of information. The CLI discovery
feature is required for port control tasks including port configuration and network provisioning and de-provisioning,
but is not used for other discovery operations or to otherwise manage devices. By default, Probe appliances inherit
their member discovery properties, including CLI credential sets, from the Grid level. Enable passwords are entered
in separate records and kept as a separate list in Grid Manager.
You manage CLI credentials for devices in similar fashion to SNMP credentials, by defining a global set of Admin
account/password tuples (and Enable passwords) at the Grid level; and specifying credentials and Enable passwords
for individual devices at the member level, when necessary. Should such a credential not work for a given device, or
if command-line access is lost for a device, Network Insight re-guesses credentials from the Grid-level credential list,
including vendor defaults if available.

Note: You can test username/password credentials or an Enable password credential. You can also combine a
username/password credential and an Enable password credential as part of the same test.

1. From the Grid tab, select the Grid Manager tab, and then click Discovery.
2. For the Grid: Click Edit –> Grid Discovery Properties in the Toolbar.
For the Probe member: Select a member check box, and then click Edit –> Member Discovery Properties in the
Toolbar.
3. Click the Credentials tab -> CLI tab. To override Grid settings for a Probe member, click Override.
4. Click the Add icon to add a new CLI username/password entry to the list. Select the Credential Type, which can
be one of two choices:
5. In the Login Credentials list, click the Add icon to add a new CLI username/password entry:
— Protocol: Select SSH or Telnet. Infoblox recommends use of SSH.
— SSH — SSH credentials require both a username and password. The default protocol is SSH.
— Telnet — In Network Insight, Telnet credentials must use both a username or password.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 681

Infoblox Network Insight

Note: Should you choose to use a Telnet-based credential, Network Insight requires both the username and
password for the login account. This also applies when you override the CLI credentials on objects such
as a fixed address, host or IPv4 reservation. For more information, see the section Defining CLI Credentials
Settings for Objects on page 682.

— Name — Username for the CLI login account.

— Password — Login password for the CLI login account.
— Comment — A text comment describing the CLI login account.
— Order — By default, Network Insight inserts the new credential record at the bottom of the credentials list,
which is reflected by its Order value, showing the order used for attempting use of CLI credentials. Enter a
new value in the Order field if you want the new credential to be in a position other than the last in order.
6. In the Enable Credentials list, click the Add icon to add a new Enable password entry:
— Protocol — SSH or Telnet. Infoblox recommends use of SSH.
— Password — Enable password for device configuration access.
— Comment — A text description.
— Order — By default, Network Insight inserts the new record at the bottom of the list, reflected by its Order
value, showing the order used for attempting use of the CLI credentials. Enter a new value in the Order field
if you want the new credential to be in a position other than the last in order.
7. Click Save & Close to save changes. You may also select Save to keep the dialog box open for further changes.
You can press Tab to navigate across the fields for the credential entry.
To test CLI credentials for the current appliance, see Testing SNMP and CLI Credentials on page 683.

Defining CLI Credentials Settings for Objects

You can override CLI credentials, and enable password credentials, for IPAM objects such as fixed addresses, IP
reservations and host objects. You can also do so for networks under IPAM and DHCP.
When you do so, you define and test the CLI credentials and enable passwords locally to the object.
1. From the Data Management tab, select the IPAM tab. The IPAM Home page appears.
2. In the IPAM IP List page or the IPAM IP Map page, navigate to the network and then the IP associated with the
object you want to edit.

Note: For each network, the IP list page provides a Type data column showing the IPAM object type that is
associated with any IP address. Also check the MAC Address column in the IP List page for information
about associated objects.
For a quick way to locate all objects of a certain type in the Grid, you can also create a smart folder with
settings such as: Type –> Equals –> IPv4 Fixed Address. Title the smart folder appropriately, to make clear
what data set it is presenting.

3. Click the IP address. In the IP address page, click the Related Objects tab.
4. Select the check box for the object in the Related Objects panel and click Edit.
5. In the object editor, click the Discovery tab.
6. For the object, click the Override CLI Credentials check box to override the inherited set of CLI credentials taken
from the Grid level.
By default, CLI credential definitions use SSH at the object level. Select the Allow Telnet check box if you want to
allow both SSH and Telnet credential usage; Infoblox recommends SSH because of better security.
7. Enter the Name and Password values, and the Enable Password value.
8. Click Test CLI Credentials to test the CLI discovery credential settings applied to the object.
9. When finished, click Save & Close.

682 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Discovery Properties

Testing SNMP and CLI Credentials

After configuring SNMP and CLI credentials, you can click Test Credentials in the SNMP Credentials or CLI Credentials
panel to test the credentials. Credential testing ensures that the configured credentials work for as many devices and
networks as possible. The procedure in this section applies at both the Grid and the member levels. You can override
the Grid settings at the member level.
For CLI credentials, you can test an admin login name and password tuple as well as a following enable credential, if
necessary. You can also override CLI credentials and enable credentials for IPAM objects such as fixed addresses, IP
reservations, and host objects. You can test any credential set, an enable credential, or both in combination against
any device within any network view. Network Insight sets the login sequence to match the command-line standards
for the selected device.
To test SNMP credentials or CLI credentials, complete the following:
1. From the Grid tab, select the Grid Manager tab, and then click Discovery.
2. For the Grid: Click Edit –> Grid Discovery Properties in the Toolbar.
For a Probe member: Select a member check box, and then click Edit –> Member Discovery Properties in the
Toolbar.
3. In the Grid Discovery Properties or Member Discovery Properties editor, click the Credentials tab -> SNMPv1/v2
tab, SNMPv3 tab, or CLI tab.
4. Select the check box or check boxes for the credentials and/or enable credentials (if applicable) you want to test.
For a Probe member, click Override, and then select the credential check boxes.
5. Click Test Credentials.
6. In the Test SNMP Credentials editor, complete the following:
— IP Address: Select this to test the credential against an IP address of a reachable device in a network (even
if it has not been discovered or managed through NIOS) within a specified network view. Enter the IP
address in the field. Ensure that you select the respective network view in which this IP address resides.
— Network View: If you have multiple network views, select the network view in which the IP address resides
from the drop-down list. If you have only one network view, which is the default view, the Network View
drop-down list is hidden by default. NIOS conducts credential testing for the IP address in the selected
network view.
— Device: Select this to test against a selected device. Click Select Device and the Device Selector appears. If
you have multiple network views, you must first select the network view in which the device resides from
the Network View drop-down list, located at the upper left hand corner of the selector. If you have only one
network view, which is the default view, the Network View drop-down list is hidden by default. You can
check the device categories under All Devices to locate discovered switches and routers or any unmanaged
devices previously detected by discovery under NIOS. You can explore categories including Discovered
Switches/Routers, Microsoft Windows Devices (this can include items such as Windows Servers of various
types), Router and Wireless Access Point Devices, Unmanaged, and others. By default, all devices
previously discovered appear in this selector. If you have a long list of devices, you can enter a device name
search value or a search expression in the Find field and click Go. You can also click Show Filter to narrow
down your selection by selecting available filters. Click OK after you have selected a device and its
corresponding network view.
7. Click Start to begin testing the credential against the IP address or selected device. The communication and
testing processes appear in the lower pane of the editor.

Note: If the specified IP address is excluded from all discovery ranges or is not part of the selected network view, or
the credential is entered with missing information, a message appears at the top of the editor after clicking
Start. Otherwise, the test begins and its process and results appear in the lower pane of the editor.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 683

Infoblox Network Insight

Defining Seed Routers for Probe Members

Seed routers can be defined only on Probe appliances. You can define seed routers that NIOS uses in quickly
performing network discovery. Definition of seed routers is highly recommended for IPv4 networks and is required for
IPv6 networks. For discovery of any IPv6 networks, you must use seed router values that comprised of at least one
well-connected IPv6 router, preferably with routes to all other networks to be managed. In some cases, seed routers
may not have the full routing tables or be unable to provide full information for some reason. The general rule of
thumb is that more seed routers are better, but the connectivity of seed router(s) also helps determine how many
seed routers you need. Avoid having more seed entries than necessary.
You must associate each seed router with a network view so the appliance can properly discover virtual networks
when using multiple seed routers.

Note: All NIOS Probe members automatically use their default gateway as a seed router. These gateways are
automatically displayed in the table. For effective use of seed routers, you must also provide SNMP credentials
to NIOS to allow it to pull the key routing and connectivity information, including the IPv6 routing table and the
local Neighbor Discovery Cache, from the device. If you do not define a seed router, it is recommended that
you enable discovery for a network or DHCP range.

You can check Discovery Status to see whether a seed router is successfully being reached and whether the seed is
providing information. By reviewing discovery status for each seed router, you can determine whether Network Insight
should be able to discover the network successfully, or if there are possible configuration errors preventing network
discovery, without having to wait to see what Network Insight finds. For seed routers, Reached Status and Overall
Status should both read Passed.
To add, view, or delete seed routers for a Probe, complete the following:
1. From the Grid tab, select the Grid Manager tab, and click Discovery.
2. Select the check box for any Probe appliance on the Discovery page and click Edit –> Member Discovery
Properties from the Toolbar.
3. In the Member Discovery Properties editor, Click the Seed tab. Grid Manager displays the following:
Click the Add icon to add a seed router. Grid Manager adds a row to the table. Complete the following in the
table:
— Router: Click this field and enter the IP address for the desired IPv4 or IPv6 seed router. Note that you can
assign a seed IP address to different network views if your deployment has overlapping IP addresses.
— Network View: Displays the current network view with which the interface is associated. A newly added
seed IP does not have any associated network view by default. From the drop-down list, select the network
view you want to reassign to the interface.
— Comment: Enter information about the seed router.
You can delete a seed router by selecting it and then click the Delete icon. Note that you cannot delete any seed router
that is a default gateway.

IPv6 Seed Router Usage

For discovery of any IPv6 network, you must use seed router values, comprised of at least one well-connected IPv6
router, preferably with routes to all other networks to be managed. In some cases, seed routers may not have the full
routing tables or be unable to provide full information for some reason. The general rule of thumb is that more seed
routers are better, but the connectivity of seed router(s) also helps determine how many seed routers you need. Avoid
having more seed router entries than necessary.

Note: For effective use of seed routers, provide SNMP credentials to the Probe member to allow it to pull the key
routing and connectivity information, including the IPv6 routing table and the local Neighbor Discovery Cache,
from the device. For more information, see Defining Seed Routers for Probe Members on page 684.

684 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Excluding IP Addresses from Discovery

Excluding IP Addresses from Discovery

Note: You use the IPv4 Network or IPv6 Network editors to exclude IP addresses or ranges of IP addresses from
discovery within the specified network. For more information, see Disabling Discovery for a Network on page
713.

Host records, fixed address and IPv4 reservations can be excluded from discovery. You may also exclude an IP
address or a range of IPs within a network from discovery.

Note: You may create a network and choose not to discover it at that time, by disabling both Enable Immediate
Discovery and Enable Discovery. If you disable the Enable Discovery check box, the network will never be
discovered unless you change the setting again at a later time.
Conversely, you can explicitly exclude specific IPs or IP ranges from discovery. Discovery will never take place
on these IPs unless the admin specifically changes their exclusion setting.

Administrators can specify IPv4 and/or IPv6 addresses that must be immediately discovered by the appliance.
Some devices may need exclusion because they do not support SNMP, or for other organizational reasons.
Devices matching IP addresses selected for immediate discovery (using the Discover Now feature described in Using
Discover Now to Discover an Existing Object on page 689) are given one-time priority over other discovered devices,
for data collection and counting toward any device found matching the license limits.
A device specified through an IP address can also be excluded from discovery or management.

Quick Exclusion of IPs from Discovery

You can use the IPAM IP Map or IP List page to quickly exclude IP addresses and selected ranges of IP addresses from
discovery. For example, you may have Infoblox appliances or routers that provide the gateway to networks that are
already managed by Grid Manager, or devices on which you do not wish to have discovery operations take place.
1. From the Data Management tab, select the IPAM tab. The IPAM Home page appears.
2. Click on any network or network container in the list. The IP Map appears for the selected network.

Note: You may also use the List page for the selected network to exclude IPs or selected ranges of IPs. However,
you have to page through or search through the pages comprising the list view to locate the IPs you want
to exclude. (If you know the IP address value in the List view but it does not appear on the page, enter it
in the Go to field to search for the IP.) The IP Map view allows you to view every IP address in a selected
network, such as a /24 prefix.

3. Select one or more IPs in the map. SHIFT+click to select a series of contiguous IPs. CTRL+click to select
non-contiguous IPs.
4. Expand the Toolbar and click Exclusion –> Enable Exclusion. The selected IP addresses are excluded from any
discovery actions.

Note: You can click the Action icon for any List record and choose Exclusion –> Enable Exclusion.

To locate an IP to exclude within a network container:

1. From the Data Management tab, select the IPAM tab. The IPAM Home page appears.
2. Select the network container by clicking it. The IPAM Home page changes to display the List page, showing the
list of networks within the container.
3. Click the network that has the IP in its space that you wish to exclude.
4. Select the network IP address from the List table. If you know the IP address value but it does not appear on the
page, enter it in the Go to field to search for the IP.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 685

Infoblox Network Insight

5. Expand the Toolbar and choose Exclusion –> Enable Exclusion.

A parent network container may exclude IPs, and you may add and remove discovery exclusions within network
containers. You can drill down to the child networks in the Net Map view to perform exclusions on IPs. For example,
consider a /16 network container that has a number of smaller /24 child networks within it. Right-clicking on any child
network in the network container and choosing Edit from the popup menu, opens the editor with its Discovery
Exclusions tab, where you can perform exclusions within the child network.

Creating a New IPAM Object and Excluding it from Discovery

You can create a new object from the main Data Management –> IPAM or Data Management –> DHCP pages.
1. From the Data Management tab, select the IPAM or DHCP tab.
a. For IPAM, the IPAM home page appears, listing all networks reachable by IPAM.
b. For DHCP, the home Networks page appears, showing all networks reachable by DHCP.

Note: The network lists between IPAM and DHCP will likely differ, because networks can be set to be Disabled from
DHCP. IPAM provides a complete list of all networks configured or discovered by Grid Manager.

2. Select a network from the IPAM home page: by checking the network’s check box, searching for the network in
the Go To box, or using the Next Page, Previous Page and Last Page selectors.
–or–
a. Select a network from the DHCP –> Networks home page by clicking its check box.
3. Expand the Toolbar and click the Add button, and select the object type from the menu, such as Host, Fixed
Address –> IPv4, or other object type.
4. In the second Wizard step, click Next Available IP to obtain the next available IP address in the chosen network.
For more information about obtaining the next available IP address, see About the Next Available Network or IP
Address on page 1109.

Note: For adding a host record, the first step in the Add Host Wizard requires adding an IP address.

5. If the network of the IP address is served by a Grid member, Grid Manager displays the Assign IP Address by
section, with its MAC Address, DHCP Client Identifier and DHCP Relay Agent settings. Select the different options
as needed to define a fixed IP Address or other object.
6. Click Next to continue to the DHCP Options page in the wizard.

Note: For more information about DHCP Options configuration, see About the Next Available Network or IP
Address on page 1109.

7. If you do not wish to configure DHCP Options for this Fixed IP, click Next to go to the following Wizard step.
8. (Optional) In the Device Information page, select the Device Type and the Device Vendor, or, if you do not wish to
configure device settings for the current object, click Next to go to the next Wizard step, for defining discovery
settings.

Note: For more information about Device Information settings, see Creating Port Reservations for IPAM Objects
on page 723.

9. Choose from the options on the Step 5 Wizard page:

• Check Exclude from Network Discovery to prevent the object from being probed by discovery.
• (Enabled by default) If you want immediate discovery of the current Fixed IP, select the Enable Immediate
Discovery check box.
You may disable both check boxes. Doing so does not disable discovery for the current object–discovery is
simply performed by Network Insight on its own internal timetable.

686 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Discovering Devices and Networks

• To override SNMP credentials for either SNMPv1/v2 or for SNMPv3 for the current Fixed IP, select the
Override Credentials check box.
You can enter both a SNMPv1/v2 Read community string and an SNMPv3 credential, or enter only the single
type you need. Each can be selected and edited in turn.
— Select SNMPv1/v2 and enter the Read community string;
–or–
— Select SNMPv3 and enter the device admin account name, and the Auth Protocol, Auth Password,
Privacy Protocol and Privacy Password values where necessary.
• You can apply a set of CLI Credentials to the specific fixed address object. To override the inherited CLI
credentials from the Grid, select the Override CLI Credentials check box. You can enter the admin user
Name and Password values and, if necessary, an Enable Password. The values you enter here are specific
only to the current object.

Note: Clicking Schedule for Later is a navigational button to allow you to skip quickly to the scheduling step in the
Wizard. You can return at any time to complete remaining Wizard steps to finish creating the object. You may
click the Schedule for Later button at any time in the Wizard process. For more information, see Scheduling
New IPAM/DHCP Objects and Associated Port Configurations on page 86.

10. (Optional) Click Next to go to the sixth Wizard step, which governs Reserve Port and Configure Port settings. (For
more information, see Defining Port Reservations for an Infoblox Grid Member on page 726.) Click Next when
finished with settings.
11. If necessary, add or apply any extensible attributes necessary for the new record. Click Next.
12. The final Wizard page governs scheduling of the object creation task and the optional port reservation task. Click
Save & Close.

Excluding IP Addresses in Grid Manager

You may exclude IP addresses from discovery from within a number of different contexts in Grid Manager. Under IPAM,
you can exclude in the IP Map and IP List pages. The IP List page provides an Exclude data column that directly shows
the exclusion status for all IPs in the selected network. Various objects, such as host records, IPv4 and IPv6 fixed
addresses, and IPv4 reservations, may be excluded from discovery.
You may view excluded IP addresses in the IP List page or in the network editor’s Exclusions tab.

Discovering Devices and Networks

To start discovery on connected networks, complete the following:
1. Ensure that your appliances are licensed for discovery.
2. Add the needed seed routers to each Probe appliance, as described in Defining Seed Routers for Probe Members
on page 684.
3. Add the necessary SNMPv1/v2 and SNMPv3 credentials at the Grid level and/or Member/Probe level. For
information, see Configuring SNMP1/v2 Credentials for Polling, Configuring SNMPv3 Properties on page 680,
Defining Seed Routers for Probe Members on page 684, and Defining Seed Routers for Probe Members on page
684.
4. If necessary, add CLI Credentials, including device admin username/password tuples and Enable passwords, at
the Grid level and/or Member/Probe level, as described in Configuring CLI Discovery Properties on page 681 and
Testing SNMP and CLI Credentials on page 683.
5. If necessary, enable the use of DHCP routers and servers as seeds to increase device discovery, as described in
Configuring SNMP1/v2 Credentials for Polling on page 680.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 687

Infoblox Network Insight

6. If you have extensive end host Ethernet segments connected to Ethernet switches, enable switch port discovery,
as described in Defining Seed Routers for Probe Members on page 684.
With these settings, the Probe appliances automatically begin discovering network infrastructure devices.
You can elect to immediately discover or schedule discovery of new objects that you create and enable under IPAM
or DHCP. Objects that allow immediate discovery include the following:
• IPv4 Fixed Address (see Configuring IPv4 Fixed Addresses on page 1125 for the complete procedure).
You can Enable Immediate Discovery or Exclude from Network Discovery after creating the IPv4 fixed address,
and override the SNMP credentials if necessary.
• IPv6 Fixed Address (see Configuring IPv6 Fixed Addresses on page 1171 for the complete procedure).
You can Enable Immediate Discovery or Exclude from Network Discovery after creating the fixed address, and
override the SNMP credentials if necessary.
• IPv4 Reservation (see Configuring IPv4 Reservations on page 1131 for the complete procedure).
You can Enable Immediate Discovery or Exclude from Network Discovery after creating the IPv4 reservation, and
override the SNMP credentials if necessary.
• Host (see Adding Host Records on page 579 for the complete procedure).
You can Enable Immediate Discovery or Exclude from Network Discovery after creating the host, and override
the SNMP credentials if necessary.
• IPv4 Network (see Configuring IPv4 Networks on page 1111 for the complete procedure).
You can Enable Immediate Discovery (option is enabled by default) and override inherited discovery Polling
Options for the new network.
• IPv6 Network (see Configuring IPv6 Networks on page 1160 for the complete procedure).
You can Enable Immediate Discovery (option is enabled by default) and override inherited discovery Polling
Options for the new network.
• IPv4 DHCP Range (see Configuring IPv4 Address Ranges on page 1121 for the complete procedure).
You can Enable Immediate Discovery (option is enabled by default) and override inherited discovery Polling
Options for the new IPv4 DHCP range.
• IPv6 DHCP Range (see Configuring IPv6 Address Ranges on page 1168 for the complete procedure).
You can Enable Immediate Discovery (option is enabled by default) and override inherited discovery Polling
Options for the new IPv6 address range.
During configuration, you can choose to Exclude from Network Discovery if you wish to postpone discovery for
specific object types.

Note: Individual IP addresses within a network, and specific object types (IPv4 reservation, fixed address, and host),
may be excluded from discovery. You must explicitly select Enable Discovery for other object types (IPv4 and
IPv6 Ranges, IPv4 and IPv6 Networks); you can optionally Enable Immediate Discovery.
If you choose not to perform immediate discovery, but do Enable Discovery, the new network or other object
is discovered at a normal time determined by Network Insight.

You can manually perform discovery on any object at any time by selecting the object and choosing
Discover Now from the Toolbar. For more information, see Using Discover Now to Discover an Existing
Object on page 689. When you do so, you see a status icon appear in the Discover Now data column
for the object under IPAM, in the Data Management –> DHCP page and other locations.
By default, Grid discovery settings are the prevailing settings for all newly created objects. You can
override basic discovery polling options for networks and DHCP ranges allowing immediate discovery.
In such cases, local settings take priority. Credentials cannot be overridden for networks and DHCP ranges,

688 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Discovering Devices and Networks

Using Discover Now to Discover an Existing Object

Note: If after you select a a network, object or IP and the Discover Now button is not enabled, make sure the network
or other object has a discovery Probe member assigned to it.

After you create any supported IPAM object, you may wish to perform discovery on it at a later time. You can simply
select the object and discover it.
1. From the Data Management tab, select the IPAM tab. The IPAM Home page appears.
2. Select the network or other object over which you want to perform discovery.
Depending on the object type, navigate from the network level to the individual IP table in the List page to locate
the object for immediate discovery.
3. Expand the Toolbar and click Discover Now.
You can also click the Action icon for the network and choose Discover Now from the menu.
The Probe member associated with the network or other object initiates a discovery procedure.

Smart Folders and Discovered Devices

Grid Manager maintains a Smart Folder titled Discovered Switches/Routers, under which
appears a list of all routers, switches and switch-routers that thus far have been
discovered and catalogued through discovery. Clicking a device name opens the device’s
main page, with Interfaces, Networks, IP Addresses, Assets and Components panels. For
more information, see Managing Discovered Data on page 691.
Open the Smart Folders category under the Finder menu and click on the Discovered
Switches/Routers folder. Clicking on a device name opens the device page under Data
Management –> Devices and shows the Interfaces page for the chosen device. For related
information, go to Predefined Smart Folders on page 176.

Using the Device Selector

You use a dedicated Device Selector window to choose a discovered device for creating
a port reservation with various IPAM objects such as IPv4 reservations, fixed addresses,
host records, and provisioning of IPv4 and IPv6 networks on device interfaces; testing
SNMP or CLI credentials, and other purposes, as shown in Figure 15.3.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 689

Infoblox Network Insight

Figure 15.3 Using the Device Selector Window

The chosen device is discovered and listed in the Devices panel in IPAM, or any other device on the network under
the All Devices category in the left pane of the device selector.
Clicking a managed device’s device name selects the device and brings you back to the originating page. Otherwise,
select a device and click OK to continue.
If you have a long list of devices even after selecting a smart folder, enter a device name search value or a search
expression in the Find field and click Go.

690 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Discovered Data

Tips for Quick Navigation

To locate interface and device information quickly, along with associated IPAM objects that may be associated with
elements such as port reservations, you can use Device and Interface terms in Global Search. (For additional
information on Global Search, see Global Search on page 68.)
Smart Folders provide another means of locating items such as IP addresses and IPAM objects of various types. Smart
Folders provides additional filters for Device Type, Vendor, Model and Version. In a Smart Folder containing
interfaces, you can filter by Admin Status, Operation Status, Trunk Status, VLAN ID or VLAN Name, and Description.
Using Smart Folders, you can also isolate all objects of a certain type by creating a smart folder with settings such as:
Type equals IPv4 Fixed Address. Title the smart folder appropriately, to make clear what data set it is presenting.

Managing Discovered Data

After Network Insight discovers devices across the network, key information is collected into a number of tables that
allow for various forms of interaction. One key interaction is the conversion of network entities into managed objects.
Discovery operates on the principle that you should be able to work effectively with five key elements that comprise
all networks:
• Devices
• Interfaces
• Networks
• IP Addresses
• Assets
All five of these discovered entities can be converted to Managed Objects under IPAM and DHCP.
At their essence, you perform two types of conversions:
• Converting an unmanaged network;
• Converting an unmanaged IP address, which is an IP address that has no IPAM object, but has discovered
data; specifically for a device, an interface or an asset.

Note: When an entity of these types is converted to managed state under IPAM, you can apply permissions to them
under Grid Manager, to limit who can modify configurations and deployments, and when those changes can
be applied.

Grid Manager allows you to convert devices, interfaces and networks to managed status. What does this mean? For
all three entity types, it means that you can assign an IPAM object to them. You can discover a router or Ethernet
switch on the network, have it appear under IPAM, and then convert it to an IPAM object under Grid Manager to
resolve its identity on the network. Supported object types include the following:
• Hosts
• Fixed IPv4 Address
• Fixed IPv6 Address
• IPv4 reservation
• A Record
• PTR Record
Devices in unmanaged status may be converted to a managed object in Grid Manager: a host, fixed address, A record
or PTR record (for more information, see Converting Unmanaged Devices to Managed Devices below).
Assets, being essentially another classification of network devices, may be treated the same way (see Converting
Unmanaged Devices to Managed Devices);

NIOS 7.3 NIOS Administrator Guide (Rev. A) 691

Infoblox Network Insight

Networks in unmanaged status may be converted to managed status under IPAM and DHCP (DHCP is optional) to
allow performance of tasks such as editing, splitting and resizing (under IPAM) and conversion to DHCP IP ranges
(under DHCP). For more information, see Converting Unmanaged Networks under IPAM to Managed Status on page
694);
Interfaces in unmanaged status may be converted to a managed object in Grid Manager: a host, fixed address, A
record or PTR record (for more information, see Converting Unmanaged Interfaces to Managed Status on page 696);
IP Addresses may also be converted to IPAM objects (for more information, see Converting Unmanaged IP Addresses
to Managed Status on page 697);
Finally, network devices such as server, end hosts and other network devices neighboring the current device can be
converted to managed devices under Grid Manager. For more information, see Converting Unmanaged Assets to
Managed Status on page 698.

Converting Unmanaged Devices to Managed Devices

Note: For convenience, the home Data Management –> Devices page provides a quick filter
to list only managed devices. In the Devices page, all devices highlighted in yellow
indicate a device that is unmanaged.

Device discovery allows you to define a fully managed state for any discovered and catalogued router, switch, firewall,
end host or other network infrastructure device. The process differs from converting an unmanaged network, because
you can bind a discovered device to a fixed address, a PTR Record, a host record or an IPv4 reservation. Doing so
offers the following benefits:
• Fixed Address – A fixed address represents a persistent link between an IP address and one of the
following: MAC address, Client identifier, or Circuit ID/remote ID in the DHCP relay agent option (option 82).
Most applications in the current context are for a MAC address. You can configure fixed addresses for
network devices, such as routers and printers, that do not frequently move from network to network. By
creating fixed addresses for network devices, clients can reliably reach them by their domain names. Some
network devices, such as web or FTP servers, can benefit from having fixed addresses for this reason. For
more information about these object types, see Configuring IPv4 Fixed Addresses on page 1125 and
Configuring IPv6 Fixed Addresses on page 1171.
• Host Record – Infoblox hosts are data objects that contain DNS, DHCP, and IPAM data of the assigned
addresses. Host objects allow you to assign multiple IPv4 and IPv6 addresses to a host. When you create a
host record, you are specifying the name-to-address and address-to-name mappings for the IP address that
you assign to the host. The Infoblox DNS server then uses this data to respond to DNS queries for the host.
This establishes the identity of any infrastructure device or asset on the network. For more information, see
About Host Records on page 578.
• PTR Record – Maps a device’s IP address to a host name in a reverse-mapping zone. The zone must already
be defined before assigning the new PTR record object. For more information about PTR records, see
Managing PTR Records on page 884.
• A Record – An A (address) record is a DNS resource record that maps a domain name to an IP address. A
records essentially tell DNS that a host exists inside a domain, as part of a forward-mapping zone. All traffic
to a domain or subdomain is directed to the IP address specified by the A record. The DNS zone must exist
in the Grid Manager before attempting to assign A records to devices. For more information about A records,
see Managing A Records on page 880.
Each object type has its own characteristics that you may apply to specific types of discovered devices. For many
infrastructure devices such as routers, or Assets such as servers, a fixed address is a likely choice.
Begin by examining the Data Management –> Devices page. The Managed column, as shown in Figure 15.4, can list
one of three possible states for all discovered devices:
— Blank value–indicates that the device is not known to IPAM, because insufficient information is available to
identify and catalog the device at the present time;

692 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Discovered Data

— No–Shows that the device in the Devices table is not managed under IPAM/Grid Manager, but enough
information is catalogued that the device can be converted to Managed state. This state is required before a
device can be converted to managed status.
— Yes–The device in the table is now Managed under IPAM, as an IPAM object type (PTR record, host, IPv4
reservation or fixed address).
An Action icon (shown as a gear in each row for the table) provides the quickest access to the Convert feature for
unmanaged devices, as shown in Figure 15.4.

Figure 15.4 Unmanaged Devices That May be Converted to IPAM objects

Managed
column

1. From the Data Management tab, select the Devices tab.

2. Click the Next Page and Last Page icons to locate the device you want to convert.
3. Click the Action icon next to the device you want (this automatically selects it) and select Convert –> To Host,
Convert –> To A Record, Convert –> To PTR Record, or Convert –> To Fixed Address, from the menu. The object editor
dialog appears for the chosen object type.
a. Define the required General settings for the new object.
b. Define any further settings you need from any of the other tabs in the editor.
4. Click Save & Close to make the conversion. You can return to the managed object at any time to make further
configuration changes.
Under the Data Management –> Devices page, the device’s listing shows Yes under the Managed column. The device
is now under the control of IPAM and can participate in Infoblox services.

Converting Unmanaged Networks to Managed Status

Note: When you convert a network to managed status, Grid Manager uses the discovered Router IP for the network
to automatically populate the Router IP value in DHCP configurations for the selected network. Conversion for
DHCP is optional; you can choose to Disable for DHCP when you convert the network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 693

Infoblox Network Insight

Unmanaged networks listed under discovered devices present the same conversion features as networks listed under
IPAM (see the following section Converting Unmanaged Networks under IPAM to Managed Status). Begin by
examining the Data Management –> Devices page, click a discovered device name’s Action icon and click the
device name hotlink. Open the Networks tab. The Managed column shows one of three possible states for all
discovered networks on each device:
— Blank value–indicates that the network is not known to IPAM, because insufficient information is available
to identify and catalog the network at the present time, or because the network listed at the device level is
for a loopback interface, a disconnected network, or a network prefix that is overlapped by a larger network
encompassing that prefix and defined in IPAM. These are also called non-NIOS networks. At the device
level, non-NIOS networks are highlighted in light grey;
— No–Shows that the network is not managed under IPAM/Grid Manager, but enough information is
catalogued that the network can be converted to Managed state. This state is required before a network can
be converted to managed status. Networks in this state are highlighted in yellow.
— Yes–The network is currently managed under IPAM, converted to an IPAM network. At the device level,
managed networks are highlighted in white.
Converting a network in the device context is the same as converting it at the top IPAM level. Administrators cannot
apply services or IPAM objects to IP addresses in unmanaged networks until the networks are converted to managed
status. Many operations cannot be carried out on unmanaged networks, including editing, splitting, resizing,
permissions changes and many other tasks.
1. From the Data Management tab, select the Devices tab.
2. Click the Next Page and Last Page icons to locate the device through which you want to locate the assets to
convert.
3. Click the Name of the device.
4. Click the Networks tab for the selected device.
5. Click the Action icon next to the network you want (this automatically selects it) and select Convert from the
menu. The Edit Network dialog appears, displaying the General tab.
You need take no further action other than Save & Close to set the network as Managed.
a. If necessary, select the Disable for DHCP check box to disallow the converted network from being usable
under DHCP.

Note: The Disable for DHCP check box enables or disables DHCP for the network.

b. If necessary, click the Discovery tab and click Enable Discovery to start discovery on the network after it is
converted to Managed state. You can also elect not to discover the network, by leaving the check box clear.
4. Click Select Member to choose the Probe member through which the network may be discovered.
5. If necessary, click Override under Polling Options, and modify the device discovery polling options
for the network. You can also specify Discovery Exclusions or a Discovery Blackout period.
6. A number of associated DNS and DHCP services are also available for configuration for the new
IPAM network, including DHCP Forwarding, IPv4 DDNS settings, and an array of other DDI service
settings for the network. None of these configurations are required in order for the network to be in
Managed state, but may be required for other purposes.
6. Click Save & Close to make the conversion.
The device’s Networks page shows Yes as the value for the network under the Managed column. The network is now
under the control of IPAM and can participate in DNS and DHCP services.

Converting Unmanaged Networks under IPAM to Managed Status

Note: When you convert a network to managed status, Grid Manager uses the discovered Router IP for the network
to automatically populate the Router IP value in DHCP configurations for the selected network. Conversion for
DHCP is optional; you can choose to Disable for DHCP when you convert the network.

694 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Discovered Data

The IPAM main page lists all discovered networks as unmanaged, highlighted in yellow. Administrators cannot apply
services or IPAM objects to IP addresses in unmanaged networks until the networks are converted to managed status.
You can explore unmanaged networks through IPAM’s IP Map and IP List views, but many operations cannot be
carried out on unmanaged networks, including editing, splitting, resizing, permissions changes and many other
tasks.

Note: Unmanaged IP addresses that are part of an unmanaged network cannot be independently converted to a
managed IP address.

Unmanaged networks can be converted at the IPAM main page and at the device level under Data Management –>
Devices, selecting a device and opening the Networks page.
Under IPAM, the Managed column for the Network tables can show one of two possible states for all discovered IPAM
networks:
— No–Shows that the network is not managed under IPAM/Grid Manager, but enough information is
catalogued that the device can be converted to Managed state. This state is required before a network can
be converted to managed status.
— Yes–The network shown in the table is now Managed under IPAM, converted to an IPAM network.
You can discover the network again after it is converted, or keep discovery disabled and execute it at another time,
or impose blackout periods that limit the time windows under which discovery can execute on the network. Other
management benefits include the ability to enable Infoblox services to the network;
1. From the Data Management tab, select the IPAM tab.
2. Select an unmanaged network from the IPAM list.
3. Click the Action icon next to the network you want (this automatically selects it) and select Convert from the
menu. The Edit Network dialog appears. The Edit Network dialog appears, displaying the General tab.
You need take no further action other than Save & Close to set the network as Managed.
a. If necessary, select the Disable for DHCP check box to disallow the converted network from being usable
under DHCP.

Note: The Disable for DHCP check box enables or disables DHCP for the network.

b. If necessary, click the Discovery tab and click Enable Discovery to start discovery on the network
immediately after it is converted to Managed state. You can also elect not to discover the network, by
leaving the check box clear.
7. Click Select Member to choose the Probe member through which the network may be discovered.
8. If necessary, click Override under Polling Options, and modify the device discovery polling options
for the network. You can also specify Discovery Exclusions, port control settings, or a Discovery
Blackout period.
9. A number of associated DNS and DHCP services are also available for configuration for the new
IPAM network, including DHCP Forwarding, IPv4 DDNS settings, and an array of other DDI service
settings for the network. None of these configurations are required in order for the network to be in
Managed state, but may be required for other purposes.
4. Click Save & Close to make the conversion.
The IPAM main page shows Yes as the value for the network under the Managed column. The network is now under
management of IPAM and can participate in Infoblox services.

Note: Most conversion operations for networks and individual IP addresses are managed under IPAM and are
described in the section Managing IPv4 and IPv6 Addresses on page 608 of this Guide.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 695

Infoblox Network Insight

Converting Unmanaged Interfaces to Managed Status

Note: For convenience, a device’s Interfaces panel provides a quick filter to list only
managed interfaces for the device. When a device is converted to managed status,
interfaces in the device may remain in unmanaged state. If the interface has an IP
address that is recognized under IPAM, it may be converted to managed state.

Interfaces that appear in the Interfaces table for a device may be converted to managed status, under specific
circumstances. If an interface is bound to an IP address that is present in an IPAM network (for example, a leaf
network inside a network container under IPAM), that interface can be converted to managed status.
For any device, any interface with a hotlink to IPAM may be converted. Examples are shown in Figure 15.5.

Figure 15.5 Device Interfaces Available for Conversion

In Figure 15.5, two interfaces provide a link to their respective IPAM interface pages, and show an IPAM Type of
Unmanaged. These ports may be converted to IPAM objects and managed under Grid Manager.
1. From the Data Management tab, select the Devices tab.
2. Click the Next Page and Last Page icons to locate the device through which you want to locate the interfaces to
convert.
3. Click the Name of the device.
4. Click the Interfaces tab for the chosen device. The Interfaces page lists all ports discovered on the device.
5. Click the Action icon next to the interface you want (this automatically selects it) and select Convert –> To
Host, Convert –> To A Record, Convert –> To PTR Record, or Convert –> To Fixed Address, from the menu. The object
editor dialog appears for the chosen object type. Interfaces that are already in Managed state or are not
recognized in IPAM are not allowed this action.
a. Define the required General settings for the new object.
b. Define any further settings you need from any of the other tabs in the editor.
6. Click Save & Close to make the conversion. The interface is associated with the new IPAM object.

696 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Discovered Data

Converting Unmanaged IP Addresses to Managed Status

The principle for converting an IP address to managed status is the same for IP addresses as for interfaces. If an IP
address is unmanaged but is present in IPAM, the IP can be converted to managed status.

Figure 15.6 Converting an IP Address to Managed Status

1. From the Data Management tab, select the Devices tab.

2. Click the Next Page and Last Page icons to locate the device through which you want to locate the IP address to
convert.
3. Click the Name of the device.
4. Click the IP Addresses tab for the chosen device. The IP address page lists all ports discovered on the selected
device.
5. Click the Action icon next to the IP address you want (this automatically selects it) and select Convert –> To
Host, Convert –> To A Record, Convert –> To PTR Record, or Convert –> To Fixed Address, from the menu. The object
editor dialog appears for the chosen object type. Addresses that are already in Managed state or are not
recognized in IPAM are not allowed this action.
a. Define the required General settings for the new object.
b. Define any further settings you need from any of the other tabs in the editor.
6. Click Save & Close to make the conversion. The IP address is associated with the new IPAM object.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 697

Infoblox Network Insight

Converting Unmanaged Assets to Managed Status

1. From the Data Management tab, select the Devices tab.
2. Click the Next Page and Last Page icons to locate the device through which you want to locate the assets to
convert.
3. Click the Name of the device.
4. Click the Assets tab for the chosen device. The Assets page lists all network devices that have been detected
through connections to the current device. If the device is a switch, you may see a list of end hosts and network
servers in the list, along with any other network infrastructure devices that are neighboring the current device.
5. Click the Action icon next to the asset you want (this automatically selects it) and select Convert –> To Host,
Convert –> To A Record, Convert –> To PTR Record, or Convert –> To Fixed Address, from the menu. The object editor
dialog appears for the chosen object type.
a. Define the required General settings for the new object.
b. Define any further settings you need from any of the other tabs in the editor.
6. Click Save & Close to make the conversion. You can return to the managed object at any time to make further
configuration changes.
Under the Assets page, the listing shows Yes under the Managed column.

Viewing Discovered Devices and their Properties

Note: For information about unmanaged devices and managed devices and what their respective status means, see
Converting Unmanaged Devices to Managed Devices on page 692. You can also use the “Unmanaged devices
and networks” filter in global search to locate all the unmanaged devices and networks discovered through
discovery. For more information, see Using Global Search on page 78.

After discovery begins executing on the network, Grid Manager provides a Devices page under Data Management for
a complete list of every device that discovery finds, and lists all unmanaged and managed devices. Starting here, you
can explore a substantial body of information about the complete list of discovered and managed devices, and drill
down to specific information about every discovered and managed device. Listed devices inhabit one of three states
in the Devices page:
• Devices that appear with an empty value in the Managed column are devices that are discovered, but are
not recognized by IPAM, are not part of an IPAM network, and hence cannot be changed to managed status
in Grid Manager. These discovered devices cannot be changed to managed status, but you can perform
actions such as activating and deactivating ports, executing Discover Now on the device, view their list of
connected networks, and other actions. Avoid changing the state of ports or taking other actions on a
discovered device, unless the action is verified by an administrator.
• Device shown in yellow table rows are unmanaged devices, but are recognized by IPAM and can be
converted to managed status. Yellow rows appear with a value of No in the Managed column. You can
convert devices in table rows to managed objects under IPAM (host, fixed address, A record or PTR record);
• Devices shown in light grey table rows are managed devices, with a value of Yes in the Managed column.

Viewing the Complete List of Discovered Devices

The Data Management tab –> Devices tab provides a complete view of all discovered devices discovered by Network
Insight. The list includes routers, switches, firewalls and other security devices, wireless APs, end hosts and servers
in end-host networks. Use NIOS standard filtering to narrow down the status table to the devices or values you want
to examine.
In the viewer, click the Action icon for any table row to view the following:

698 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Discovered Devices and their Properties

• Click Show IPAM IP Address to open the IPAM status page to view records information for the Router IP
address, and information such as any IPAM/DHCP objects associated with the IP address (Related Objects)
and its recent history in Grid Manager (Audit History).
• Click Interfaces to display the complete table of interfaces associated with the network device.
• Click IPAM Networks and choose any network prefix in the list. The IP Map page appears for the chosen
network for which the device is a part.
• Click Edit to open the device editor, to change settings for interfaces on the selected device; apply
extensible attributes, or apply administrative permissions for Grid Manager admin access to a device.
• Choose Discover Now to apply discovery to a listed device to detect configuration changes, status changes
and other device information.
• Where applicable, choose Convert to change the status of an unmanaged device to managed status under
Grid Manager. (For more information, see Converting Unmanaged Networks under IPAM to Managed Status
on page 694.)
• Click Device Details to view a short list of key information about the selected device.
• Click Show Active Users to view all the active users on the Active Directory domain for the selected device.
For information, see Viewing Active Network Users on page 615.
Values listed in the Discovered Devices table include the following:
• IP Address: Detected the IP address (IPv4 or IPv6).
• Name: Detected the name of the device. Each device name provides a link to the complete body of information
associated with the device, arranged in five tabs: Interfaces, Networks, IP Addresses, Assets and Components.
For more information, see the sections under Accessing Detailed Device Information on page 701;
• Type: The network device type: Router, Switch-Router, Firewall, NIOS (Infoblox appliance), vNIOS, and others.
• Model: The model name as detected from the device during discovery.
• Vendor: The equipment manufacturer (Cisco, Juniper, Fortinet, F5, and others);
• Device Version: The Operating System version for the network device.
• Location: The physical location of the network device as detected from the device during discovery.
• Description: Verbose description of the network device as collected from the device by discovery.
• Discover Now: Indicates when the device is undergoing a current discovery process. A “Pending” icon appears
in this column to indicate the status.
• Managed: Indicates the status of the device in Grid Manager. A blank value in this field indicates the device has
been discovered but is not recognized in IPAM; a No value indicates the device is recognized by IPAM but is not
managed under Grid Manager; and a Yes value indicates that the device is fully managed by Grid Manager from
use of the Convert command and can support related features such as port reservations and IPAM/DHCP object
assignments. (For more information, see Converting Unmanaged Networks under IPAM to Managed Status on
page 694.)
• Active Users: The number of active users on the Active Directory domain for the selected IP address.
Click Discovery Status in the Toolbar to view the same list of network devices showing the discovery data set. You can
sort the table by Name or IP address. Use Grid Manager-standard filtering to isolate device names, IP addresses or
other values in which you are interested.
For each listed device, the Action icon provides the following options depending on the device type and its status:
Interfaces: Displays the Interfaces page for the chosen device. (For more information, see Viewing Networks
Associated with Discovered Devices on page 704.)
Show IPAM IP Address: Shows the Management IP address for the device that has a network in IPAM–the main IPAM
tab appears, showing details for the IP address. This option is greyed out for devices that have a management IP that
is not part of an IPAM network;
Edit: Displays the Device Editor window;
Interfaces: A direct link to the Interfaces page for the chosen device. Unmanaged devices may have managed
interfaces that appear in this page, and managed devices may have unmanaged interfaces that appear here;
Discover Now: Directs Network Insight to immediately perform discovery on the selected device;

NIOS 7.3 NIOS Administrator Guide (Rev. A) 699

Infoblox Network Insight

Convert: For devices in unmanaged status (shown in yellow), allows conversion of the device to a managed object in
Grid Manager: a host, fixed address, A record or PTR record. (For more information, see Converting Unmanaged
Devices to Managed Devices on page 692.)
Networks: A drop-down list of all IPv4/IPv6 IPAM networks currently provisioned on the device. Each network
provides a link to the IP Map page for the selected network.
Device Details: A basic list of information about the chosen device, including the IP address by which the device is
discovered, operational status, IPAM Type (whether the device is managed or unmanaged), the Device Type and the
number of Interfaces.
Show Active Users: Displays the Active Users dialog box. You can view all the active users on the Active Directory
domain for the selected device. For more information, see Viewing Active Network Users on page 615.

Viewing Discovered VRFs and Mapping Network Views

To view VRF instances (or VRFs) and map corresponding network views, do the following:
1. From the Data Management tab, select the Devices tab, and then click VRF Mapping from the Toolbar.
2. The VRF Mapping dialog appears and displays the following:
— VRF Name: The name of the VRF on the hosting device, which typically contains the interface name and its
VRF route distinguisher.
— Device Name: The discovered name of the device that is hosting the VRF.
— Device IP Address: The IP address of the managed VRF hosting device.
— Network View: The network view that is associated with the VRF. You can click this field and select a
different network view from the drop-down list.
To assign the same network view to multiple VRFs, select the check boxes of the VRFs, and then click the Edit icon.
The VRF Mapping dialog displays the Edit VRF Network View panel. From the Network View drop-down list, select the
network view you want to assign to all the selected VRFs, and then click Save. If there is only one network view in the
Grid, which is the default view, the Network View column is hidden by default.

700 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accessing Detailed Device Information

Accessing Detailed Device Information

Clicking on any device’s name in the Name column, you open a set of five tabs revealing information about the
selected device (see the following sections for details on discovered and managed devices):
The Interfaces tab (seeViewing Interface Information for Discovered Devices below);
The Networks tab (see Viewing Networks Associated with Discovered Devices on page 704);
The IP Addresses tab (see Viewing IP Addresses Associated with Discovered Devices on page 706);
The Assets tab (see Viewing Assets Associated with Discovered Devices on page 708);
The Components tab (see Viewing Components of Discovered and Managed Devices on page 710).

Viewing Interface Information for Discovered Devices

This panel lists all discovered interfaces associated with the selected device. Interfaces are detected whether they
are loopbacks, unnumbered, or numbered with one or more IP addresses. Interfaces may be listed for either managed
or unmanaged devices.
1. From the Data Management tab, select the Devices tab. The Devices Home page displays a list of all devices
currently found and catalogued by discovery.
2. Click the Action icon for a chosen device and choose Interfaces from the drop-down menu, or simply click the
device name to display the Interfaces list. Click Devices Home to return to the main Devices page.
This panel displays the following information for each interface. Note that some data may appear for some
device types and not for others.
— Name: The name of the interface (usually a switched interface) associated with the discovered device.
— Reservation: Indicates whether the port has been reserved by NIOS as part of a Port Control operation.
— IP Address: Detected IPv4 or IPv6 address of the interface.
— VRF Name: The name of the VRF associated with the interface, if applicable.
— Network View: The name of the network view to which the VRF instance belongs, if applicable. If there is
only one network view in the Grid, which is the default view, the Network View column is hidden by default.
— VRF Description: The description about the VRF instance, if applicable.
— VRF RD: The route distinguisher associated with the VRF instance, if applicable.
— MAC Address: The hardware address associated with the interface.
— Description: Port description associated with the interface, such as ge-0/0/5 or FastEthernet0/13.
— VLAN ID/VLAN Name: The data VLAN identifier and VLAN name that is bound to the interface, if applicable.
— Port Speed: Interface speed, in Mbps.
— Port Type: Type of interface as detected by NIOS Discovery. Examples include ethernet-csmacd,
propPointToPoint Serial, l2vlan, tunnel, and others.
— Admin Status: Shows whether the interface is administratively Up or administratively Down.
— Operating Status: Shows whether the interface is operationally Up or operationally Down.
— Trunk Status: Where applicable, shows the trunking status of the interface.
— Link Aggregation: Shows the state of the interface if it is part of a LAG (Link Aggregation Group).
— Status: Shows whether the interface is Used or Unused.
— IPAM Type: The object type that is associated with the IP address for the interface. Possible values can be
Lease, IPv4 DHCP Range or Fixed Address.
— Usage: Indicates whether NIOS has configured the IP address for DNS or DHCP.
— Managed: Shows whether the interface is managed under IPAM, by being associated with a managed IPAM
object such as a Fixed Address. Check the IPAM Type field for related information.
— Reservation: Indicates whether the interface has a port reservation bound to it. For information, see
Creating Port Reservations for IPAM Objects on page 723

NIOS 7.3 NIOS Administrator Guide (Rev. A) 701

Infoblox Network Insight

— Capabilities: Describes the capabilities of each interface in the selected device. Hover the mouse over each
entry to view the complete listing. For information, see Determining Interface Capabilities on page 702.
— Site: This is a predefined extensible attribute.
You can also click the Action icon next to an interface name and select one of the following to perform the
specified task:
• Edit: This option is enabled if the network is in managed state. This opens the network editor.
• Show Assets: This option is only available for switched Ethernet interfaces with no IP Address. This opens the
Assets page for the selected device, and shows a list of end host devices or neighboring linked to the interface.
Network Insight filters the asset list for the device by the interface name.
• Show Multiple IP Addresses: Opens the IP Addresses page specifically for the interface, listing all IPv4 and IPv6
addresses associated with the interface. This option appears only if the interface has IP addresses.
• Convert: Convert a network in the unmanaged state to be managed under IPAM and (optionally) DHCP. Unlike
devices and interfaces, you do not assign objects such as fixed addresses or PTR records to a managed network.
Conversion enables a network to be fully manageable under IPAM and DHCP. For more information, see
Converting Unmanaged Networks to Managed Status on page 693.
• IPAM Networks: Choosing this option lists all IPAM networks associated with the current interface.
• Device Details: A basic list of information about the chosen device, including the IP address by which the device
is discovered, operational status, IPAM Type (whether the device is Managed or Unmanaged), the Device Type
and the number of Interfaces.
You can also do the following:
• Modify some of the data in the table. Double click a row, and either modify the data in the field or select an item
from a drop-down list. Click Save to save the changes or click Cancel to exit. Note that some fields are read only.
You can modify the following fields in this table: VLAN ID/VLAN Name, Admin Status and Description.
• Sort the data in ascending or descending order by column.
• Select an interface check box and click the Edit icon to manage device properties.
• Click the Export icon to export the list of discovered devices to a .csv file.
• Click the Print icon to print the list of discovered devices.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of a device name in the Go to field and select the device from the possible matches.
• Create a quick filter to save frequently used filter criteria.

Determining Interface Capabilities

One key piece of information that Network Insight compiles from discovery involves an assessment of interface
capabilities. The Interfaces table provides a hidden column titled Capabilities with a description of the relevant
capabilities of each interface in the discovered device.
1. From the Data Management tab, select the Devices tab. The Devices Home page displays a list of all devices
currently found and catalogued by discovery.
2. Click the Action icon for a chosen device and choose Interfaces from the popup menu.
3. Click the right end of a column header and choose Columns –> Edit Columns from the drop-down menu.
4. Select the Capabilities check box and click Apply.
The text listing for the Capabilities field may be too long to display in the Interfaces table. Hover the mouse over any
table row to display the complete entry for the Capabilities field:

702 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accessing Detailed Device Information

Figure 15.7 Capabilities information for the selected interface

Critical values in the Capabilities field include the following:

• Provision IPv4 Network – Yes or No
• Provision IPv6 Network – Yes or No
• De-Provision IPv4 Network – Yes or No
• De-Provision IPv6 Network – Yes or No
• Interface has no IP Address – Appears only if no IP address is defined for the interface
• Edit Data VLAN – Yes or No
• Edit Voice VLAN – Yes or No
• Edit Admin Status – Yes or No
• Edit Description – Yes or No
The values you see in this field provide notification when you are unable to set certain values for any interface. When
discovery queries devices for their device type, OS version support and other factors, Network Insight compiles the
information into table formats that help you to determine issues or exceptions in the network.
For example, loopback interfaces are “always up” and hence do not support an Admin Status configuration and show
Edit Admin Status = No. If an interface does not have an IP address, it cannot be de-provisioned and hence shows a
De-provision Network = No. That same device may not support IP addresses or VLANs because it is only a L2 Ethernet
switch, and shows Edit VLAN = No and Provision IPv4 Network = No, among others.
If a device shows a Provision IPv4 Network = Yes and Provision IPv6 Network = No, it indicates that the device
supports only IPv4, perhaps due to OS software version.
Other cases may involve the following reasons:
• Edit Admin Status = No:
— Device not supported
— Vendor not supported
— Model not supported
— Port does not support Admin settings (Loopback, Virtual)
• Edit VLAN = No:
— Device not supported
— Device type not supported for VLAN assignment (Router, L2 switch)
— Vendor not supported
— model not supported
• Edit Voice VLAN = No:
— Device not supported
— Vendor not supported (Cisco is the only supported device type)
— Device not licensed
— Model not supported
• Provision IPv4 Network=No/Provision IPv6 Network=No:
— Device not supported
— Vendor not supported for network provisioning

NIOS 7.3 NIOS Administrator Guide (Rev. A) 703

Infoblox Network Insight

• De-Provision IPv4 Network=No/De-Provision IPv6 Network=No:

— Device not supported
— Vendor not supported for network provisioning
— Device type not supported for network provisioning (Router)
• Edit Description=No
— Device not supported
— Vendor not supported
— Model not supported

Viewing Networks Associated with Discovered Devices

To view all discovered networks associated with the selected device, complete the following:
1. From the Data Management tab, select the Devices tab. The Devices Home page displays a list of all devices
currently found and catalogued by discovery.
2. Click the Action icon for a chosen device and choose Interfaces from the drop-down menu, or simply click the
device name to display the Interfaces list. Click Devices Home to return to the main Devices page.
3. Click the Network tab. Grid Manager displays all networks to which the chosen device connects. The Networks
page uses the same conventions as the main IPAM page for network listings.
You see three types of networks in this page:
• Networks shown in grey table rows are discovered networks that cannot be added to IPAM because they do
not fit within the list of currently configured or discovered networks. (These networks are also called
Non-NIOS networks.) Grey rows appear with an empty value in the Managed column. When a network is in
this state you are limited to de-provisioning discovered networks of this type from their host device, and
viewing device details.
• Networks shown in yellow table rows are unmanaged networks, but are recognized by IPAM and can be
converted to managed status. Yellow rows appear with a value of No in the Managed column. You can
provision these networks onto devices;
• Networks shown in white table rows are managed networks, appearing with a value of Yes in the Managed
column. You can provision and de-provision managed networks.
Grid Manager displays the following applicable information for each network found on the selected device. A field is
left blank if the information is not applicable to the network.
• Network: The network IPv4 or IPv6 address.
• VRF Name: The name of the VRF associated with the interface, if applicable.
• Network View: The name of the network view to which the VRF instance belongs, if applicable. If there is only
one network view in the Grid, which is the default view, the Network View column is hidden by default.
• VRF Description: The description about the VRF instance, if applicable.
• VRF RD: The route distinguisher associated with the VRF instance, if applicable.
• Comment: Any information entered by admins about the network.
• Managed: Shows values of Yes or No for managed status.
Using the Action icon , you can perform the following tasks in the Networks page:
• Show IPAM Network: Opens the IPAM IP MAP that illustrates the IP states for all IPs in the network.
• De-provision Network: Available for managed networks that are provisioned and active on a device. Allows you
to de-provision (delete) the selected IPAM network from all devices connected to the selected network. See
Provisioning and De-Provisioning Networks on page 720.
• Edit: Opens the network editor for the selected network. This option is enabled if the network is in managed
status.

704 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accessing Detailed Device Information

• Delete: Select Delete to delete the network now or select Schedule Deletion to schedule the deletion at a later
time. Note that the deletion function allows you to de-provision the actual network from the device. By default,
when you choose Delete or Scheduled Delete, the network is de-provisioned from all interfaces listed in the
panel. Exercise caution when using this feature!
• Extensible Attributes: Provides access to the extensible attribute settings for the selected network.
• Permissions: Provides access to admin permissions settings for the selected network. This option is enabled if
the network is in managed status.
• Convert: Converts unmanaged network to a managed network in NIOS. All discovered networks on each device
are automatically listed as Unmanaged after a discovery. This means that the discovered network, though
visible, does not have its identities resolved by NIOS, nor are its IP address managed through IPAM or leased
through DHCP. After converting the unmanaged network to managed status, Grid Manager uses the discovered
router IP address to populate the same value under subsequent DHCP configurations for the network. You can
also select an unmanaged network and convert it to managed status by clicking Convert from the Toolbar.
• Device Details: Provides information about the device to which the selected network belongs. The list includes
information such as the IP Address and Device Type for the device, and in the IPAM Type field whether the
device itself is a managed or unmanaged object in NIOS. It also provides the following status counters for the
device:
— Administrative Up - Operational Up: The number of ports that are fully up and passing traffic
— Administrative Up - Operations Down: The number of ports that are administratively up, but have some kind
of connectivity issues.
— Administrative Down - Operational Down: The number of ports that are administratively taken down.
The horizontal navigation bar and the Toolbar also provide the following functions:
• Provision Network : Available for managed networks and for unmanaged networks that are recognized by
IPAM. For information, see Provisioning and De-Provisioning Networks on page 720). Clicking this icon opens
the Provision Network feature, allowing you to provision the network onto the actual device by selecting a
device interface, and enabling DHCP Forwarding and/or assigning a VLAN. Grid Manager creates a new port
control task under Task Manager, and you can choose the interface on which the network is provisioned, along
with VLAN configuration and other settings.
• De-Provision Network : Available for discovered networks that are not visible under IPAM. A dialog box
appears summarizing the task.
• Show Active Users: For Microsoft Management only. Displays the Active Users dialog box. You can view all the
active users on the Active Directory domain for the selected device. For more information, see Viewing Active
Network Users on page 615.

Modifying Networks
Grid Manager enables the user to edit select DHCP configurations, including the following:
IPv4 DHCP Options/IPv6 DHCP Options: DHCP options provide specific configuration and service information to DHCP
clients. For more information, see About IPv4 DHCP Options on page 1078.
DHCP Forwarding: Enables routers connecting multiple networks to act as a silent DHCP relay and forward DHCP
packets between them. The DHCP Forwarding page lists the interfaces on the currently selected network on which
DHCP Forwarding is enabled. If more than one device on the selected network also enables DHCP Forwarding, they
also appear here. DHCP Forwarding configuration involves simply enabling or disabling the service for a network
endpoint on the device. In order for DHCP forwarding to work, you must restart the DHCP service on the Grid member
that is serving the network; If you run DHCP service on both LAN1 and LAN2 of the Grid member, then both addresses
are written to the device.
1. From the Data Management tab, select the Devices tab.
2. Click the Name link for the device you want to inspect.
3. Click the Networks tab.
4. Click the Action icon for a network in the table, and choose Edit. This feature is enabled only for networks
that are managed under IPAM.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 705

Infoblox Network Insight

5. Click the DHCP Forwarding tab.

6. Select the check box for any listed instance and do the following if necessary:
• Click Configure. Grid Manager queries you to confirm that DHCP Forwarding are configured on the selected
network (A task will be created to configure DHCP forwarding for this network on these devices:
<device_name>. You can view the execution log for the task in the Task Manager to see the results).
• Click Delete to remove the selected DHCP Forwarding instance from the network.

Figure 15.8 DHCP Forwarding confirmations

7. Click Yes to confirm the activating or deletion of DHCP forwarding on the selection, or No to reject the change.
8. Click Save & Close.

Viewing IP Addresses Associated with Discovered Devices

You can view the complete list of discovered IP addresses bound to all interfaces for any device, discovered and
managed devices alike.

Note: One useful trick for interfaces is to pick out an interface from the Interfaces page that has multiple IPs and open
the IP Addresses tab; or sort the IP addresses table by its IP Address column, and locate the interface name
that bears multiple IPs. Frequently, an interface with multiple addresses can have IPv4 and IPv6 addresses
bound to it. Loopbacks are another example.

1. From the Data Management tab, select the Devices tab. The Devices Home page displays a list of all devices
currently found and catalogued by discovery.
2. Click the Action icon for a chosen device and choose Interfaces from the drop-down menu, or simply click the
device name to display the Interfaces list. Click Devices Home to return to the main Devices page.
3. Click the IP Addresses tab. Grid Manager displays all IP addresses associated with the chosen device.
Grid Manager displays the following information for each IP address:
— IP Address: The IP address for each discovered interface as managed by NIOS and IPAM. The table supports
IPv4 and IPv6 values. Each IP address is a link to the home IPAM page for the interface. If an IP address
does appear but is not a link, this indicates the discovered IP is not recognized under IPAM.
— VRF Name: The name of the VRF associated with the interface, if applicable.
— Network View: The name of the network view to which the VRF instance belongs, if applicable. If there is
only one network view in the Grid, which is the default view, the Network View column is hidden by default.
— VRF Description: The description about the VRF instance, if applicable.
— VRF RD: The route distinguisher associated with the VRF instance, if applicable.
— Interface Name: The name of the interface (usually a switched interface) associated with the discovered
device.
— MAC Address: The hardware MAC address associated with the interface.

706 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accessing Detailed Device Information

— VLAN Name/VLAN ID: The data VLAN name and VLAN identifier to which the interface is
bound, if applicable. In most cases, you see both the VLAN name and the VLAN ID as two
values in the same field. Multiple VLAN entries may be present for an interface or IP
Address.Some interfaces may have a large number of associated VLANs. By default,
Network Insight does not automatically show all of them, instead providing a Show all... link for reference
within the table cell. All VLAN ID/VLAN name values appear within the table cell, with a Hide... link provided
to shorted the list back to original length.
— Admin Status: Lists whether the interface is administratively Up or administratively Down.
— Operation Status: The operational status of the interface (operationally Up or operationally Down).
— Managed: Indicates whether or not the IP Address is managed by Grid Manager. If the IP address is
unmanaged, you will be able to Convert the IP address to an Object that is managed by Grid Manager.
— Site: This is a predefined extensible attribute.
Extensible attributes may also appear in this table.
4. Click the IP Address link for any interface to open the Related Objects page for the chosen port.
Click the Action icon next to an IP address and select one of the following to perform the specified task. Note that
some of these actions are not applicable to the IP address.
• Edit Interface: Opens the interface general settings page. You can view and modify basic interface settings such
as Admin Status (on the General page), Data VLAN and Voice VLAN (on the VLAN page), and add or modify
extensible attributes.
• Convert: Depending on the address type and its IPAM status, you may be able to convert the selected IP to a
Host Record, A Record, PTR Record or a Fixed Address. Otherwise, Grid Manager shows This object cannot be
converted. You can also perform the same action by selecting an IP address check box and clicking Convert from
the Toolbar.
• Device Details: Provides information about the device to which the selected IP address belongs. The list
includes information such as the IP Address and Device Type for the device, and in the IPAM Type field whether
the device itself is a managed or unmanaged object in NIOS. It also provides the following status counters for
the device:
— Total Available Interfaces: The total number of interfaces associated with the device.
— Administrative Up - Operational Up: The number of ports that are fully up and passing traffic
— Administrative Up - Operations Down: The number of ports that are administratively up, but have some kind
of connectivity issues.
— Administrative Down - Operational Down: The number of ports that are administratively taken down.

Viewing Router Redundancy Information

Some discovered devices may support router redundancy. After discovery, some IP addresses are indicated as a VIP
(virtual IP) in the device’s IP Addresses page with router redundancy. In the IP List page, Router Redundancy in the
Action icon menu lists the IP addresses associated with the VIP. For each IP, there are various menu items as
shown in Figure 15.9:

Figure 15.9 Virtual IPs and discovered redundancy information

— Active: lists the active interface in the redundancy pair;

— VIP: The Virtual IP for the router redundancy pair;

NIOS 7.3 NIOS Administrator Guide (Rev. A) 707

Infoblox Network Insight

— Standby: The standby IP interface for the router redundancy.

Discovery of all three IP components of the Router Redundancy instance also provides related information for all
three IP entities:
— Show IPAM Address: opens the IPAM page to the listed IP address;
— VIP: Opens the virtual interface in the host device’s Interfaces page;
— Device name: The third item lists the device name of the router for each of the three IP address entities
comprising the redundancy instance. The currently active router is identified with the Active and VIP
objects; the second Standby router is identified with the Standby IP address.

Viewing Assets Associated with Discovered Devices

During discovery, Network Insight classifies end hosts and any other devices connected to switchport interfaces as
“Assets” directly associated with each discovered interface. On the device level, the Assets page shows all network
devices reachable by the selected network device, including switchports supporting end hosts. In practice, most
Asset tables show end hosts and devices that populate Ethernet network segments.
The Assets table lists all managed end hosts and application servers detected through discovery and identity
resolution by Grid Manager, that are connected to each network infrastructure device. The records listed in this table
date from the Last Seen discovery time stamp of each end host or other device. In many cases, you see neighbor
devices to the current device appearing on this page.
To view assets associated with discovered devices:
1. From the Data Management tab, select the Devices tab. The Devices Home page displays a list of all devices
currently found and catalogued by discovery.
2. Click the Action icon for a chosen device and choose Interfaces from the drop-down menu, or simply click the
device name to display the Interfaces list. Click Devices Home to return to the main Devices page.
3. Click the Assets tab. Grid Manager displays all assets associated with the chosen device.

Note: The list of assets at this level may include devices that are trunked to the current device, including
end-user host computers or routers and switch-routers neighboring the currently selected device.

Grid Manager displays the following information for each asset:

— Name: The asset name on the network as discovered by Grid Manager. If the name is that for another
infrastructure device, you may click on it to see its associated assets.
— Interface Name: The name of the interface (usually a switched interface) associated with the discovered
device.
— VRF Name: The name of the VRF associated with the interface, if applicable.
— Network View: The name of the network view to which the VRF instance belongs, if applicable. If there is
only one network view in the Grid, which is the default view, the Network View column is hidden by default.
— VRF Description: The description about the VRF instance, if applicable.
— VRF RD: The route distinguisher associated with the VRF instance, if applicable.
— IP Address: The IP Address for each discovered asset as managed by NIOS and IPAM. The IP address is a
link to the home IPAM page for the interface.
— Type: The type of device. Infrastructure devices such as routers and switches may also be categorized as an
Asset.
— Username: The User Name for the asset, as defined from the host’s DHCP lease.
— Asset MAC Address: The hardware MAC address associated with the asset.
— VLAN Name/VLAN ID: The VLAN identifier from which the asset is reachable.
— Admin Status: The administrative status (Up or Down) of the management port that identifies the asset
device.
— Operation Status: Normally reads Up or Down. Asset records may appear as Down because they are
disconnected from the network or being rebooted.

708 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accessing Detailed Device Information

— Managed: Indicates whether the asset is managed by NIOS.

— Reservation: Indicates whether the interface has a port reservation bound to it.
— Capabilities: Describes the capabilities of each interface in the selected device. Hover the mouse over each
entry to view the complete listing.
— Site: This is a predefined extensible attribute.
Using the Action icon , you can perform the following tasks in the IP Addresses page:
• Edit IPAM Object: For managed objects, this opens the editor for the object so you can modify its properties.
• Edit Interface: Opens the interface general settings page. You can view and modify basic interface settings such
as Admin Status (on the General page), Data VLAN and Voice VLAN (on the VLAN page), and add or modify
extensible attributes.
• Show IPAM IP Address: Shows discovered data, related objects, and audit history of the selected asset. This
option is disabled for devices that have a management IP that is not part of an IPAM network. Discovered data
may or may not appear for the asset, depending on the device type.
• Convert: Depending on the asset type and its IPAM status, you may be able to convert the selected asset to a
Host Record, A Record, PTR Record or a Fixed Address. Otherwise, Grid Manager shows This object cannot be
converted. You can also perform the same action by selecting an IP address check box and clicking Convert from
the Toolbar.
• Device Details: Provides information about the device to which the selected IP address belongs. The list
includes information such as the IP Address and Device Type for the device, and in the IPAM Type field whether
the device itself is a managed or unmanaged object in NIOS. It also provides the following status counters for
the device:
— Total Available Interfaces: The total number of interfaces associated with the device.
— Administrative Up - Operational Up: The number of ports that are fully up and passing traffic
— Administrative Up - Operations Down: The number of ports that are administratively up, but have some kind
of connectivity issues.
— Administrative Down - Operational Down: The number of ports that are administratively taken down.

Viewing Assets Associated with an Interface

You can narrow down an Asset list to individual interfaces on any managed network device. On the interface level, the
Assets page shows all devices associated with the chosen interface, including switchports supporting many end
hosts. In practice, most Asset tables show end hosts and devices that populate Ethernet network segments.
1. From the Data Management tab, select the Devices tab.
2. Click the Name link for the device you want to inspect.
3. Click the Action icon for an interface in the table, and choose Show Assets. (Applies only to switched
interfaces that do not have an IP address.)
Values listed in the Assets table include the following:
• Name: The asset’s name on the network as discovered by Grid Manager. If the Name is that for another
infrastructure device, you may click on it to see its associated Assets.
• Interface Name: The name of the interface (typically a switched interface) associated with the asset (by which
the asset was discovered).
• IP Address: The IP Address for each discovered end host as managed by IPAM. The IP address is a link to the
home IPAM page for the interface.
• MAC Address: The hardware MAC address associated with the asset.
• VLAN ID/VLAN Name: The VLAN identifier from which the asset is reachable.
• Operation Status: Normally reads Up or Down. Asset records may appear as Down because they are
disconnected from the network or being rebooted.
In the Interfaces page, if you select an interface for a switch that is only connected to a neighboring switch, router, or
switch-router, and then choose Show Assets, the Assets page displays only the neighboring device that is reachable
from the chosen port.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 709

Infoblox Network Insight

Viewing Components of Discovered and Managed Devices

Network Insight provides a table of hardware components for each discovered/managed network device.
Elements listed in the Components table include the following:
• Name: The discovered name of the device component.
• Description: The description string associated with the component. In many cases, this value is the same as the
Name field.
• Class: Type of component. Possible values include, but are not limited to, Port, Power Supply, Fan, Module,
Stack, RoutingEngine, powerEntryModule, Chassis, and more, based upon the collected SNMP data.
• Serial Number: The discovered vendor serial number for the component.
• Model: Describes the model number or model name of the component, based upon collected SNMP data.

Note: Click Device Details in the Toolbar to view information about the device, including its IPAM Type and the
operating status of its ports.

Viewing Discovery Status

Note: Opening Discovery Status for viewing requires Superuser permissions under Grid Manager.

You can view a list showing the complete Discovery status of all device or of selected devices.
To isolate devices for evaluation, use filtering to reduce the list. Click Use Filter at the top of the table and choose IP
Address, Name or Overall Status as the filter.
1. From the Data Management tab, select the IPAM tab. The IPAM Home page appears.
2. Expand the Toolbar and click Discovery Status.
The same Discovery Status button can be found under Data Management –> Devices.
The Discovery Status table lists detailed information about network devices and end hosts discovered through
all methods, including SNMP, ICMP ping sweeps and other processes.
• IP Address: the IPv4 or IPv6 address of the discovered device. You can filter the table by this value.
• Name: The name of the discovered device as reported through SNMP. You can filter the table by this value.
• Type: The discovered device type. Examples include Router, NIOS, Switch-Router, Firewall, Load Balancer,
and numerous others.
• Overall Status: Indicates the overall success or failure of the discovery task on the device. Hover the mouse
over the device to see more detailed information about the discovery status, including the timestamp of the
last discovery event, confirmation of detection (“Device Exists”), and the means of detection, which are
usually methods such as SNMP, reading the ARP table or location through a Seed router. You can filter the
table by this value.
• Reached Status: Indicates the reachability of the discovered device. Typically, devices are reported Passed
for Reached Status if they are reachable through SNMP, a path trace through ICMP, or UDP-based path
tracing for an IPv6 address.
You may see a Reached Status of Passed and still receive an Overall Status of Failed. This often occurs
because either the CLI credentials or SNMP credentials provided for discovering the device do not work, or
another problem occurs in some part of the discovery process.
• SNMP Collection Enabled: Indicates whether the managed device allows SNMP as a management protocol.
This value shows Yes or No. You do not see any SNMP collection status updates if this value shows No.

710 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Discovery Status

• SNMP Credential Status: Indicates whether the correct SNMP credential is used by discovery. Usually shows
simple Passed or Failed status. Passing the mouse over the Failed status reading for this column shows the
location in the SNMP data collection where information gathering failed. The typical message for a failure of
this type typically shows Failure to Authenticate, which simply means that the correct SNMP credentials
have not been provided for either SNMPv1, SNMPv2c or SNMPv3 as required and defined for the device’s
discovery configuration.
If SNMP Credential Status shows Failed, you do not see a value under SNMP Collection Status, because that
is dependent on successful credential authentication. Should you succeed in SNMP Credential
Authentication for a device, this value shows Passed.
• SNMP Collection Status: Indicates whether managed device information has been successfully collected
from the device. If the current device shows an SNMP Credential Status of Failed, this field remains blank.
Should you succeed in SNMP Credential Authentication, SNMP Collection Status may or may not show a
Passed outcome. If the final outcome is successful, passing the mouse over the table value shows the
SNMP data set that was successfully collected from the device.
• CLI Credential Status: Reports the basic success state of CLI credential usage for device discovery. When
you see a Failed status in this column, hover the mouse over the table value. Details related to failed CLI
credentials normally relate to “Failed to Authenticate” events. (For more information, see the following
subsection Analyzing Discovery Status.) If you define device discovery requirements to use both SNMP and
CLI, and you receive complete SNMP discovery information but fail to authenticate for CLI, the Overall
Status for the device remains as Failed.
• CLI Collection Enabled: indicates the CLI collection configuration state for the discovered or managed
device. Possible values are Yes (CLI collection is enabled) or No (CLI collection is disabled for the device).
• Fingerprint Status: Shows the status of discovery of the device’s OS through fingerprinting.
• Last Update: Timestamp showing the conclusion of the last data update for the current device.
• First Seen: Timestamp showing the initial discovery event.
• Last Seen: The date and time when the device was last successfully polled by discovery.
• Last Action: The last action performed by discovery upon the device after the discovery took place. Hover
the mouse over this field to obtain details.
Visible columns can be changed in the Discovery Status window. At the top of any column header, click the down
arrow tool, and choose Columns – > Edit Columns.

Analyzing Discovery Status

When you see a status of Failed for a device under Overall Status, the problem usually relates to issues in discovery
data collection. When Overall Status shows a value of Passed, it indicates that everything has passed for the device.
If the value is Failed, it indicates that one or more elements of the device have failed discovery. Your discovery
settings have a great deal to do with what you see in the respective Status columns. You key on the Overall Status
result and read columns to the right to narrow down possible causes. To start, you typically see three basic discovery
credential configurations for network devices:
• SNMP credentials and no CLI credentials;
• SNMP credentials and CLI credentials;
• No SNMP credentials, CLI credentials only.
Begin by considering SNMP-only device discovery configurations. In the table, Overall Status shows only a simple
Failed message with no detail. Go to the next data column, which is Reached Status. If the device proves reachable,
this value shows Passed, indicating that discovery can successfully reach and query the device. If Reached Status
shows Failed, this is the first and most fundamental problem, that the device cannot be Pinged or contacted in any
way across the network.
As an example, assume a Reached Status value of Passed. If the device is reachable, discovery can successfully
attempt SNMP or CLI communication to the device. Beginning with SNMP, and assuming that SNMP collection is
enabled, select the SNMP Credential Status counter. If it shows Failed, that normally indicates a Failure to
Authenticate, which can be shown as a tooltip by hovering the mouse over the table field:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 711

Infoblox Network Insight

A successful authentication also shows which protocol was used for SNMP authentication; SNMPv1, SNMPv2c or
SNMPv3. This does not guarantee successful data collection through SNMP, however.
The SNMP Collection Status counter shows possible Passed and Failed values. Hovering the mouse over a Failed
value in this column shows a tooltip reporting the set of data that discovery could not collect through SNMP. When
discovery encounters an error during collection of a specific data set (Forwarding table, or System identification data,
for example), data collection stops and issues an error message and an SNMP trap, which is reported and also
appears in the tooltip. If SNMP Collection Status shows a value of Passed, and discovery does not use CLI data
collection on the device, discovery has successfully completed on the device.
The CLI Credential Status counter also reports either Passed or Failed results, and uses tooltips to tell the user what
is going on in more detail.

CLI credentials failure messages are straightforward and can be tested by verifying login tuples or Enable passwords
from the credential sets defined in discovery configuration.
If you receive a CLI Credential Status value of Passed, the correct command-line admin login information is specified
in the discovery configuration.
For more information about checking and diagnosing discovery behavior for devices listed in the status table, see the
following topic Executing Discovery Diagnostics.

Executing Discovery Diagnostics

You can execute a discovery diagnostic to help determine why a specific device is presenting difficulties in discovery.
For example, a given device may be reachable but show an overall status of Failed in the Discovery Status dialog. A
discovery diagnostic steps through a complete discovery process based on the configuration on the Probe member
to which the device is assigned. The diagnostic runs the gamut from fetching SNMP object ID information to ARP table
reading and to ICMP pings and traceroutes.
Note that you must be a superuser to perform a discovery diagnostic.
To execute a discovery diagnostic, complete the following:
1. From the Data Management tab, select the IPAM tab, and then click Discovery Diagnostics from the Toolbar.
2. In the Discovery Diagnostic editor, complete the following:
— IP address: Enter the IPv4 or IPv6 address of the device on which you want to perform the test. The
discovery diagnostic runs a full discovery procedure against the specified IP address. Ensure that you select
the respective network view in which this IP address resides.

712 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Disabling Discovery for a Network

— Network View: If you have multiple network views, select the network view in which the IP address resides
from the drop-down list. If you have only one network view, which is the default view, the Network View
drop-down list is hidden by default. NIOS conducts a discovery diagnostic for the IP address in the selected
network view.
— Community String: Specify the community string for the device if the required SNMP credential is not
currently configured for the discovery member. It may not be necessary to enter a community string if the
device is already discovered by NIOS and is a managed device.
— Force Test: To force a diagnostic against the device, select Yes.
3. Click Start to start the discovery diagnostic. The lower pane displays the complete discovery sequence for the
chosen device, and whether or not the discovery is successful. You can click Stop at any time to end the
diagnostic sequence.
The output log of the diagnosis is displayed in the lower pane, and it shows the attempt for the complete discovery
process. You can click Select All to select the complete text in the lower pane for copying and pasting to the Clipboard
and a text editor. You can also monitor the test messages in this pane.

Viewing the Management State of IPs in Discovered Networks

You can view the management state for any IP address, in any network, that is associated with any discovered device.
1. From the Data Management tab, select the Devices tab. The Devices Home page displays a list of all devices
currently found and catalogued by discovery.
2. Click the Action icon for a chosen device and choose Networks from the popup menu.
3. Choose a network from the list. Grid Manager switches to the IPAM page view of the selected network.
The IPAM Home page displays the IP Map for the chosen network. The page shows information in graphical
format, indicating elements such as Used Addresses, fixed addresses and IP reservations, Unmanaged IPs,
Host Not in DNS/DHCP, and all other objects or information associated with IP management. The user benefits
from this view by immediately seeing which IPs in the network contain devices that remain unmanaged by Grid
Manager. These Unmanaged IP values appear in light yellow. Hovering the mouse over any IP address in the
graphical table shows the information that has already been determined about the IP address.

Note: An Unmanaged IP cannot be converted to Managed unless the network that contains it, is converted to
managed status. For more information, see Converting Unmanaged Networks under IPAM to Managed
Status on page 694.

Disabling Discovery for a Network

You go to the DHCP feature under Data Management to disable discovery for a network. Disabling discovery for a
network differs from discovery blackouts; disabling discovery for a network simply ensures that discovery never takes
place on the chosen network.
To disable discovery for an IP network:
1. Select a managed network from one of the following locations:
a. Data Management –> IPAM –> list view
b. Data Management –> DHCP –> Networks
2. Click the Action icon next to the network you want (this automatically selects it) and select Edit from the
menu. The Network editor appears.
3. Click the Discovery tab.
4. Child networks inherit their discovery default settings from their parent networks. Click Override to change the
Enable Discovery setting. (The Discovery Member setting remains unchanged.)
5. Deselect the Enable Discovery check box, and then save the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 713

Infoblox Network Insight

Adding Discovery Device Support

Note: Adding Device Support Bundles, viewing and deleting them requires Superuser permissions.

Infoblox frequently provides support files for additional network devices that may not previously be supported by
discovery, and updates to support new operating system versions of existing devices. To add device support updates:
1. From the Grid tab, select the Device Support tab.
2. Expand the Toolbar and click Add.
3. Click Select and navigate to the file you want to upload.
4. Select the file, and then click Upload.
The Device Support table shows its installed library of files with the following data points:
• Name: The descriptive device name for the device support file.
• Version: The version of the currently active device support file.
• Author: The developer of the device support file.
• Type: The Type column lists two types of Device Support files: the System type indicates a support bundle that
is installed with the NIOS/Grid Manager system. The Downloaded type indicates device support bundles that
are installed by the administrator.
System bundles are read-only and cannot be removed or overwritten by administrators.
You may remove custom support bundles that you have installed on the Device Support Page. To do so, click the
Action icon for a chosen device and choose Delete from the popup menu.

Port Control Features in Network Insight

Note: Port control involves two primary operations: network provisioning/de-provisioning and port configurations.
These operations are classified as port control tasks that can be monitored and viewed in the Task Manager
(Administration –> Workflow –> Task Manager).

Port control enables changes to the interface-level configurations of switches and switch-router devices, and
assignment of these resources to network objects defined and created within IPAM.
• Port configurations and network provisioning and de-provisioning use CLI admin credentials, supporting
SSH and Telnet. You may test credentials before use, against an IP address or a selected device;
• Port configuration consists of two primary operations: setting admin status for a port, and defining Data
VLAN and Voice VLAN assignments (where applicable), along with minor changes such as editing
descriptions;
• You can define port configuration blackout periods using the same methods provided for discovery
blackouts. These blackout periods also apply to network provisioning and de-provisioning tasks;
• Configuring a port on a device always creates a new port control task that can be viewed and managed in
the Task Manager.
• You can separately schedule port control tasks using the same method as for object creation.
• You can edit multiple interfaces at a time (see Editing Multiple Interfaces on page 717).
• You can edit interfaces, inline, from the Interfaces, IP Addresses and Assets pages in Grid Manager. These
operations generally consist of setting the interface to be Administratively Up or administratively Down, and
VLAN assignments (see Inline Interface Editing on page 719);
Network provisioning includes the following:
• If a user deletes a discovered network from the system, Grid Manager displays the list of interfaces on
which the network is currently provisioned;

714 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Port Control Features in Network Insight

• Network provisioning allows you to provision a network on one interface at a time. The network must be in
managed status under IPAM;
• The user can also de-provision a network, which removes it from one or more interfaces;
• You can perform network provisioning and de-provisioning tasks on routers and switch-routers.
Devices do not have to be in managed state for some port control operations (setting ports to Admin Up and Admin
Down, for example) but some port control operations require it:
• Provisioning a network (through IPAM) onto a port on a managed device;
• De-provisioning a network.
When you create a new object using the wizard, you can configure the port or ports that are associated with the
object’s port reservation. In this case, two new tasks are created: an object creation task, and a port control task,
which can be scheduled separately from the object creation. The port control task is a separate task that may also
require administrator approval. When you create a new task, an information feedback panel provides a link to the
port control task in the Task Manager.
You may also select and reschedule both tasks. For more information, see Rescheduling Tasks on page 92.

Note: If you edit an object, you can only edit an associated port reservation.

Objects are completed in their configuration by Grid Manager before executing a port configuration.
If, for example, a fixed address object is subject to administrative approval, no port control task takes place for that
object until the approval is executed and the object is created. This has implications for scheduling: if you schedule
the creation of a new host, IPv4 reservation or fixed address, and wish to schedule a port control task for the same
object, the scheduled object creation must take place first, and must complete, before the scheduled port
configuration executes.
All port configuration operations can be scheduled and subject to administrator approval. For more information, see
Configuring Approval Workflows on page 94.

About Port Reservations

You can define a device port reservation for a defined object such as a host, fixed address or IPv4 reservation, or for
an Infoblox Grid Member. Port reservations assign device interfaces to Infoblox-managed objects in Grid Manager.
The port reservation is a property of each object, such as a fixed address or host record, that you create.
After discovering and cataloguing infrastructure devices, Grid Manager compiles the lists of interfaces and separately
tracks available switch ports on each device. When you attempt to reserve a switch port, Grid Manager provides the
complete list of available switch ports on the device, automatically preventing possible conflicts over port usage.
Characteristics of port reservations include the following:
• Device Ports can be reserved to Grid Manager objects under IPAM and DHCP;
— The user can choose to immediately create the new object (IPv4 reservation, IPv4/IPv6 fixed address or
host, or a Grid member), and to also immediately assign a device port to the object. In such cases, the
object is created and the port is reserved for the object;
— An object can be scheduled for creation at a later time, and its port assignment scheduled for the same
time, or for a different date and time, in the future;
— A port reservation does not guarantee that the switch interface is in fact available for the assignment.
• You can create port reservations for multiple objects at a time;
• Interface tables show the objects to which they are bound, in a special Reservation column;
• When you delete an IPAM object such as a fixed address, its associated port reservation is automatically
deleted.
Once a switch port or other device port is reserved, Network Insight prevents future tasks from trying to use the same
port for another reservation.
Device switchports and router interfaces, and other interface types may be assigned to the following types of objects:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 715

Infoblox Network Insight

• Grid members (including HA Pairs). For more information, see the following sections Defining Port
Reservations for an Infoblox Grid Member on page 726 and Defining Port Reservations for an HA Pair on
page 726.
• Hosts. For more information about defining hosts with included port configuration, see Adding Host
Records on page 579.
• IPv4 reservations. For more information, see Adding IPv4 Reservations on page 1131.
• Fixed addresses (IPv4 and IPv6). For more information, see Adding IPv4 Fixed Addresses on page 1126 and
Adding IPv6 Fixed Addresses on page 1171.
• IP networks (IPv4 and IPv6). For more information, see Adding IPv4 Networks on page 1111 and Adding
IPv6 Networks on page 1161.
Devices involved in these operations must be under managed status in Grid Manager. For more information, see
Converting Unmanaged Devices to Managed Devices on page 692.

Editing Interfaces in a Device

Note: Voice VLAN settings are applicable only for Cisco devices.

To speed port configuration workflows, you can select one interface or multiple interfaces for a device to change the
admin status, description and VLAN settings. For example, this feature is handy if you want multiple interfaces to
participate in the same data VLAN. There are two ways to approach this feature: directly from the Devices page, or by
selecting a device on the Devices page, opening its Interfaces page and selecting ports from there.
Editing interfaces is done from the main Data Management –> Devices page.
1. From the Data Management tab, select the Devices tab.
2. Click the Action icon for a chosen device and choose Interfaces from the popup menu.
3. Select the check box for a specific interface, click the Action icon for the interface and choose Edit. The
interface editor appears as shown in Figure 15.12.

Figure 15.10 Interface Editor, with editable Admin Status and Description settings

4. The editable settings are Admin Status (Up or Down) and Description (click inside the field to edit). In some
cases, owing to device permissions, the device type or other device settings, you may not be able to edit these
values for the selected interface.

716 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Editing Interfaces in a Device

5. To edit VLANs for the chosen interface, click the VLAN tab. Figure 15.12 shows an example. VLAN editing also is
subject to permission limitations based on the device, and on the device type.

Figure 15.11 Editing VLANs

6. Choose a data VLAN to assign to the port from the Data VLAN drop-down menu.
7. If supported, choose a voice VLAN (Cisco only) from the Voice VLAN drop-down menu.
8. Click the Extensible Attributes tab to add any attributes that are necessary for the interface.
9. Click Save & Close to close the interface editor.

Editing Multiple Interfaces

To edit multiple interfaces for a device:
1. From the Data Management tab, select the Devices tab.
2. Click the Action icon for a chosen device and choose Interfaces from the popup menu.
3. Select the check boxes for each interface that you want to edit.
4. Expand the Toolbar and click Edit. The Interfaces editor appears as shown in Figure 15.12.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 717

Infoblox Network Insight

Figure 15.12 Editing Multiple Interfaces

You can select one or more interfaces for configuration, define their settings in the dialog, and then select other
interfaces and define different settings for them.

Note: Once you change Admin Status, Data VLAN or Voice VLAN settings for any selected port, no automatic
eversion exists to the original settings from the same editing session. You must cancel out of the
Interfaces editor to reject any changes and begin with a new editing session from the Interfaces page.
Use the Verify button to verify your changes.

5. Select the check boxes for one or more ports and define the Port Configuration settings for the following:
a. Admin Status: Select Up or Down from the menu, depending on the current state of the port(s);
b. Description: Provide a brief description of the port configuration or other information;
c. Data VLAN: (Hidden if editing a VLAN is not supported) Drop-down list of all data VLANs actively configured
in the current device. One of the values can be chosen for the currently select interface(s);
d. Voice VLAN: (Hidden if editing a voice VLAN is not supported) Drop-down list of all voice VLANs actively
configured in the current device. One of the values can be chosen for the currently select interface(s).
6. After making configuration changes to all ports, click Verify to check over your changes:

Figure 15.13 Verifying port configuration changes

7. Click OK. The changes are not committed by doing so.

718 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Editing Interfaces in a Device

8. If the port configuration changes are correct, click Save & Close or click the Scheduling icon at the top of the
editor. To schedule this task, click the Schedule icon at the top of the editor. In the Schedule Change panel, click
Later, and then specify a date, time, and time zone. The Schedule icon is green when there is a pending
scheduled task. You can reschedule the task if you have the applicable permissions.
When you complete the configuration, all port configurations in the session are combined into a single task by Grid
Manager.

Editing Multiple Interfaces from the Devices Page

The Data Management –> Devices page allows you to immediately set the Admin Status, descriptions and VLAN
settings for any selection of ports on a single device.
1. Click the Action icon for a chosen device and choose Edit from the popup menu.
The Interfaces page appears for the device editor.
2. Select the check boxes for one or more ports and define the Port Configuration settings for the following:
a. Admin Status: Select Up or Down from the menu, depending on the current state of the port(s);
b. Description: Provide a brief description of the port configuration or other information;
c. Data VLAN: (Hidden if editing a VLAN is not supported) Drop-down list of all data VLANs actively configured
in the current device. One of the values can be chosen for the currently select interface(s);
d. Voice VLAN: (Hidden if editing a voice VLAN is not supported) Drop-down list of all voice VLANs actively
configured in the current device. One of the values can be chosen for the currently select interface(s).
3. After making configuration changes to all ports, click Verify to check over your changes.
4. Click OK. The changes are not committed by doing so.
5. If the port configuration changes are correct, click Save & Close or click the Scheduling icon at the top of the
editor. To schedule this task, click the Schedule icon at the top of the editor. In the Schedule Change panel, click
Later, and then specify a date, time, and time zone. The Schedule icon is green when there is a pending
scheduled task. You can reschedule the task if you have the applicable permissions.
When you complete the configuration, Network Insight combines all port configurations in the session into a single
task.

Inline Interface Editing

You can directly edit a device’s interface listings in the Interfaces page. Double-click any table row and the fields that
you can edit for the row, which consist of the VLAN ID, Admin Status and Description fields for each interface, open
in an inline editing selection field.
Fields are editable as applicable to device types. If you are editing an interface on a L2 switch, for example, the VLAN
ID field does not appear.

Figure 15.14 Editing Interface values inline.

Double-clicking a table row opens the editable fields for the selected record.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 719

Infoblox Network Insight

If editable fields are not present in the table display, you cannot change their values in the Interfaces page.
After making inline changes, click Save on the selected row to commit them. To prevent using any changes, click
Cancel. This also de-selects the row.

Note: When you make inline changes to an interface, a new task is created under Grid Manager,
which you can view in the Task Manager page (for more information, see Viewing Tasks
on page 82). A status icon appears next to the interface element you have changed,
indicating the status of the new task and providing a link to the Task Manager page. New
tasks appear with a status icon of Pending (||). When the new task completes, the icon
changes to a green checkmark.

Provisioning and De-Provisioning Networks

You may provision networks and remove or de-provision networks from individual devices. You can also provision
networks when creating a network in IPAM (for more information, see Adding IPv4 and IPv6 Network Containers and
Networks on page 585). Network provisioning and de-provisioning comprises the second type of port control tasks
under Network Insight. Provisioning a network involves creating a new network and adding it to the list of networks
in IPAM, and also involves changes to device configuration.

Note: If a port control task requires administrative approval, and it is not approved before its scheduled execution,
the task appears as unsuccessful in Task Manager.

Provisioning networks also allows for provisioning VLANs. If devices do not support VLANs, options for provisioning
VLANs do not appear for those devices and their associated interfaces.
If a network is already provisioned for an interface, regardless of its status under Grid Manager, you cannot provision
another network upon it.
Only available interfaces that support network provisioning are shown in Grid Manager for provisioning tasks.
The horizontal toolbar also provides related functions:
Provision Network : Available for discovered devices and for managed devices, this icon opens the Provision
Network feature, allowing you to provision an existing IPAM network onto the selected device by selecting a device
interface or assigning a VLAN. Grid Manager creates a new Port Control task, and you can choose the interface on
which the network is provisioned, along with VLAN configuration and other settings.
De-provision Network : Available for networks that are managed under IPAM, for de-provisioning on devices that
are managed under IPAM on the Data Management –> Devices page. A dialog box appears summarizing the task you
are instructing Grid Manager to perform. This action changes the configuration of the device.
To provision IPAM networks onto a device:
1. From the Data Management tab, select the Devices tab.
2. Click the Next Page and Last Page icons to locate the device whose interfaces you want to provision.
3. Click the Name of the device. The Devices page displays the five tabs of information associated with the device.
4. Click the Networks tab.
5. The Networks page lists all discovered networks (highlighted in grey), unmanaged networks (highlighted in
yellow), and any managed networks (highlighted in white, showing Yes in the Managed column) present on the
selected device.
6. Open the vertical toolbar and click Provision Network. The Provision network wizard appears.
7. Click Select Network to choose the network the you want to provision. If only one managed network is available
on the device, that network value is populated after clicking the button.
If more than one managed network is available under IPAM, the Network Selector dialog opens, listing all
networks managed under IPAM.

720 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Provisioning and De-Provisioning Networks

8. Choose the network to provision onto the device and click OK.
9. Enter the Router IP Address. This required field may be pre-populated with the DHCP router IP address if the
device already has a DHCP configuration. If not, enter the gateway router IP address for the current device.
10. If necessary, check the DHCP Forwarding check box. Check this check box to enable DHCP forwarding for the
newly provisioned network. If a DHCP failover is already present, the IP addresses from that failover are used for
DHCP forwarding information.
11. For choosing the Interface, you can choose one out of two options:
a. Interface drop down list: If you are provisioning the network directly onto an interface, select it from this list.
Only interfaces that are available for provisioning on the chosen device appears on this list; interfaces that
are already active in a network do not appear;
–or–
b. For a switch-router, select Create VLAN, and specify the VLAN Name and its new VLAN ID. Ensure that the
VLAN ID is not one that is already provisioned on the device.

Figure 15.15 Provisioning a VLAN on a Switch-Router

12. Click Next to go to the second step in the Provision Network wizard, in which you define whether to provision the
configuration now or to schedule it.
13. To immediately provision the new network on the chosen device, select Now.
a. You can choose to have Grid Manager create the network at a later time. To do so, select Later. Choose a
Selected time by entering or selecting a Start Date (click the calendar icon to choose a calendar date) and a
Start Time, and choose a Time Zone.
14. Click Save & Close when finished.

De-provisioning Networks

Note: De-provisioning a network changes the device configuration. As such, a separate task is created for the action
under Task Manager. However, you cannot schedule the de-provisioning of a network–once you confirm the
de-provisioning action in Grid Manager, the action takes place. Each managed and unmanaged device under
Grid Manager provides a Permissions page (Data Management –> Devices –> Select Device –> click Edit –>
Permissions tab). By default, no admin group or Role is assigned to managed devices. Infoblox recommends
using caution when assigning rights to users that may be able to access devices and change device
configurations.

De-provisioning networks is a relatively straightforward task that can be performed for any selected network, whether
it is a non-NIOS network (a network that cannot be configured in IPAM), an unmanaged network, or a managed
network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 721

Infoblox Network Insight

Note: If the network is also managed under IPAM, de-provisioning the network from a device does not delete the
network from IPAM.

If you are deleting a network from the main IPAM page, any devices that have endpoints provisioned on that network
are also de-provisioned for that network.

Note: A network may not be de-provisioned until after you set the interface for the network on the device(s), to Down
in Admin Status.

1. From the Data Management tab, select the Devices tab.

2. Click the Next Page and Last Page icons to locate the device through which you want to locate the interfaces to
convert.
3. Click the Name of the device. The Devices page displays the five tabs of information associated with the device.
4. Click the Networks tab for the chosen device. The Network page lists all discovered networks (highlighted in
grey), unmanaged networks (highlighted in yellow), and managed networks (highlighted in white) present on the
selected device.
5. Click the Next Page and Last Page icons to locate the network that you wish to de-provision.
6. Click the Action icon next to the network you want (this automatically selects it) and select De-Provision
Network. The dialog box appears, listing the device name, the device’s IP address, the interface to which the
network is currently bound, and the network’s endpoint IP address on the current device.

Figure 15.16 De-Provisioning a Network from a Device

7. Click Yes to confirm the de-provisioning action.

Note: Ensure that the de-provisioning of the network has administrative approval.

You can also select multiple network entries from the list on the same device and de-provision all of them in a single
step. Exercise caution when performing such actions.

De-Provisioning Networks by Deleting Networks in IPAM

Note: Deleting a network under IPAM creates a new Object Change task in Task Manager. You can check the
Administration –> Workflow –> Task Manager page to view its status.

You can simply delete a managed or unmanaged network in IPAM to de-provision it. Doing so opens a Delete
Confirmation dialog. IPAM also automatically prompts you to verify that you are deleting the network from all devices
that have interfaces connecting to the network, subject to verification and permissions.
By default, when you delete the network, all devices that connect to the network, that are also managed by IPAM, are
part of the new de-provisioning port control task created by Grid Manager. If you do not want the network
de-provisioned from all devices, clear the De-provision network from all interfaces check box or simply cancel out
from the Delete Confirmation dialog.

722 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating Port Reservations for IPAM Objects

Troubleshooting Port Control Tasks

Issues can occur when attempting to define port configurations on devices. When you define port configurations
through Network Insight, you are defining a port control task that can be viewed, investigated, and run again when
necessary. You do so by using the Task Manager (Administration –> Workflow –> Task Manager) and looking for tasks
that show a Type of Port Control. Each Port Control task provides an Execution Log and the ability to re-run a task that
has failed for any reason.
The Task Manager page provides an Action icon column with a series of menu options for features related to Grid
Manager tasks to manage task execution, scheduling and approval. Menu choices change based upon the context
and the current state of tasks in the table; features available in the Action menu include the following:

Figure 15.17 Task Manager Action menu

• Approve: Enables admins to approve a pending job.

• Reject: Enables admins to reject a pending job, immediately cancelling it.
• Execution Log: Opens a completed task’s execution log window. the Execution Log lists the complete
communications sequence sent to a device to perform a port control task.
• Execute Now: Force a selected pending task to execute immediately.
• Re-Execute: Allows you to re-run the selected task. Combined with the Execution Log, this process can aid in
troubleshooting a failed port control task.
• Reschedule: Opens the Reschedule window for the selected task. To immediately execute this task, click Now.
Or, in the Reschedule panel, click Later, and then specify a date, time, and time zone. You can reschedule the
task if you have the applicable permissions. Click Save to commit the changes.
• Delete: Deletes the pending task.
• View: Opens the Task Viewer to the currently selected task. For related information, see Using the Task Viewer to
View Job Logs and Approve Jobs on page 135.
The Execution Log allows you to see task behavior when it executes. You can check the configuration directly on the
device and re-run the job if it has failed, by selecting Re-execute from the Action menu on the Task Manager page.

Creating Port Reservations for IPAM Objects

A port reservation instructs Network Insight to reserve ports on discovered and managed devices, for exclusive use
by Grid members and by IPAM objects such as hosts or fixed addresses. Network Insight ensures that doing so does
not interfere with existing device and port configurations and active networks, because port reservations
automatically apply only to ports that are discovered to be available on network devices. Network Insight prevents a
user from reserving the same port for more than one object. Should a port reservation somehow conflict with another
more recent port reservation, Network Insight automatically reports a conflict and enables you to respond to the issue
(for more information on this topic, see Resolving Port Reservation Conflicts on page 737).
When you create new IPAM objects, you can create the new objects and define port reservation settings at that time,
or create the new object without any port-related settings and edit them later, after the object is established in Grid
Manager. The Add IPv4 Reservation Wizard, Add Fixed Address Wizard, Add Host Wizard and Add Grid Member
Wizards all support the full set of port configuration settings, as shown in Figure 15.18.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 723

Infoblox Network Insight

Figure 15.18 Defining Port Reservations during Object Creation

Making a port reservation does not guarantee that the port is in fact available on the requested device. All interfaces
appearing in the Interface list are ports that are otherwise known to Network Insight as Operationally Down during its
last discovery task, and that are not already reserved by a port reservation.
1. Begin by checking the Reserve Port check box.

Note: Optionally, you can completely skip port reservation and port configuration by clicking Next.

2. Click the Device Name button to choose the device for which the port reservation is associated. You should know
the identity of the device to which the Infoblox appliance is connected before taking this step.
3. After choosing the device, choose the Interface with which the reservation is bound. The drop-down list shows
only interfaces that are most recently found to be available by Network Insight during the last discovery cycle.
This list does not include any ports that are Administratively Up and Operationally Up and are otherwise already
assigned to other networks or objects.
— The Wizard page also shows a list of any VLANs that are currently configured in the chosen device. This
Wizard page does not allow the definition of new VLANs for port configuration–only the assignment of an
existing VLAN in the device for port configuration.
4. Select the Configure Port check box to define specific port control settings for the port reservation.

Note: If you do not take this action when you create the object, you cannot perform the configuration later while
editing the object.

5. If the chosen device supports them, choose the Voice VLAN and/or the Data VLAN settings you may need for the
port assignment. You do not create new VLAN values in this step; you can select from VLANs that are provisioned
on the currently chosen device. All VLANs configured on the device and discovered by Network Insight during its
most recent discovery polling cycle appear in the drop-down lists.
6. Set the Admin Status to Up if you need to activate the port in the current task. Though the port reservation is
associated only with the current object, any port configuration creates a new Port Control task under Task
Manager.
7. Enter a Description for the port assignment. Infoblox recommends doing so to help other technicians to
recognize the port assignment event.
8. When finished, click Save and Close or select other tabs to change settings for the object.

724 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating Port Reservations for IPAM Objects

Note: Once a switch port or other device port is reserved, Network Insight prevents further port reservations from
using the same port for another reservation.

See the following sections for examples on how to create IPAM objects with port reservations:
• Adding Host Records on page 579
• Configuring IPv4 Networks on page 1111
• Configuring IPv4 Fixed Addresses on page 1125
• Configuring IPv4 Reservations on page 1131
• Configuring IPv6 Networks on page 1160
• Configuring IPv6 Fixed Addresses on page 1171
• Adding Grid Members on page 297
• Defining Port Reservations for an Infoblox Grid Member on page 726

Editing Port Reservation Settings for IPAM Objects

As previously noted, you can create IPAM objects such as hosts or fixed addresses without device information and
port reservation settings, and edit them later after the object is established in the Grid Manager. You can change port
reservations in any object to new settings. Limitations exist when editing existing objects.
The Port Reservation editing page settings uniformly apply to Grid members, IPv4 reservations, hosts, and fixed
address objects. Note that you cannot change port configurations when editing objects, as shown in Figure 15.19.

Figure 15.19 Editing an Existing Object’s Port Reservation

Unlike creating an object, editing an existing object’s port reservation does not permit configuring the selected port.
(You can edit the port from the device’s Interfaces page, including inline editing.) Physical interfaces with an
Operational Status of Down appear in the Interface drop-down list. Ports that are already active, that are reserved
through a port reservation, or that are administratively Up/Operationally Up do not appear in the Interface drop-down
list.
For object editing, you can select interfaces but you cannot edit their settings, such as setting the Admin Status to Up
or choosing the Data VLAN or Voice VLAN.
Port reservation editable settings are as follows:
• Reserve Port–Enables the port reservation task for the new object;

NIOS 7.3 NIOS Administrator Guide (Rev. A) 725

Infoblox Network Insight

• Device Name–Shows the name of the chosen devices, which must be selected by clicking Select Device and
using the Device Selector window (for information, see Using the Device Selector on page 689);
• Interface–Drop-down menu listing for all interfaces on the selected device.
The Following VLANs Are Configured–A read-only panel that shows the VLANs, if any, that are configured on the
currently selected Interface setting.
Port configuration and VLAN settings cannot be performed when editing objects–you are limited to selecting a
different port (from the same device or from a different device) to be bound to the current object.

Defining Port Reservations for an Infoblox Grid Member

Note: Editing Grid members does not allow for port configuration when you create or change a port reservation. For
Grid member editing, you can select interfaces but you cannot edit them, such as setting the Admin Status to
Up or choosing the Data VLAN or Voice VLAN. This section applies only to creating and defining port
reservations and configurations for new Grid members. For the complete Grid member creation procedure, see
Adding Grid Members on page 297.

You can configure port reservations for a Grid member, including HA members, in the Add Grid Member wizard. All
interfaces on a member (LAN1, LAN2, HA and MGMT) may have independently defined port reservations. For Grid
members, port reservations are not subject to scheduling and workflow approval, and Grid Manager executes them
immediately.

Defining Port Reservations for an HA Pair

The process of defining port reservations and port configurations for a Grid member allows these settings to be
defined during the creation of the new member. (You can also edit them afterwards.) Before performing this
procedure, consult the sections Planning for an HA Pair on page 283, About HA Failover on page 284 and Adding an
HA Member on page 300 for more details.
1. Go to Grid –> Grid Manager and choose Add -> Grid Member from the vertical toolbar. Define your new HA Pair’s
settings and click Next.
2. In the second Add Grid Member Wizard step (Step 2 of 5), click the High Availability Pair option and enter the
required Virtual Router ID value.
3. As with a normal HA pair configuration, enter the IP information about the following interfaces: VIP, Node 1 HA
and LAN1 ports, Node 2 HA and LAN1 ports. The VIP address and the IP addresses for all the ports must be in the
same subnet. Follow the guidelines provided in the section Adding an HA Member on page 300.
4. Ensure all settings are correct and click Next.
5. The following step in the Add Grid Member Wizard presents a workflow that must be performed three times for
each appliance–once for each of the three interfaces (LAN1, HA and MGMT) participating in the HA pair. (LAN2
may be configured by editing the Grid member afterwards.)

726 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating Port Reservations for IPAM Objects

Figure 15.20 Beginning the HA Pair Configuration’s Port Reservations

6. Begin by clicking the check box for the Node 1 -> LAN1 appliance port. (You do not perform port reservation for
the VIP port.)
a. Select the Reserve Port check box. The Node1 -> LAN1 port listing changes to read Pending.
b. Click Select Device to choose the device (switch or switch-router) that is Node 1 of the HA Pair. (For
information, see Using the Device Selector on page 689.)
c. After selecting the device, click OK.
d. Choose the device port for Node 1’s LAN1 port by choosing it from the Interface menu.
The panel The Following VLANs are configured refreshes to show any VLANs that are currently provisioned
on the selected port.
e. (This step is optional.) Select the Configure Port check box.
f. (This step is optional.) If the Data VLAN setting is enabled, select the VLAN from the Data VLAN menu.
g. (This step is optional.) Choose an Admin Status of Up.
h. (This step is optional.) Enter a Description.
i. For the Node 1 –> HA port, follow steps 6a through 6h for that appliance port. Ensure you select the same
switch and Data VLAN settings.
j. For the Node 1 –> MGMT port, follow steps 6a through 6h for that appliance port. Ensure you select the
same switch and Data VLAN settings.
7. For the second appliance Node 2, follow steps 6a through 6j above.
8. Click Next when finished with the Reserve Port and optional Configure Port settings for all interfaces. The result
appears similar to the example shown in Figure 15.21.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 727

Infoblox Network Insight

Figure 15.21 Port Reservations for an HA Pair

9. In the final step of the Add Grid Member Wizard, if you have defined port configuration, a final wizard step shows
that the port configuration (which is a Port Control task) executes Now, without allowing a scheduling of the task.
Port reservation for the HA Pair is not scheduled and also takes effect automatically as a part of the new Grid
member configuration. (Grid Manager creates the Grid member immediately after you click Save & Close.)
10. After you click Save & Close to create the new HA pair Grid member, thus closing the Add Grid Member wizard,
opening the editor for the HA member and clicking the Port Reservations tab displays the LAN2 port along with
the previous port settings:

Figure 15.22 Completing the HA Pair Port Reservations with the LAN2 Ports

11. Select the LAN2 port for each node and follow steps 6a through 6h above. If VLANs are provisioned on the
selected port, you can also select them.
12. Click Save & Close.

728 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Creating Port Reservations for IPAM Objects

Editing Port Reservation Settings for an Infoblox Grid Member

Editing an existing Grid member’s port reservation does not permit configuring the currently selected port. You can
select ports from any device to change the port reservation. For any selected device, ports with an Operational Status
of Down appear in the Interface list.
For editing Grid member settings, you can select interfaces but you cannot configure them; setting the Admin Status
to Up or choosing the Data VLAN and changing the Description are not allowed when editing a Grid member.

Figure 15.23 Editing a Grid Member’s Port Reservation Settings

You can edit any appliance’s port reservation settings:

1. Go to Grid –> Grid Manager and select the check box for the Grid member you wish to edit. Click Edit from the
vertical toolbar.
2. Click the Port Reservation tab.
3. Select the Reserve Port check box. The Node1 -> LAN1 port listing changes to read Pending.
4. Click Select Device to choose the device. (For information, see Using the Device Selector on page 689.)
5. After selecting the device, click OK.
6. Choose the device interface from the Interface menu. Click Save & Close when finished.
On HA pairs the process is quite similar except that you may edit up to the full complement of interfaces used for each
appliance in the HA pair. The Grid Member Properties Editor supports all ports for each appliance in the HA Pair.

Note: When editing Grid members and HA Grid members, Grid Manager does not allow changes to VLAN settings,
Admin Status or port description in the editor. You can change these values in the Interfaces table by
double-clicking the table row for the interface you want to edit.

Defining Device Information

During the process of configuring a port reservation for an IPAM object, you can define device information settings as
descriptive information for IPAM objects, as seen in Figure 15.24.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 729

Infoblox Network Insight

Figure 15.24 Device Information Settings for IPAM Objects in the Wizard

Note: If you define Device Information and Device Vendor settings for a port reservation, which are optional, and
choose to discover the object to which the port reservation is associated, you may see a conflict if discovery
of the object finds that the device for the port reservation is a different type or different vendor. For example,
if the specified information states that the device is a switch, and the discovered device is a router, Network
Insight reports a conflict. Another example: you declare the vendor to be Aruba, and the discovered value is
Cisco. For information on resolving such conflicts, see Resolving Port Reservation Conflicts on page 737.

The Device Type menu provides the following settings:

• ESX Server–identifies the object as a VMware ESX host.
• MSFT Server–identifies the object as a Microsoft Hyper-V host.
• Network Automation–Network Automation appliance from Infoblox;
• NIOS–Infoblox appliance;
• Router–Provides routed connections, including VLANs;
• Switch–provides L2 switched connections only;
• Switch-Router–Provides L2/L3 switched connectivity, including VLANs;
• VNIOS–Infoblox virtual appliance.
The Device Vendor menu provides the following device vendor choices:
• Cisco
• Juniper
• Infoblox
• Aruba
• Dell
• HP
IPAM object wizards allow definition of the settings when you create the object, or you can define the settings later.

730 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Defining Blackout Periods

Defining Blackout Periods

Note: You can separately define blackout periods for discovery, and for port configuration. This section describes
how to use the blackout feature for discovery. For more information on blackouts for port configuration tasks,
consult the section Defining Port Configuration Blackout Periods on page 733.

Discovery protocols can occupy significant resources within the network when discovery is taking place. While you
can schedule any discovery or port control task for any single time period or recurring time period, you can also
establish time periods when Network Insight does not talk to devices or networks for discovery.
You can define blackout settings at two levels in Grid Manager:
• Under Grid Discovery Properties, applying across the entire Grid;
— All networks managed by the Grid inherit discovery blackout settings by default;
• For individual networks under IPAM and under DHCP.
— A network must be Managed before you can edit its discovery blackout settings.
— Under IPAM, you can define discovery blackout settings for Network Containers and for networks (for
DHCP, you can also set blackouts for DHCP Ranges);
— If a network is in Managed state, it can be edited under IPAM or under DHCP for discovery settings and
discovery blackout settings.
Discovery tasks may already be running when a blackout period takes effect. Current tasks are not interrupted and
will complete within their time. Network Insight does not activate new discovery tasks during the blackout period,
however.

Defining Blackout Periods for the Grid

This procedure also covers defining port configuration blackout periods for the Grid. To define blackouts for the Grid:
1. From the Grid tab, select the Grid Manager tab, and click Edit –> Grid Discovery Properties.
If you do not select an appliance from the list, the Grid Discovery Properties option remains enabled.
2. Expand the Toolbar and click Edit –> Grid Discovery Properties.
3. Click the Blackout tab.
4. Select the Enable Discovery Blackout check box and click the Scheduling icon to open a separate scheduling
window. The Blackout Scheduler dialog opens.
a. Select how often you want to execute the blackout period. You can select Once, Daily, Weekly, or Monthly.
b. If you select Once, enter the day in the date picker and select a month from the drop-down list.
— Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
— Choose the Time Zone.
— Specify the Duration: 1 or more Minutes, Hours or Days.
c. If you select Daily, click either Every Day or Every Weekday.
— Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
— Choose the Time Zone.
— Specify the Duration: 1 or more Minutes, Hours or Days.
d. If you select Weekly, complete the following:
— Under Schedule every week on:, select the check box for any day of the week.
— Enter a time in the hh:mm:ss AM/PM format. You can choose a time from the drop-down list.
— Choose the Time Zone.
— Specify the Duration: 1 or more Minutes, Hours or Days.
e. If you select Monthly, complete the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 731

Infoblox Network Insight

— Schedule the day of the month: A discovery blackout can be executed monthly on a specific day, or
instances can be executed more than one month apart on a specific day, in the Day__every__month(s)
field.
— Enter a time in the hh:mm:ss AM/PM format. You can choose a time from the drop-down list.
— Choose the Time Zone.
— Specify the Duration: 1 or more Minutes, Hours or Days.
5. If necessary, select the Enable Port Configuration Blackout check box and click the Scheduling icon to open the
scheduling window. For more information, see Defining Port Configuration Blackout Periods on page 733.
6. Follow Steps 5a–5e to schedule the port configuration blackout for the Infoblox Grid. (For related information,
see Defining Port Configuration Blackouts for the Grid on page 733.)
–or–
a. Select the Use Discovery Blackout Schedule check box to apply the discovery blackout schedule to port
configurations.
7. When you have finished configuring schedules for blackout periods, click Save & Close.
When a scheduled Grid-level blackout period goes into effect, no operations related to discovery take place for the
specified time period across the Infoblox Grid. Any discovery tasks already in progress will run to completion but no
new ones will start.

Defining Blackout Periods for Networks

Network Insight offers considerable flexibility in how you apply blackout periods. You may choose to have discovery
allowed for most managed networks but elect to have a discovery blackout for selected networks that are traffic- or
latency-sensitive.
You can define extended time periods and regularly scheduled times when discovery and/or port configuration tasks
is not in progress on a specific IPAM network or within a network container. By default, the network inherits its
discovery blackout settings from the Grid level. Editing a network under IPAM or DHCP, blackout settings apply only
to the specified network. You also specify the scheduled time when the blackout period begins, and the duration of
the blackout period.
As noted, a network must be in managed status before editing discovery or blackout features.
To define a discovery blackout for a network under IPAM or DHCP:
1. Select a managed network from one of the following locations:
a. Data Management –> IPAM –> list view
–or–
b. Data Management –> DHCP –> Networks
2. Click the Action icon next to the network you want (this automatically selects it) and select Edit from the
menu. The Edit Network dialog appears.
3. Click the Discovery Blackout tab.
4. Click Override to change blackout settings for the chosen network.
5. Select the Enable Discovery Blackout check box and click the Scheduling icon to open a separate scheduling
window. (Because the settings are inherited, Enable Discovery Blackout may or may not already be enabled.) The
Blackout Scheduler dialog opens.
a. Select how often you want to execute the blackout period. You can select Once, Daily, Weekly, or Monthly.
b. If you select Once, enter the day in the date picker and select a month from the drop-down list.
— Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
— Choose the Time Zone.
— Specify the Duration: 1 or more Minutes, Hours or Days.
c. If you select Daily, click either Every Day or Every Weekday.
— Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.

732 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Defining Port Configuration Blackout Periods

— Choose the Time Zone.

— Specify the Duration: 1 or more Minutes, Hours or Days.
d. If you select Weekly, complete the following:
— Under Schedule every week on:, select the check box for any day of the week.
— Enter a time in the hh:mm:ss AM/PM format. You can choose a time from the drop-down list.
— Choose the Time Zone.
— Specify the Duration: 1 or more Minutes, Hours or Days.
e. If you select Monthly, complete the following:
— Schedule the day of the month: A discovery blackout can be executed monthly on a specific day, or
instances can be executed more than one month apart on a specific day, in the Day__every__month(s)
field.
— Enter a time in the hh:mm:ss AM/PM format. You can choose a time from the drop-down list.
— Choose the Time Zone.
— Specify the Duration: 1 or more Minutes, Hours or Days.
6. If necessary, select the Enable Port Configuration Blackout check box and click the Scheduling icon to open the
scheduling window. For information, see Defining Port Configuration Blackout Periods on page 733.
7. Follow Steps 5a–5e to schedule the port configuration blackout for the chosen network. (For related information,
see Defining Port Configuration Blackouts for Networks on page 734.)
–or–
a. Select the Use Discovery Blackout Schedule check box to apply the discovery blackout schedule defined for
the network.
8. When you have finished configuring schedules for blackout periods for the network, click Save & Close.
When a scheduled blackout goes into effect, no operations related to discovery and/or port configuration take place
for the specified time period on the selected network. Any related operations in progress will run to completion but
no new ones will start.

Defining Port Configuration Blackout Periods

Similar to discovery blackout periods, you can define port configuration blackout periods for managed networks
under IPAM and DHCP. You specify the scheduled time when the blackout period begins, and the duration of the
blackout period.
By default, networks inherit their blackout settings from the Grid level. For port configuration blackout settings in a
network, the network must be under managed status in IPAM.

Defining Port Configuration Blackouts for the Grid

Port configuration blackout settings apply globally across the entire Infoblox Grid unless overridden by members or
for specific networks.
1. From the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and click Edit –> Grid Discovery Properties.
3. Click the Blackout tab.
4. Click the Enable Port Configuration Blackout check box.
a. Select the Use Discovery Blackout Schedule check box to apply the same blackout schedule to port
configurations that is applied locally to discovery blackouts. (For more information on discovery blackouts,
see Defining Blackout Periods on page 731.)
–or–

NIOS 7.3 NIOS Administrator Guide (Rev. A) 733

Infoblox Network Insight

b. Click the Schedule icon below. The Blackout Scheduler dialog opens.

Figure 15.25 Scheduling a Port Configuration Blackout

5. Select how often you want to execute the blackout period. You can select Once, Daily, Weekly, or Monthly.
a. If you select Once, enter the day in the date picker and select a month from the drop-down list.
1. Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
2. Choose the Time Zone.
3. Specify the Duration: 1 or more Minutes, Hours or Days.
b. When you select Daily, click either Every Day or Every Weekday.
1. Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
2. Choose the Time Zone.
3. Specify the Duration: 1 or more Minutes, Hours or Days.
c. When you select Weekly, complete the following:
1. Schedule every week on: Select the check box for any day of the week.
2. Time: Enter a time in the hh:mm:ss AM/PM format. You can also click the clock icon and select a
time from the drop-down list.
3. Choose the Time Zone.
4. Specify the Duration: 1 or more Minutes, Hours or Days.
d. When you select Monthly, complete the following:
1. Schedule the day of the month: A Discovery can be executed monthly on a specific day, or
instances can be executed more than one month apart on a specific day, in the Day__every-
__month(s) field.
2. Time: Enter a time in the hh:mm:ss AM/PM format. You can also click the clock icon and select a
time from the drop-down list.
3. Choose the Time Zone.
e. Specify the Duration: 1 or more Minutes, Hours or Days.
6. Click OK to commit the port configuration blackout schedule.
7. To commit settings, click Save & Close.

Defining Port Configuration Blackouts for Networks

By default, networks inherit their blackout settings from the Grid level. You can override these with local settings for
the network or for a network container, for both IPAM and DHCP. To change port configuration blackout settings for an
IPAM or DHCP network or network container:
1. Select a managed network or network container from one of the following locations:
a. Data Management –> IPAM –> list view
–or–
b. Data Management –> DHCP –> Networks
2. Click the Action icon for a chosen network and choose Edit from the popup menu.

734 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Defining Port Configuration Blackout Periods

— Under IPAM, the network must be in managed status (a value of Yes appears in the Managed field, and the
table row is highlighted in white).
— Under DHCP, all networks appearing on this page may be selected for this purpose.
3. Click the Discovery Blackout tab. The editor page appears as shown in Figure 15.26.

Figure 15.26 The Discovery Blackout tab with enabled Port Configuration Blackouts

4. Click Override to change blackout settings for the chosen member.

5. Click the Enable Port Configuration Blackout check box.
a. Select the Use Discovery Blackout Schedule check box to apply the same blackout schedule to port
configurations that is applied locally to discovery blackouts. (For more information on discovery blackouts,
see Defining Blackout Periods on page 731.)
–or–
b. Click the Schedule icon. The Blackout Scheduler dialog appears as shown in Figure 15.25.
6. Select how often you want to execute Discovery. You can select Once, Daily, Weekly, or Monthly.
a. If you select Once, enter the day in the date picker and select a month from the drop-down list.
1. Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
2. Choose the Time Zone.
3. Specify the Duration: 1 or more Minutes, Hours or Days.

Note: Ensure that you correctly specify AM or PM when entering the start time.

b. When you select Daily, click either Every Day or Every Weekday.
1. Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
2. Choose the Time Zone.
3. Specify the Duration: 1 or more Minutes, Hours or Days.
c. When you select Weekly, complete the following:
1. Schedule every week on: Select the check box for any day of the week.
2. Time: Enter a time in the hh:mm:ss AM/PM format. You can also click the clock icon and select a
time from the drop-down list.
3. Choose the Time Zone.
4. Specify the Duration: 1 or more Minutes, Hours or Days.
d. When you select Monthly, complete the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 735

Infoblox Network Insight

1. Schedule the day of the month: A Discovery can be executed monthly on a specific day, or
instances can be executed more than one month apart on a specific day, in the Day__every-
__month(s) field.
2. Time: Enter a time in the hh:mm:ss AM/PM format. You can also click the clock icon and select a
time from the drop-down list.
3. Choose the Time Zone.
e. Specify the Duration: 1 or more Minutes, Hours or Days.
7. Click OK to commit the port configuration blackout schedule for the network.
8. To commit settings, click Save & Close.

Conflict Resolution in Network Insight

Figure 15.27 Locating Conflicts and Beginning Their Resolution

You can sometimes encounter conflicts when defining port reservations for IPAM-managed objects such as Fixed IP
addresses or host records. The quickest way to locate any conflicts in Grid Manager is to open the Conflicts Smart
Folder as noted in Figure 15.27.
Numerous types of conflicts are possible:
• Device Information conflict;
• Port Reservation conflict, including Used Port Reservation conflicts (usually resulting from a request to
reserve a port that has already been assigned to another IPAM object);
• Fixed address conflict;
• IP Address conflicts;
• DHCP Range conflicts (such as: Discovered address is within an existing DHCP range but does not match an
existing lease, fixed address, or exclusion range);
• MAC Address conflict (such as: Discovered MAC Address conflicts with existing fixed address).
The Conflict Resolution wizard automatically recognizes the object associated with the conflict (which is listed in the
Related Objects pane as noted in Figure 15.27) and ensures that changes you make during resolution are applied
correctly to the object. An example appears in Figure 15.28.

736 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Conflict Resolution in Network Insight

Figure 15.28 Conflict resolution example

Resolving Port Reservation Conflicts

Sometimes, administrators may accidentally request a device port to be reserved for an IP address when the port is
already reserved for another object, or try to apply a different port to an object that already has a port reservation.
When these cases arise, Grid Manager reports a conflict.
To resolve port reservation conflicts:
1. Click the link provided in the Conflicts Smart Folder.
2. Expand the Toolbar and click Resolve Conflict, as shown in Figure 15.27.
The Resolve Port Reservation Conflict dialog opens, showing the differences between the reserved and
discovered information.
3. Choose from the following options:
— Change the reserved port to be the same as the discovered port.
— Keep the configured port reservation and clear the conflict for the next 1 day(s).

Note: In the Grid Discovery Properties –> Advanced tab, the Ignore Conflict Duration setting governs the default
time duration to ignore (clear) certain types of conflicts that may occur when defining IPAM objects that
are associated with discovered and managed devices, interfaces, or IP addresses. Increments can be
defined in Hours or Days. For more information, see Defining Seed Routers for Probe Members on page
684.

4. Click OK to save changes.

Note: For other conflict examples, see Resolving Multiple Conflicts on page 738.

Another category of conflicts involves incorrectly defined device information for the object:
• The reserved Device Type information provided is different from the discovered vendor and device type
(Router vs. Switch, for example);
• The defined Device Vendor information does not match with the discovered information.
• A User Port Reservation conflict occurs when an unmanaged IP address attempts to use a port that is
already reserved by an IPAM object on a different IP address.
You can choose from the following options:
— Change configured information to discovered information.
— Keep the current device configuration and clear the conflict for the next 1 day(s).
In virtually all cases, replacing the configured information with the discovered information successfully clears the
conflict; click OK to commit changes or to temporarily clear the conflict.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 737

Infoblox Network Insight

Resolving Multiple Conflicts

You can define objects for IP addresses, attempt to apply a port reservation, or incorrectly specify a value such as a
MAC address or a vendor name, and accidentally cause multiple conflicts after creating the new object.
When multiple conflicts need to be resolved for a particular IP address, you use a Resolve Multiple Conflicts wizard:
1. To quickly locate any conflicts, open the Smart Folders panel and open the Conflicts list.
2. Click the IP address for any entry in the Conflicts list. The IPAM page opens for the selected IP address, with the
top panel highlighted in pink to indicate the conflict.
3. Open the vertical toolbar and click Resolve Conflict.
4. If multiple issues are involved with the conflict entry, the Resolve Conflicts wizard lists each of them as shown in
Figure 15.29.

Figure 15.29 Resolution of Multiple Conflicts

5. Select the conflict that you want to resolve first and click Next. For example, consider choosing to resolve the MAC
Address conflict as shown in Figure 15.29. The second step of the wizard appears, listing the differences
between the Existing and Discovered information for the conflict as shown in Figure 15.30:

Figure 15.30 troubleshooting the first selected conflict

a. In this case, the MAC address specified in the last fixed address object configuration, for that object,
conflicts with the discovered MAC address associated with the IP. (You can verify this by checking the
Related Objects tab in the IPAM page for the IP address.) Choose from one out of two options:
— Change the configured MAC address to be the same as the discovered MAC address;
— Keep fixed address and ignore this conflict for the next 1 day(s).
In this example, the Discovered information for the MAC address associated with the Fixed Address object is
one digit off from the Existing MAC information, which was entered incorrectly by the administrator. The
DIscovered MAC, shown in red, is the correct value and should be used to overwrite the record for the conflict.

738 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Conflict Resolution in Network Insight

6. Select the Update... with discovered data option and click Resolve.
The wizard updates with a return to the first step, in which you select the next conflict to resolve. A banner
shows the result of the first resolution.
7. Select the next conflict to resolve and click Next. As an example, Figure 15.31 shows a device configuration
conflict.

Figure 15.31 Device Information conflict for an object

a. To resolve the conflict, the Configured information must be overwritten with the Discovered information:
— Change configured device type and vendor to be the same as the discovered device type and vendor;
— Keep current device configuration and clear the conflict for the next 1 day(s).
Other conflict types have similar language.
8. Select from the above choices and click Resolve.
9. Continue through the wizard to resolve the last conflict associated with the IP address.

Note: In the Polling tab –> Advanced page of the Grid Discovery Properties editor, the Ignore Conflict Duration setting
governs the default time duration to ignore (clear) certain types of conflicts that may occur when defining IPAM
objects that are associated with discovered and managed devices, interfaces, or IP addresses. Increments can
be defined in Hours or Days. This setting cannot be modified when resolving conflicts.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 739

Infoblox Network Insight

740 NIOS Administrator Guide (Rev. A) NIOS 7.3

Part 4 DNS
This section describes how to configure the Grid to provide DNS services. It includes the following chapters:
• Chapter 16, Infoblox DNS Service, on page 743
• Chapter 17, Configuring DNS Services, on page 751
• Chapter 18, DNS Views, on page 811
• Chapter 19, Configuring DNS Zones, on page 827
• Chapter 20, DNS Resource Records, on page 875
• Chapter 21, Configuring DDNS Updates, on page 909
• Chapter 22, DNSSEC, on page 963
• Chapter 24, Configuring IP Routing Options, on page 1031

NIOS 7.3 NIOS Administrator Guide (Rev. A) 741

742 NIOS Administrator Guide (Rev. A) NIOS 7.3
Chapter 16 Infoblox DNS Service
The NIOS appliance uses a standard, BIND-based DNS protocol engine. It interoperates with any other name server
that complies with the DNS RFCs (see DNS RFC Compliance on page 1782).
This chapter provides an overview of the DNS configuration tasks. It includes the following sections:
• Configuring DNS Overview on page 744
— DNS Configuration Checklist on page 745
• About Inheriting DNS Properties on page 745
— Overriding DNS Properties on page 746
• Understanding DNS for IPv6 on page 747
— Configuring IPv6 on a Grid Member on page 748
— Configuring DNS for IPv6 Addressing on page 749

NIOS 7.3 NIOS Administrator Guide (Rev. A) 743

Infoblox DNS Service

Configuring DNS Overview

An overview of the DNS configuration process is outlined in the following diagram, illustrating the required steps for
preparing a NIOS appliance for use:

Begin the initial configuration of DNS for a NIOS appliance.

Do you want to
configure Grid DNS
properties?

Yes
No
Do you want to
Configure Grid DNS properties.
configure member DNS
properties?

Yes
No Configure member DNS
properties.
Begin the configuration of DNS zones and resource records.

Do you want to add DNS

views, in addition to the Add DNS views.
default ?

No Yes
Decide on the type of
zones to configure.

Forward zone Authoritative zone Delegated zone Stub zone

Specify the IP address - Choose the primary member Specify the IP address Specify the IP address of
of the server(s) to or specify the external primary. and FQDN of the the master server, and
which queries are
-.Choose Grid secondaries or authoritative name server select the Grid member
forwarded, and select
specify external secondaries. for the zone. that hosts the zone.
the Grid member that
hosts the zone.

- Add resource records.

- Import zone data.

Yes
Do you want to add
more zones?
No
Start DNS service on the
member

Initial DNS configuration is complete.

744 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Inheriting DNS Properties

DNS Configuration Checklist

The following checklist includes the major steps for configuring DNS:

Table 16.1 DNS Configuration Checklist

Step For more information

Decide if you want to configure DNS • Chapter 16, Infoblox DNS Service, on page 743
properties for the Grid and for individual
members
Decide if you want to create a new DNS • Chapter 18, DNS Views, on page 811
view, in addition to the default DNS view
Decide which type of DNS zone you want • Chapter 19, Configuring DNS Zones, on page 827
to configure
Add hosts and resource records • Chapter 20, DNS Resource Records, on page 875
Import zone data • Importing Zone Data on page 849
Enable DNS service on the member • Starting and Stopping the DNS Service on page 763

About Inheriting DNS Properties

You can configure DNS properties at the Grid, member, zone, and resource records level. The NIOS appliance applies
the properties hierarchically, with the Grid at the top of the hierarchy. Grid settings apply to all members in the Grid,
unless you override them at the member, zone, or resource record level. When you set DNS properties for a particular
member, these properties override the Grid properties and apply to all zones served by that member. When you set
properties for a specific zone, they override the member properties and apply to the resource records in the zone. You
can also override the zone properties and set properties for specific resource records.
When you configure DNS properties that contain inherited values, the appliance displays the information based on
the inheritance sources. There may be times when an object can inherit properties from different sources with
different settings. The following table summarizes what the appliance can display:

When you see... it means...

Inherited From <object> the DNS property has a definite value
from an inheritance source.
Inherited From Upper Level the appliance cannot yet determine the
inherited value or inheritance source for
the DNS property.
Inherited From Multiple the DNS property has the same value
that it inherits from multiple sources.
Settings Inherited from Multiple the DNS property has different values
Ancestors, View Multiple that it inherits from multiple sources,
Inheritance Scenarios and you can view the values and their
corresponding sources by clicking the
View Multiple Inheritance Scenarios link.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 745

Infoblox DNS Service

Based on the information provided, you can then decide whether to override or keep the inherited values. You must
have read/write permissions to the DNS resources to override inherited values. You can only view inherited values
and paths if you have at least read-only permissions.
In the example in Figure 16.1, the DNS zone is served by members with different query settings.

Figure 16.1 DNS Zone with Different Inherited Settings

The Multiple Inheritance Viewer indicates that the two servers have different query ACLs, as shown in Figure 16.2.
You can then view the Query properties of each member and edit them, or override the setting and specify values that
apply to the zone only.

Figure 16.2 Multiple Inheritance Viewer

Overriding DNS Properties

DNS properties configured at the Grid level apply to the entire Grid. You can choose to keep the inherited properties
or override them when you configure the properties for a member, zone, or resource record.
To override an inherited value:
1. In a wizard or editor, click Override next to a property to enable the configuration. The Override button changes
to Inherit.
2. Enter a new value to override the inherited value.

746 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Understanding DNS for IPv6

Understanding DNS for IPv6

You can configure NIOS appliances to provide DNS services over IPv4 (Internet Protocol version 4) and IPv6 (Internet
Protocol version 6) networks. You can configure the Grid member as IPv6, or dual-mode name server. Dual-mode
name server is capable of sending and receiving IPv4 and IPv6 queries and responses. It can serve DNS data in
response to both IPv4 and IPv6 queries. The appliance supports authoritative forward-mapping zones containing
AAAA records mapping host names to IPv6 addresses, as well as authoritative reverse-mapping zones with PTR
records mapping IPv6 addresses to host names.
Configuring a Grid containing an IPv4 primary server and IPv6 secondary servers is not supported. You must enable
IPv6 on both the primary and secondary servers within the Grid to enable them to communicate with each other.
Infoblox highly recommends that you enable IPv6 on your Grid appliances before configuring IPv6 authoritative
zones.
The NIOS appliance supports IPv6 configuration on multiple interfaces, such as LAN1,LAN2, MGMT, anycast (OSPF
and BGP), and loopback interfaces. Infoblox integrates IPv6 address management into many of the same places
where IPv4 addresses are entered. Data validation occurs on all IP address fields and automatic validation is done
to ensure proper entry of either an IPv4 address or an IPv6 address.
The NIOS appliance supports the following DNS functions for IPv6:
• AAAA records—You can import, serve queries, display, add, delete, and modify AAAA records on the appliance.
An AAAA record is equivalent to an IPv4 A record, relying upon a forward-mapping zone to map a hostname to
an IPv6 address. A single forward-mapping zone can map names to both IPv4 and IPv6 addresses. The
appliance autogenerates AAAA records for any of its interfaces that have IPv6 addresses.
• Hosts—You can configure IPv4 and IPv6 addresses for hosts. For information, see Adding Host Records on page
579.
• ip6.arpa— A specific domain for IPv6 is used for DNS reverse lookups called ip6.arpa. This domain maps an
IPv6 address to a hostname. When you specify an IPv6 network, the appliance automatically creates the
appropriate zone under ip6.arpa.
• PTR records—Import, serve queries, display, add, delete, and modify PTR records within an ip6.arpa reverse
zone. The PTR record returns a domain name corresponding to an IPv6 address contained in the ip6.arpa zone.
The appliance does not autogenerate PTR records; the user must configure PTR records manually.
• DDNS—The appliance supports AAAA and PTR records for DDNS (Dynamic DNS).
For more information about DNS for IPv6, see RFC 3596, DNS Extensions to Support IP Version 6.

Address Structures
IPv4 uses a 32-bit, 4-octet (each octet separated by decimals) addressing structure to designate sources and
destinations within a network. Since there are 32 bits that make up the address, IPv4 can support up to 4 billion
unique addresses.
An IPv6 address is a 128-bit number in colon hexadecimal notation. It consists of eight groups of four hexadecimal
digits separated by colons (example: 12ab:0000:0000:0123:4567:89ab:0000:cdef). Since there are 128 bits that
make up the address, IPv6 can support up to 3.4x1038 unique addresses. The increase in the number of unique IPv6
addresses is one of the biggest advantages of an IPv6 implementation.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 747

Infoblox DNS Service

Figure 16.3 IPv6 Address Structure

n bits m bits 128-n-m bits

Global Routing Prefix Subnet ID Interface ID

Network Prefix Interface ID

The IPv6 address structure consists of the following:

• Global Routing Prefix—Global routing prefix is a (typically hierarchically-structured) value assigned to a site.
• Subnet ID—Subnet ID is an identifier of a link within the site.
• Interface ID—Interface Identifier. This portion of the address identifies the interface on the subnet. This is
equivalent to the host identifier for IPv4 addresses.
When you enter an IPv6 address, you can use double colons to compress a contiguous sequence of zeros. You can
also omit any leading zeros in a four-hexadecimal group. For example, the complete IPv6 address
2006:0000:0000:0123:4567:89ab:0000:cdef can be shortened to 2006::123:4567:89ab:0:cdef. Note that if there
are multiple noncontiguous groups of zeros, the double colon can only be used for one group to avoid ambiguity. The
NIOS appliance displays an IPv6 address in its shortened form, regardless of its form when it was entered.

Configuring IPv6 on a Grid Member

You can configure a Grid member in either IPv6 or dual mode (IPv4 and IPv6) to support IPv6 connections. A dual
mode Grid member supports both IPv4 and IPv6 connections by configuring an IPv6 address on the member, in
addition to the standard IPv4 address.
When you enable IPv6 on a member, you can manually enter the IPv6 gateway address or enable the member to
automatically acquire the address from router advertisements. Routers periodically send router advertisements that
contain link-layer addresses and configuration parameters. A NIOS appliance that supports IPv6 can listen for router
advertisements and obtain the default gateway IP address and link MTU (maximum transmission unit). The link MTU
is the maximum packet size, in octets, that can be conveyed in one transmission unit over a link. Thus you can set
parameters on a router once and automatically propagate it to all attached hosts.
To configure the member to support IPv6:
1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Expand the Toolbar and click Add -> Add Grid Member.
3. In the Add Grid Member wizard, enter the following and click Next:
— Member Type: Specify the appliance type of the Grid member. If the member is an Infoblox appliance,
select Infoblox, which is the default. If the member is a NIOS virtual appliance, select Virtual NIOS.
— Host Name: Type the FQDN (fully qualified domain name) of the appliance that you are adding to the Grid.
— Time Zone: If the Grid member is in a different time zone from the Grid, click Override and select a time
zone.
— Comment: Type a comment that provides some useful information about the appliance, such as its
location.
— Master Candidate: Select this option to designate this appliance as a Master Candidate. For supported
vNIOS appliances, see Supported vNIOS Appliance Models and Specifications on page 1775. Note that the
Grid Master Candidate must use the same communication protocol as the Grid Master.
4. Enter the following information about the member that you are adding to the Grid and click Next:
— Type of Network Connectivity: Select IPv6 to configure an IPv6 Grid member or select IPv4 and IPv6 to
configure a dual mode Grid member.

748 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Understanding DNS for IPv6

— Select Standalone Member to configure a single member or select High Availability Pair to configure an HA
member.
For an HA member, enter the Virtual Router ID number and if the HA member is configured in dual mode,
select IPv6 in the Send HA and Grid Communication Over field.
— Required Ports and Addresses: This table lists the network interfaces based on the type of network
connectivity of the Grid member.
For IPv6 Grid member, specify the network information for LAN1(IPv6) interface. For a dual mode Grid
member, specify the network information for both LAN1(IPv4) and LAN1(IPv6) interfaces.
For IPv6 HA member, specify the network information for VIP (IPv6), Node1 LAN1(IPv6), and Node2
LAN1(IPv6) ports. For a dual mode HA member, specify the network information for the following interfaces:
VIP (IPv4), Node1 LAN1(IPv4), Node2 LAN1(IPv4), VIP (IPv6), Node1 LAN1(IPv6), and Node2 LAN1(IPv6).
Enter correct information for the following by clicking the field:
— Interface: Displays the name of the interface. You cannot modify this.
— Address: You can enter IPv4 or IPv6 address depending on the type of interface. An IPv6 address is a
128-bit number in colon hexadecimal notation. It consists of eight 16-bit groups of hexadecimal digits
separated by colons (example: 2001:db8:0000:0123:4567:89ab:0000:cdef or
2001:db8::123:4567:89ab:0:cdef).
— Subnet Mask (IPv4) or Prefix Length (IPv6): Enter an appropriate subnet mask for IPv4 address and
prefix length for IPv6 address. The prefix length ranges from 2 to 127.
— Gateway: Type the default gateway for the interface. For IPv6 interface, you can also type Automatic to
enable the appliance to acquire the IPv6 address of the default gateway and the link MTU from router
advertisements.
— VLAN Tag: For a VLAN, enter the VLAN tag or ID. You can enter a number from 1 to 4094. Ensure that you
configure the corresponding switch accordingly.
— Port Settings: From the drop-down list, choose the connection speed that you want the port to use. You
can also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or Half
for data transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to
negotiate the optimum port connection type (full or half duplex) and speed with the connecting switch
automatically. This is the default setting. You cannot configure port settings for vNIOS appliances.
— DSCP Value: Displays the Grid DSCP value, if configured. To modify, click Override and enter the DSCP
value. You can enter a value from 0 to 63. For information about DSCP, see Implementing Quality of
Service Using DSCP on page 447.
5. Save the configuration and click Restart if it appears at the top of the screen.

Configuring DNS for IPv6 Addressing

Configuring the appliance to manage DNS services for IPv6 connections is similar to configuring DNS services for IPv4
connections. For simplicity, the IPv6 procedures are located in the same location as the corresponding procedures
for IPv4 in this chapter. In most cases, the key difference within the procedure involves selecting an IPv6 mapping
zone instead of an IPv4 mapping zone. You can configure the following tasks:

Table 16.2 IPv6 DNS Configuration Checklist

Step For more information

Create primary or secondary name • About Authoritative Zones on page 829
servers and specify an IPv6 root server. • Specifying a Primary Server on page 840
• Specifying Secondary Servers on page 843
• Creating a Root Zone on page 832

NIOS 7.3 NIOS Administrator Guide (Rev. A) 749

Infoblox DNS Service

Step For more information

Configure the IPv6 zones. • Creating an Authoritative Forward-Mapping Zone on page 830
• Creating an Authoritative Reverse-Mapping Zone on page 830
Configure IPv6 resource records • Managing AAAA Records on page 883
• Managing PTR Records on page 884

750 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 17 Configuring DNS Services
This chapter provides general information about DNS service properties. The topics in this chapter include:
• Configuring DNS Service Properties on page 753
— Configuring DNS Access Control on page 753
— About Time To Live Settings on page 753
— Configuring Hostname and Server ID Options on page 756
— Enabling and Disabling DNS Health Check Monitor on page 757
— Adding an Email Address to the SOA Record on page 757
— Notifying External Secondary Servers on page 758
— Enabling the Configuration of RRset Orders on page 759
— Specifying Port Settings for DNS on page 760
— Deleting PTR Records associated with A or AAAA Records on page 762
— Specifying Minimal Responses on page 763
— Starting and Stopping the DNS Service on page 763
• About DNS Cache on page 763
— Clearing DNS Cache on page 763
— Clearing Cache for DNS Views on page 764
— Clearing Domain Names from Cache on page 764
— Viewing DNS Configuration on page 765
— Viewing DNS Cache Details on page 766
— Viewing Statistics on page 766
• Using Forwarders on page 767
— Specifying Forwarders on page 767
• Controlling DNS Queries on page 767
— Specifying Queries on page 768
• Enabling Recursive Queries on page 769
— Enabling Recursion on page 769
— Restricting Recursive Client Queries on page 770
• Controlling AAAA Records for IPv4 Clients on page 770
— Enabling AAAA Filtering on page 771
• About NXDOMAIN Redirection on page 772
— About NXDOMAIN Rulesets on page 773
— NXDOMAIN Redirection Guidelines on page 774

NIOS 7.3 NIOS Administrator Guide (Rev. A) 751

Configuring DNS Services

— Configuring NXDOMAIN Redirection on page 775

— Creating Rulesets on page 775
— Enabling NXDOMAIN Redirection on page 776
• Detecting and Mitigating DNS DDoS Attacks on page 776
• Automated Mitigation of Phantom Domain Attacks on page 777
— Guidelines for Mitigating Phantom Domain Attacks on page 777
— Configuring Parameters for Mitigating Phantom Domain Attacks on page 777
• Detecting NXDOMAIN Attacks on page 779
— Tracking NXDOMAIN Responses on page 779
— Tracking Cache Hit Ratio of Recursive Queries on page 782
— Tracking Dropped UDP Packets on page 783
• Mitigating Possible NXDOMAIN Attacks on page 783
• Support for RRL (Response Rate Limiting) on page 784
• About Blacklists on page 784
— About Blacklist Rulesets on page 785
— Blacklist Guidelines on page 786
— Configuring the Blacklist Feature on page 786
— Enabling Blacklisting on page 787
• Enabling Zone Transfers on page 788
— Configuring Zone Transfers on page 789
— Configuring Concurrent Zone Transfers on page 791
• About Root Name Servers on page 792
— Specifying Root Name Servers on page 792
• About Sort Lists on page 792
— Defining a Sort List on page 793
• Configuring a DNS Blackhole List on page 794
— Defining a DNS Blackhole List on page 794
• Specifying Hostname Policies on page 795
— Defining Grid Hostname Policies on page 796
— Defining Hostname Restrictions on page 797
— Obtaining a List of Invalid Record Names on page 797
• About DNS64 on page 798
— Configuring DNS64 on page 799
— About Synthesis Groups on page 799
• DNS Record Scavenging on page 803
— Scavenging Rules on page 804
— Configuring DNS Record Scavenging Properties on page 804
— Scheduling Automatic Scavenging on page 806
— Scavenging DNS Records Immediately on page 806
— Disabling Scavenging for Individual Records on page 807
— Administrative Permissions for DNS Records Scavenging on page 808
— Restoring Reclaimed Records on page 808
• DNS Queries Monitoring on page 808

752 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Service Properties

Configuring DNS Service Properties

You can configure general DNS service properties and change some default values. The DNS service is disabled by
default. To enable the member to provide DNS service, you must start the DNS service. For information about how to
start and stop the DNS serviceStarting and Stopping the DNS Service on page 763. The following sections describe
the DNS service properties that you can configure:
• Configuring DNS Access Control
• About Time To Live Settings
• Configuring Hostname and Server ID Options on page 756
• Adding an Email Address to the SOA Record on page 757
• Notifying External Secondary Servers on page 758
• Specifying Port Settings for DNS on page 760
• Specifying Minimal Responses on page 763
• Starting and Stopping the DNS Service on page 763

Configuring DNS Access Control

You can add ACEs (access control entries) or use a named ACL (access control list) to determine which hosts can
perform specific DNS tasks. For information about how to define a named ACL, see Defining Named ACLs on page
400. When you add ACEs or a named ACL to Grid DNS properties, the configuration overrides member and object
access control for DNS zone transfers, dynamic DNS updates, DNS queries and recursive queries, blackhole lists, and
AAAA filtering. For a full list of operations that support access control, see Operations that Support Access Control on
page 398.
To configure DNS access control:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
2. In the Grid DNS Properties editor, click Toggle Advanced Mode, and select one of the following tabs for specific
DNS tasks:
— Updates tab: Define ACEs or a named ACL to control Grid level dynamic DNS updates, as described in
Enabling DNS Servers to Accept DDNS Updates on page 928.
— Queries tab: Define ACEs or a named ACL to control Grid level DNS queries, recursive queries, and AAAA
filtering, as described in Controlling DNS Queries on page 767, Enabling Recursive Queries on page 769,
and Controlling AAAA Records for IPv4 Clients on page 770.
— Zone Transfers tab: Define ACEs or a named ACL to control Grid level DNS zone transfers, as described in
Enabling Zone Transfers on page 788. This does not apply to zone transfers for Microsoft servers. For
information about Microsoft servers, see Setting Zone Properties on page 1288.
— Blackhole tab: Configure ACEs or a named ACL to define IP addresses and networks that you do not want to
include during the DNS resolution process, as described in Configuring a DNS Blackhole List on page 794.
— DNS64 tab: Configure ACEs or a named ACL for clients to which the appliance sends synthesized AAAA
records DNS64 groups, as described in Setting DNS64 Group Properties on page 800.
3. Save the configuration.
You can override the Grid settings at the member and object levels.

About Time To Live Settings

You can specify TTL (time to live) settings for Infoblox host records and resource records. TTL is the time that a name
server is allowed to cache data. After the TTL expires, the name server is required to update the data. Setting a high
TTL reduces network traffic, but also renders your cached data less current. Conversely, setting a low TTL renders more
current cached data, but also increases the traffic on your network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 753

Configuring DNS Services

You can specify global TTL settings at the Grid level, for individual zones, or resource records. When you configure TTL
settings for auto-generated records, the following conditions apply:
• NS records that are auto-generated for delegated name servers use TTL settings from their delegated zones.
• Auto-generated glue A and AAAA records use TTL settings from a delegated zone if the name of the name server
is below the delegation point and does not belong to an authoritative child zone.
• All other auto-generated NS, A, and AAAA records continue to use TTL settings from their parent zones.
• Auto-generated PTR records do not inherit TTL settings from delegated zones. They use TTL settings from their
parent zones.
When you have an RRSET (resource record set) that contains different TTL settings for each record, Grid Manager
displays the actual TTL values for these records. However, in DNS responses, the appliance takes the least of the
values and returns that as the TTL setting for all resource records in the RRset.
For recursive DNS severs, you can specify the maximum cache TTL value that establishes the time limit for the name
server to cache positive responses. You can also specify the maximum negative cache TTL value that specifies the
time limit for the name server to cache negative responses. For information about how to configure these settings,
see Specifying Max Cache TTL and Max Negative Cache TTL Settings on page 755.

Specifying TTL Settings for a Grid

To specify global TTL settings for resource records hosted by Grid members:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
2. In the Basic tab of the General section of the Grid DNS Properties editor, modify the following values as
necessary:
— Refresh: This interval tells secondary servers how often to send a message to the primary server for a zone
to check that their data is current, and retrieve fresh data if it is not. The default is three hours.
— Retry: This interval tells secondary servers how long to wait before attempting to recontact the primary
server after a connection failure between the two occurs. The default is one hour.
— Expire: If the secondary fails to contact the primary for the specified interval, the secondary stops giving out
answers about the zone because the zone data is too old to be useful. The default is 30 days.
— Default TTL: Specifies how long name servers can cache the data. The default is eight hours.
— Negative-caching TTL (Time to Live): Specifies how long name servers can cache negative responses, such
as NXDOMAIN responses. The default is 15 minutes.
3. Save the configuration and click Restart if it appears at the top of the screen.

Specifying TTL Settings for a Zone

To specify TTL settings for host and resource records in a zone:
1. From the Data Management tab, select the DNS tab and click the Zones tab-> dns_view -> zone check box -> Edit
icon.
2. In the Authoritative Zone editor, click Settings.
3. Click Override and complete the fields as described in the preceding section, Specifying TTL Settings for a Grid.

Specifying the TTL of a Host or Resource Record

To specify the TTL setting for an Infoblox host or resource record:
1. From the Data Management tab, select the DNS tab and click the Zones tab -> dns_view -> zone -> resource_record.
2. The TTL tab of the resource record editor displays the TTL setting the resource record inherited from the Grid or
zone. Click Override and enter a value. The setting is in hours by default. You can change it to seconds, minutes,
days or weeks.
3. Save the configuration and click Restart if it appears at the top of the screen.

754 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Service Properties

Specifying TTL Settings for a Lame Server

Servers that are marked as authoritative, but do not respond as authoritative servers are called lame servers. You can
specify the number of seconds to cache a lame delegation or lame server indication through the Lame TTL option.
Lame TTL usually indicates the amount of time your name server remembers information about the remote name
server that is not authoritative for a zone, which is delegated to it.
A domain or sub-domain that is delegated to a server that is not authoritative for the domain is called lame
delegation. It indicates that a zone file does not exist for the domain on the server.
The lame time-to-live cache value can be defined at the Grid DNS, Member DNS, or DNS view level.
To specify the Lame TTL cache value for a lame delegation or lame server:
1. Grid: From the Grid tab -> Grid Manager tab, select the DNS tab, click the Services tab -> member check box,
expand the Toolbar and click Edit -> Grid DNS Properties. In the Grid DNS Properties editor, select the General tab
-> click the Advanced tab (or click Toggle Advanced Mode).
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon. In the Member DNS Properties editor, select the General tab -> click the Advanced tab (or click Toggle
Advanced Mode).
DNS View: From the Data Management tab, select the DNS tab -> Zones tab -> dns_view check box -> Edit icon. In
the DNS View editor, select the General tab -> click the Advanced tab (or click Toggle Advanced Mode).
2. In the Grid DNS Properties, Member DNS Properties, or the DNS View editor, select the General tab -> click the
Advanced tab (or click Toggle Advanced Mode) and then complete the following:
Lame TTL: Specify the duration of time to cache a lame delegation or lame server. The default value is 600
seconds (ten minutes) and the maximum value is 1800 seconds (thirty minutes). The appliance displays a
warning message when you specify a value equal to 0 (zero). The value 0 (zero) disables lame caching and is
not recommended. The appliance displays an error message when you specify a value greater than 1800
seconds.
The Lame TTL cache value is inherited from the Grid by the member and DNS view levels and this field is
disabled, by default. To override the Lame TTL cache value, click Override. You can override the value at the
member and DNS view levels. To retain the same Lame TTL value as the Grid, click Inherit at the member and
DNS view level.
3. Save the configuration and click Restart if it appears at the top of the screen.

Specifying Max Cache TTL and Max Negative Cache TTL Settings
You can specify the maximum duration of time for which your name server caches positive responses using the Max
Cache TTL settings. The Max Cache TTL indicates the time limit for which the name server retains records in the cache.
When the Max Cache TTL for a record expires, the name server deletes the record from the cache.
You can also specify the maximum duration of time for which your name server caches negative responses through
the Max Negative Cache TTL settings. The Max Negative Cache TTL sets the time limit for which the name server retains
negative responses (NXDOMAIN/NXRRSET responses) in the cache. The name server deletes a negative response
from the cache when the Max Negative Cache TTL period for the entry expires.
You can define the Max Cache TTL value and the Max Negative Cache TTL value at the Grid DNS, Member DNS, and
DNS view levels.
To specify the Max Cache TTL and the Max Negative Cache TTL:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
DNS View: From the Data Management tab, select the DNS tab and click the Zones tab -> dns_view check box ->
Edit icon.
2. In the Grid DNS Properties, Member DNS Properties, or the DNS View editor, click Toggle Advanced Mode if the
editor is in the basic mode.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 755

Configuring DNS Services

3. Click the Advanced subtab of the General tab and then complete the following:
— Max Cache TTL: Specify the maximum duration of time for which the name server caches positive
responses. Select the time period in minutes, hours, or days from the drop-down list. The default value is
one week (7 days), and the maximum value is 49710 days, 1193046 hours, or 71582788 minutes. The
appliance displays an error message when you enter a value greater than the maximum value. Note that
setting the Max Cache TTL value to 0 (zero) will disable the name server from caching any data, and it is not
recommended.
— Max Negative Cache TTL: Specify the maximum duration of time for which the name server caches negative
responses. Select the time period in minutes, hours, or days from the drop-down list. The default value is
three hours, and the maximum value is 7 days, 168 hours, or 10080 minutes. The appliance displays an
error message when you enter a value greater than the maximum value. Note that setting the Max Negative
Cache TTL value to 0 (zero) will disable the name server from caching negative responses, and it is not
recommended.
The Max Cache TTL value and the Max Negative Cache TTL value are inherited from the Grid at the member
and DNS view levels. To override the inherited values, click Override and specify the new value. To retain
the Grid values, click Inherit.
4. Save the configuration and click Restart if it appears at the top of the screen.

Configuring Hostname and Server ID Options

When you configure DNS anycast, multiple DNS name servers share a single IP address. To identify which DNS name
server is answering queries, you can configure the hostname and server ID options so the appliance returns the
hostname of the DNS name server that is currently answering queries. By default, the hostname and server ID options
are disabled on the NIOS appliance. You can configure the hostname bind directive and server-id directive options at
the Grid level and override them at the member level. The appliance returns the hostname of the DNS name server
that is currently answering queries when a client queries for the hostname.bind or the id.server with record
type as TXT and class CHAOS, as follows:
dig @<IP> hostname.bind txt CH
dig @<IP> id.server txt CH
To secure the identity of the internet-facing DNS servers, you can configure the hostname and server ID options for
specific Grid members that are internet-facing to return a user defined value instead of the real hostname.
Alternatively, you can disable the hostname and server ID options at the Grid level and configure them only for those
members that are not internet-facing.
To configure the hostname and server ID options:
1. Grid: From the Data Management tab, select the DNS tab, and then select Grid DNS Properties from the Toolbar.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
2. In the Grid DNS Properties or the Member DNS Properties editor, click Toggle Advanced Mode if the editor is in
the basic mode.
3. Click the Advanced subtab of the General tab and then complete the following:
— Hostname bind directive: Select either Hostname or None from the drop-down list. The default is None. If
you select Hostname, the appliance returns the hostname of the DNS name server that is currently
answering queries. Selecting None disables the Hostname bind directive option.
In the Member DNS Properties editor, you can also select User defined and specify any hostname of your
choice. The appliance returns the specified hostname instead of the real hostname of the DNS name server
that is currently answering queries.
To override an inherited setting from the Grid, click Override. To retain the same setting as the Grid, click
Inherit.

756 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Service Properties

— Server-id directive: Select either Hostname or None from the drop-down list. The default is None. If you
select Hostname, the appliance returns the hostname of the DNS name server that is currently answering
queries, when a client queries to identify the server ID of the name server that is answering queries.
Selecting None disables the Server-id directive option.
In the Member DNS Properties editor, you can also select User defined and specify a value of your choice.
The appliance returns the specified value when a client queries to identify the server ID of the DNS name
server that is answering queries.
To override an inherited setting from the Grid, click Override. To retain the same setting as the Grid, click
Inherit.
4. Save the configuration and click Restart if it appears at the top of the screen.

Enabling and Disabling DNS Health Check Monitor

You can enable the DNS health check monitor to monitor whether the DNS server is responding to client requests.
When you enable this feature, the appliance sends a query to the DNS server and waits for the response until the
specified timeout duration. If the appliance is unable to receive a response from the DNS server after the specified
number of retries, the appliance sends SNMP traps and email notifications about the failure. The appliance performs
the DNS health check periodically based on the specified time interval.

WARNING: The DNS Health Check monitor might not work properly if DNS blackhole feature is enabled or if
any named ACL is blocking the query sent to loopback interface.

To enable or disable the DNS health check monitor:

1. Grid: From the Data Management tab, select the DNS tab, and then select Grid DNS Properties from the Toolbar.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
2. In the Grid DNS Properties or the Member DNS Properties editor, click Toggle Advanced Mode if the editor is in
the basic mode.
3. Click the Advanced subtab of the General tab and then complete the following:
— Enable DNS Health Check: This check box is deselected by default, meaning the DNS health check monitor
is disabled. Select this check box to enable the DNS health check monitor and specify the following:
— Interval: Enter the time interval in seconds. The interval value is measured from the end of the previous
monitoring cycle. The default is 30 seconds. You can enter a value between 10 and 21600 seconds.
— Timeout: Enter the timeout value in seconds. This is the time the appliance waits for a response to the
query. The default is 3 seconds. You can enter a value between 1 and 10 seconds.
— Retries: Enter the number of times the appliance tries to send the query after a failed attempt. The
default is 3. You can enter a value between 1 and 10.
4. Save the configuration.

Adding an Email Address to the SOA Record

If the primary name server of a zone is a Grid member, you can add an administrator email address to the SOA record
to help admins determine who to contact about this zone.

Adding an Email Address for SOA Records in the Grid

If all zones hosted by the Grid members have the same administrator, you can add the email address once for the
Grid. The appliance then adds the email address to the RNAME field of the SOA records of the zones.
To add an email address to the SOA records at the Grid level:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 757

Configuring DNS Services

2. In the General -> Basic tab of the Grid DNS Properties editor, enter the email address in the E-mail Address (for
SOA RNAME field) field.

Note: The appliance does not support IDN for the E-mail Address (for SOA RNAME field) field at the Grid level.
You can add an email address containing IDN for the SOA records at the zone level.

3. Save the configuration and click Restart if it appears at the top of the screen.

Adding an Email Address for the Zone SOA Record

To add an email address to the SOA record of a zone:
1. From the Data Management tab, select the DNS tab and click the Zones tab-> dns_view -> zone check box -> Edit
icon.
2. In the Authoritative Zone editor, click Settings.
3. Click Override beside the Email address (for SOA RNAME field) field and enter the email address of the zone
administrator.
4. Save the configuration and click Restart if it appears at the top of the screen.

Note: The appliance supports IDN for the host name of the Email address (for SOA RNAME field) field. For example,
you can create admin@инфоблокс.рф but not админ@инфоблокс.рф.com.

Notifying External Secondary Servers

Grid members can use database replication to maintain up-to-date zone data sets, so the secondary servers in the
Grid can keep their zone data synchronized even if the primary server fails. Any external secondary servers can fall
out of sync, however, if they rely only on the primary server to send notify messages when there is new zone data.
Therefore all authoritative name servers in a Grid (all primary and secondary servers) send notify messages to
external secondary servers by default. This ensures that an external secondary name server receives notify messages
when its master is a secondary name server in a Grid. However, it also increases the number of notify messages.
Infoblox recommends that you do not configure a large number of external secondary servers in stealth mode. To
ensure that these secondary servers receive notifications about zone updates, you can allow zone transfers for these
IP addresses and then enable the appliance to add them to the also-notify statement. For information about how to
configure this feature, see Configuring Zone Transfers on page 789.
To specify whether secondary name servers in the Grid are to send notify messages to external secondary name
servers:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
2. In the Grid DNS Properties editor, click Toggle Advanced Mode.
3. When the additional tabs appear, click the Advanced subtab of the General tab.
4. Complete the following:
— Enable Grid secondaries to notify external secondaries: This option is enabled by default.
— Notify Delay: Specify the number of seconds that the Grid secondary servers delays sending notification
messages to the external secondaries. The default is five seconds.
5. Save the configuration and click Restart if it appears at the top of the screen.
For the external secondary servers to accept notify messages from the secondary name servers in the Grid and then
request zone transfers from them, you must configure the external secondary servers to use the Grid secondary
servers as the source of the zone transfers. This ensures that the external secondary servers continue to receive notify
messages, even if the primary server is unavailable.

758 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Service Properties

Enabling the Configuration of RRset Orders

You can use the Infoblox GUI to configure the order that the appliance uses to return the A and AAAA records
associated with an Infoblox host. This feature is useful when you want the appliance to return the A and AAAA records
of a host in a specific order. For example, if you want the management address to appear first on a list of IP addresses
associated with a network device, you can configure the order of the IP addresses so the management address is
always returned first on the list when you look up the name of the device. For information about using the Infoblox
API to configure RRset order (resource record order) of a host, refer to the Infoblox API Documentation.
To specify an RRset order of a host record, you must first enable the feature at the Grid level. When you enable this
feature and there are multiple IP addresses associated with the host record, you can specify one of the following
RRset orders through the Host Record wizard and editor:
• Fixed: The A and AAAA records of the host are returned in the order that you specify in the IPv4 and IPv6 address
tables.
• Random: The A and AAAA records of the host are returned in a random order.
• Cyclic: The A and AAAA records are returned in a round robin pattern.
For information about specifying RRset order of a host record, see Adding Host Records on page 579.
Note that when you configure an order type for the IP addresses associated with a host record, the order type applies
to both the A and AAAA records of the host. It does not apply to any non-host A or AAAA records that may have the
same owner name as the host record. By default, the appliance returns resource records in a cyclic or round robin
order. The return order of non-authoritative data retrieved from a recursion is not affected by the host RRset order,
and that remains cyclic.
When you enable the RRset order for hosts at the Grid level, you may not be able to maintain the same DNS responses
on a recursive server if it exists in the Grid. You can preserve the original cached DNS responses by configuring a fixed
RRset order on the recursive server so it can return A and AAAA records associated with domain names in the original
order they were received. For information about configuring the RRset order for the cached DNS responses, see
Preserving the RRset Order for Cached DNS Responses on page 759.
To enable the configuration of RRset order for a host record:
1. From the Data Management tab -> DNS tab, expand the Toolbar, and then click Grid DNS Properties.
2. In the Grid DNS Properties editor, click Toggle Advanced Mode.
3. When the additional tabs appear, click the Advanced subtab of the General tab.
4. Complete the following:
— Enable setting RRset order for hosts with multiple addresses: Select this check box to enable the
configuration of RRset order for a host record. After you enable this feature, you can configure the RRset
order in the Host Record wizard or editor. For information, see Adding Host Records on page 579.
— Preserve host RRset order for Grid secondaries that use DNS zone transfers: This is enabled only when you
have enabled the setting of RRset order for host records. When you select this check box, the RRset order
that you configure for a host record applies to the resource records of the Grid secondaries that are in the
DNS transfer mode.
5. Save the configuration and click Restart if it appears at the top of the screen.

Preserving the RRset Order for Cached DNS Responses

By default, when a client queries a domain name, the DNS caching appliance returns the A and AAAA records of the
domain name in the cyclic order. However, this default behavior can be overridden if you have enabled and
configured (at the Grid level) fixed RRset order for hosts that have multiple addresses. When you override the default
behavior and preserve the fixed RRset order for cached DNS responses, the DNS caching appliance returns A and
AAAA records associated with domain names in the order they were received from an upstream server. You can
preserve the RRset order for the cached DNS responses and specify the fixed RRset order for A, AAAA, or both A and
AAAA records at the Grid level and override at the member and DNS view levels. Note that configuring fixed RRset
order for specific FQDNs might slightly affect the performance of the DNS caching appliance.
To preserve the fixed RRset order for cached DNS responses at the Grid, member, or DNS view level:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 759

Configuring DNS Services

1. Grid: From the Data Management tab -> DNS tab, expand the Toolbar, and then click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
DNS View: From the Data Management tab, select the DNS tab -> Zones tab -> dns_view check box -> Edit icon.
2. In the editor, select the RRset Order tab -> click the Basic tab, and then complete the following:
— Enable fixed RRset order for following FQDNs: Select this check box to preserve the configuration of RRset
order for cached DNS responses.
— In the FQDN table, specify the list of FQDN entries for which you want to preserve the RRset order. Note that
you can configure a maximum of 25 FQDNs for the specified RRset order.
You can click the Add icon and complete the following to add a new entry to the list:
— FQDN: Enter the fully qualified domain name with which the A or AAAA record is associated.

Note: For Infoblox-4030, if you enter a wildcard character as part of the domain name, the appliance considers
the wildcard character as a literal character. For example, if you enter test*.com, the appliance matches
the domain name with test*.com only.

— Record Type: Select the record type from the drop-down list. You can select A, AAAA, or Both A and
AAAA.
3. Save the configuration and click Restart if it appears at the top of the screen.

Specifying Port Settings for DNS

When requesting zone transfers from the primary server, some secondary DNS servers use the source port number
(the primary server used to send the notify message) as the destination port number in the zone transfer request. If
the primary server uses a random source port number when sending the notify message—that the secondary server
then uses as the destination port number when requesting a zone transfer—zone transfers can fail if there is an
intervening firewall blocking traffic to the destination port number.
Specifying a source port number for recursive queries ensures that a firewall allows the response. If you do not
specify a source port number, the NIOS appliance sends these messages from a random port number. You can also
specify a source for the DNS Traffic Control health check.
When performing recursive queries, the NIOS appliance uses a random source port number above 1024 by default.
The queried server responds using the source port number in the query as the destination port number in its
response. If there is an intervening firewall that does not perform stateful inspection and blocks incoming traffic to
the destination port number, the recursive query fails.
You can specify a source port number for notify messages to ensure the firewall allows the zone transfer request from
the secondary server to the primary server. If you do not specify a source port number, the NIOS appliance sends
messages from a random port number above 1024.
You can limit If you have configured anycast and non-anycast IP addresses on the loopback interface, you must
enable the appliance to provide DNS services on them. You can also configure the appliance to listen for DNS queries
on a specific IP address that you configure on the loopback interface, by separating the source port for DNS queries
from the port for notify messages and zone transfer requests. For information about the loopback interface and
anycast addressing, see Using the Loopback Interface on page 1032.

Specifying Source Ports

To specify port numbers and settings for queries, notify messages and zone transfer requests:
1. From the Data Management tab, select the DNS tab and click the Members tab -> member check box -> Edit icon.
2. In the editor, click Toggle Advanced Mode.
3. When the additional tabs appear, click the Advanced subtab of the General tab.
4. You can change the port settings as follows:

760 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Service Properties

— Listen on these additional IP addresses: Click the Add icon to add an anycast or non-anycast address you
configure on the loopback interface. You must add all IP addresses you configure on the loopback interface
so the appliance can provide DNS services on them. Adding source ports for listening supports both IPv4
and IPv6 interfaces. For information about adding IP addresses on the loopback interface, see Using the
Loopback Interface on page 1032.
— DTC health check source: Select a value from the drop-down list: VIP, MGMT, LAN2, ANY, IP. The appliance
displays VIP by default. For more information, see Viewing DNS Traffic Control Objects on page 1026.
— IP Address: This is displayed only when you select IP from the drop-down list. Specify the IP address of
the source.
— Send queries from: If you want to improve the DNS service performance, you can separate the DNS queries
from the notify messages and zone transfer requests. Select a value from the drop-down list to select an
interface name: VIP, MGMT, LAN2, ANY, IP. The appliance displays VIP by default.
— IP Address: This is displayed only when you select IP from the drop-down list. Specify the IP address of
the source.
— Send notify messages and zone transfer requests from: From the drop-down list, select the source port of
the notify messages and zone transfer requests that the Grid member sends. Select a value from the
drop-down list to select an interface name: VIP, MGMT, LAN2, ANY, IP. The appliance displays VIP by default.
You can only select a physical interface, you cannot select IP addresses on the loopback interface.
— IP Address: This is displayed only when you select IP from the drop-down list. Specify the IP address of
the source.
— Notify Delay: Specify the number of seconds that the Grid secondary servers delays sending notification
messages to the external secondaries. The default is five seconds.
5. Save the configuration and click Restart if it appears at the top of the screen.

Specifying Static Source Ports

To specify static source ports:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. Complete the following:
— Set static source UDP port for queries (not recommended): This is disabled by default. To override the value
that has been inherited from the Grid, click Override. Select this check box to enable it and enter the UDP
port number. To retain the same value as the Grid, click Inherit.
— Set static source UDP port for notify messages: This is disabled by default. To override the value that has
been inherited from the Grid, click Override. Select this check box to specify a source port for notify
messages to ensure that the firewall allows the zone transfer request from the secondary server to the
primary server. If you do not specify a source port, the appliance sends messages from a random port with
a number above 1024. To retain the same value as the Grid, click Inherit.
3. Save the configuration and click Restart if it appears at the top of the screen.

Using Extension Mechanisms for DNS (EDNS0)

The NIOS appliance supports EDNS0 (Extension Mechanisms for DNS), which allows DNS clients to expand and
advertise up to 4096 bytes of UDP packets for certain DNS parameters. EDNS0 facilitates the transfer of UDP packets
beyond the original restricted packet size of 512 bytes. As defined in RFC 6891, EDNS0 provides extended UDP
packet size that supports additional DNS functionality, such as DNSSEC. When EDNS0 is supported, the DNS client
adds information to the additional data section of a DNS request in the form of an OPT pseudo-RR (resource record).
An OPT RR does not contain actual DNS data and its contents pertain to the UDP transport layer message only. An OPT
RR is not cached, forwarded, or stored. For more information about EDNS0, refer to RFC 6891 Extension Mechanisms
for DNS (EDNS0).

NIOS 7.3 NIOS Administrator Guide (Rev. A) 761

Configuring DNS Services

EDNS0 is enabled on the NIOS appliance by default, which means all outgoing recursive queries are set to have a
maximum UDP packet size of 4096 bytes. Typically, when the appliance receives a DNS request that contains an OPT
RR, it assumes the DNS client supports EDNS0 and thus scales its response accordingly. When the appliance is used
as a forwarder or a resolver for recursive queries and communicates with a client that does not support EDNSO, the
appliance sends three queries starting with one that contains EDNS0 and DNSSEC support messages and is set to a
maximum UDP packet size of 4096 bytes. When the first query fails, the appliance sends another query that contains
only the EDNS0 support message. If the second attempt fails too, the appliance sends a third query that indicates a
standard 512-byte query. Note that when EDNS0 is not used, DNS packets may be sent over TCP. For DNS service to
function properly at this stage, ensure that you configure your firewall accordingly.
The following information demonstrates how the appliance responds when EDNS0 is enabled by default and the end
server does not support EDNS0:
Packet 0954: 08:19:38.925 - query for www.google.com from Infoblox to forwarder (with
EDNS0 support by setting the Extended Label Type to ‘01’ and DNSSEC OK bit to ‘1’)
Packet 1138: 08:19:47.927 - query for www.google.com from Infoblox to forwarder (with
EDNS0 support by setting the Extended Label Type to ‘01’ and DNSSEC OK bit to ‘0’)
Packet 1504: 08:19:58.929 - query for www.google.com from Infoblox to forwarder (without
EDNS0 and DNSSEC support by sending a standard 512-byte query)
Packet 1505: 08:19:30:960 - query response for www.google.com from forwarder to Infoblox
To ensure that end servers that do not support EDNS0 can respond to recursive queries from the NIOS appliance and
to improve DNS performance, you can disable EDNS0 for the Grid and override the Grid settings for individual
members. Note that you cannot configure the maximum UDP packet size, which is set for 4096 bytes by default. When
you disable EDNS0, the appliance does not include OPT RRs for all outgoing recursive DNS queries. Thus remote end
servers that do not support EDNS0 can still respond to the queries. This feature is useful when your NIOS appliance
is used as a forwarder or a resolver for recursive queries, and the end servers in the configuration do not support
EDNS0.

WARNING: When you disable EDNS0, all outgoing DNSSEC queries to zones within trusted anchors will fail
even if DNSSEC validation is enabled. This is due to the restriction of the UDP packet length when
you disable EDNS0. For information about DNSSEC, see About DNSSEC on page 965.

To disable EDNS0:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
2. In the Grid DNS Properties or Member DNS Properties editor, click the General tab -> Advanced tab, and complete
the following:
— Disable EDNS0: This check box is deselected and EDNS0 is enabled by default. To override the value
inherited from the Grid, click Override. To retain the same value as the Grid, click Inherit. Select this check
box to disable EDNS0. When you disable EDNS0, the appliance does not include OPT RRs for all outgoing
recursive DNS queries and all outgoing DNSSEC queries to zones within trusted anchors will fail even if
DNSSEC validation is enabled.
3. Save the configuration and click Restart if it appears at the top of the screen.

Deleting PTR Records associated with A or AAAA Records

You can configure the appliance to confirm whether to delete a PTR record when its corresponding A or AAAA record
is being deleted. This feature is valid only if you have configured the appliance to automatically generate a PTR record
when you create an A or AAAA record. For information about adding an A or AAAA record, see Adding A Records on
page 881 and Adding AAAA Records on page 883. When you delete a resource record, the appliance moves it to the
Recycle Bin, if enabled. You can later restore it if needed. Note that this option is disabled by default for all new
installations.
To enable this option:

762 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS Cache

1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
2. In the Grid DNS Properties , click the General tab -> Advanced tab, and complete the following:
— Enable PTR record removal for A/AAAA records: This check box is deselected by default. When you select
this check box, the appliance displays the Delete Confirmation dialog box to confirm that you want to delete
a PTR record associated with the A or AAAA record that is being deleted. For information about deleting an A
or AAAA record, see Modifying, Disabling, and Deleting Host and Resource Records on page 899.
3. Save the configuration and click Restart if it appears at the top of the screen.

Specifying Minimal Responses

A NIOS appliance returns a minimal amount of data in response to a query, by default. It includes records in the
authority and additional data sections of its response only when required, such as in negative responses. This feature
speeds up the DNS services provided by the appliance.
To disable returning minimal responses:
1. From the Data Management tab, select the DNS tab and click the Members tab -> member check box -> Edit icon.
2. In the Member DNS Configuration editor, click General -> Basic tab.
3. Clear the Return minimal responses check box.
4. Save the configuration and click Restart if it appears at the top of the screen.

Starting and Stopping the DNS Service

The DNS service is disabled by default. After you complete the DNS configuration, you can start DNS service on a
member. You can also disable the DNS service on any Grid member. Be aware that disabling the DNS service on a
member removes the NS records from it. If you later re-enable DNS service for this member, the NS records are then
restored.
To start DNS service on a member:
1. From the Data Management tab, select the DNS tab -> Members tab -> member check box -> click the Edit icon.
2. In the Member DNS Properties editor, click General -> Basic tab, and do the following:
— LAN1: Select IPv4 to start the DNS service using IPv4 or select IPv6 to start the DNS service using IPv6. Note
that for a dual mode member, IPv4 will be selected by default.
3. Save the configuration.
4. Expand the Toolbar and click Start.
5. In the Start Member DNS Service dialog box, click Yes.
Grid Manager starts the DNS service on the selected member.
You can stop DNS service on a member by selecting the member check box and click Stop from the Toolbar.

About DNS Cache

The NIOS appliance allows you to clear certain information from the DNS cache. You can do the following:
• Clearing DNS Cache on page 763
• Clearing Cache for DNS Views on page 764
• Clearing Domain Names from Cache on page 764

Clearing DNS Cache

You can clear all the entries that are saved in the DNS cache. When you clear DNS cache on the NIOS appliance, entire
BIND recursive cache is cleared.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 763

Configuring DNS Services

To clear DNS cache:

1. From the Data Management tab, select the DNS tab -> Members tab -> member check box.
2. Expand the Toolbar, click Clear -> Clear DNS Cache.
3. Click Yes in the confirmation dialog box to clear DNS cache.

Clearing Cache for DNS Views

You can configure the NIOS appliance to clear cache of a specific DNS view. This feature clears cache entries of a
specific DNS view that is associated with the selected member.
To clear cache of a DNS view:
1. From the Data Management tab, select the DNS tab -> click the Members tab.
2. Expand the Toolbar, click Clear -> Clear View’s Cache.
3. Specify the following in the Clear View’s Cache dialog box:
— Member: Click Select Member to select a member. If there are multiple members, the Member Selector
dialog box is displayed, from which you can select a member. Click the required member name in the dialog
box. You can also click Clear to clear the displayed member and select a new one.
— DNS View: Select a DNS View from the drop-down list. This list box appears only when there are multiple
DNS views in the network view.
— Click Clear Cache to clear the cache entries of the corresponding DNS View.

Note: The entire name server recursive cache is cleared, if you do not specify a DNS view when you clear cache
using Clear View’s Cache and Clear Domain Name features on the NIOS appliance.

Clearing Domain Names from Cache

You can clear specific domain names from the DNS cache. The selected domain name entry is deleted from the BIND
recursive cache.
To clear a domain name:
1. From the Data Management tab, select the DNS tab -> click the Members tab.
2. Expand the Toolbar, click Clear -> Clear Domain Name.
3. Specify the following in the Clear Domain Name from Cache dialog box:
— Domain Name: Enter a domain name you want to delete.
— Member: Click Select Member to select a member. If there are multiple members, the Member Selector
dialog box is displayed, from which you can select a member. Click the required member name in the dialog
box. You can also click Clear to clear the displayed member and select a new one.
— DNS View: Select a DNS View from the drop-down list. This list box appears only when there are multiple
DNS views in the network view.
— Click Clear Domain Name to clear the domain name from the cache.

Viewing DNS Cache Entries

The NIOS appliance allows you to view certain information that is stored in the DNS cache. You can do the following:
• Viewing DNS Configuration on page 765
• Viewing DNS Cache Details on page 766
• Viewing Statistics on page 766

764 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing DNS Cache Entries

Viewing DNS Configuration

The NIOS appliance supports View Configuration feature that enables you to view DNS configuration details. You can
view the configuration details through a browser.
To view DNS configuration:
1. From the Data Management tab, select the DNS tab -> click the Members tab.
2. Expand the Toolbar, click View -> View Configuration.

Sample Output
include "/infoblox/var/named_conf/tsig.key";

options {
zone-statistics yes;
directory "/infoblox/var/named_conf";
version none;
hostname none;
recursion yes;
listen-on { 127.0.0.1; 10.34.1.18; };
query-source address 10.34.1.18 port *;
notify-source 10.34.1.18 port *;
transfer-source 10.34.1.18;
minimal-responses yes;
max-cache-size 536870912;
infoblox-top-query yes;
infoblox-top-query-log-interval 60;
infoblox-top-query-client 500;
infoblox-top-query-name 500;
infoblox-top-query-rr-type 500;
infoblox-top-query-nxdomain 500;
infoblox-top-query-servfail 500;
infoblox-top-query-rpz 99;
infoblox-top-query-rpz-items-per-client 100;
lame-ttl 600;
# for service restart: allow_bulkhost_ddns = Refusal
allow-transfer { any; };
forwarders { 10.32.0.177; };
avoid-v4-udp-ports { 2114; 2113; 2115; 8000; 8089; 9997; 2222; 7911; 7912; 8000; 8089; 9997;
8080; 9000; 9999; 9004; 2022; 3374; 3115; 1194; };
transfer-format many-answers;
};

# Worker threads: default

# Bulk Host Name Templates:

#Four Octets: "-$1-$2-$3-$4" (Default)
#One Octet: "-$4"
#Three Octets: "-$2-$3-$4"
#Two Octets: "-$3-$4"

include "/infoblox/var/named_conf/dhcp_updater.key";

NIOS 7.3 NIOS Administrator Guide (Rev. A) 765

Configuring DNS Services

include "/infoblox/var/named_conf/rndc.key";

controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};

logging {
channel ib_syslog {
syslog daemon;
severity info;
};
category default { ib_syslog; };
category rpz { null; };
};

acl all_dns_views_updater_keys { key DHCP_UPDATER_default; key DHCP_UPDATER1; key

DHCP_UPDATER3; };

Viewing DNS Cache Details

You can view data stored in cache for the DNS views that are configured in the NIOS appliance. You can view the
details through a browser.
To view cache details:
1. From the Data Management tab, select the DNS tab -> click the Members tab.
2. Expand the Toolbar, click View -> View Cache.

Sample Output
;; Start view _default
;;; Cache dump of view '_default' (cache _default)
;$DATE 20121018180555
; authanswer
a.test.com.23876IN A4.4.4.4
;; Address database dump
;; Dump complete

Viewing Statistics
The View Statistics feature enables you to view DNS Statistics of a Grid member. You can view statistics through a
browser.
To view statistics:
1. From the Data Management tab, select the DNS tab -> click the Members tab.
2. Expand the Toolbar, click View -> View Cache.
You can view statistics in the DNS Statistics for Member dialog box.

766 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using Forwarders

Using Forwarders
A forwarder is essentially a name server to which all other name servers first send queries that they cannot resolve
locally. The forwarder then sends these queries to DNS servers that are external to the network, avoiding the need for
the other name servers in your network to send queries off-site. A forwarder eventually builds up a cache of
information, which it uses to resolve queries. This reduces Internet traffic over the network and decreases the
response time to DNS clients. This is useful in organizations that need to minimize off-site traffic, such as a remote
office with a slow connection to a company’s network.
You can select any Grid member to function as a forwarder. You must configure your firewall to allow that Grid member
to communicate with external DNS servers. You can also configure the NIOS appliance to send queries to one or more
forwarders.
You can define a list of forwarders for the entire Grid, for each Grid member, or for each DNS view.

Specifying Forwarders
To configure forwarders for a Grid, member, or DNS view:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
DNS View: From the Data Management tab, select the DNS tab -> Zones tab -> dns_view check box -> Edit icon.
Note that if there is only one DNS view— for example, the predefined default view—you can just click the Edit
icon beside it.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. Click the Forwarders tab.
3. Click the Add icon.
4. Enter an IP address in the text field. The field supports entry for both IPv4 and IPv6 values.
— To remove a forwarder, select the IP address from the Forwarders list, and then click the Delete icon.
— To move a forwarder up or down on the list, select it and click the Up or Down arrow.
5. To use only forwarders on your network (and not root servers), select the Use Forwarders Only check box.
6. Save the configuration and click Restart if it appears at the top of the screen.

Controlling DNS Queries

By default, the NIOS appliance responds to DNS queries from any IP address. You can create a list of queriers to which
the appliance is allowed to respond; restricting it to specific networks, IP addresses, and remote servers that present
specified TSIG (transaction signature) keys. When using TSIG keys, it is important that the appliances and servers
involved with the authentication procedure use NTP (Network Time Protocol) for their time settings (see Using NTP for
Time Settings on page 405).
In addition, you can also configure the appliance to respond to recursive queries. A recursive query requires the
appliance to return requested DNS data, or locate the data through queries to other servers. Recursion is disabled by
default. If you enable this feature, you can also create a list of allowed recursive queries. For information about
allowing recursion, refer to Enabling Recursive Queries on page 769.
You can create a list of allowed queriers for the Grid and for individual Grid members.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 767

Configuring DNS Services

Specifying Queries
To configure a list of allowed queriers for the Grid or for a member:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the Grid DNS Properties or Member DNS Properties editor, click Toggle Advanced Mode, select the Queries tab.
3. In the Allow queries from section, select one of the following:
— None: Select this if you do not want to configure access control for DNS queries. The appliance allows
queries from all clients. This is selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this, the appliance allows clients that
have the Allow permission to send and receive DNS queries. You can click Clear to remove the selected
named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows:
— IPv4 Address and IPv6 Address: Select this to add an IPv4 address or IPv6 address. Click the Value field
and enter the IP address of the remote querier. The Permission column displays Allow by default. You
can change it to Deny by clicking the field and selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.
— TSIG Key: In the Add TSIG Key panel, complete the following, and then click Add to add the TSIG key to
the list:
• Key name: Enter a meaningful name for the key, such as a zone name or the name of the remote
name server. This name must match the name of the same TSIG key on other name servers.
• Key Algorithm: Select either HMAC-MD5 or HMAC-SHA256.
• Key Data: To use an existing TSIG key, type or paste the key in the Key Data field. Alternatively, you
can select the key algorithm, select the key length from the Generate Key Data drop down list, and
then click Generate Key Data to create a new key.
— Any Address/Network: Select to allow or deny queries from any IP addresses.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE or multiple ACEs and click the Delete icon to delete the entries.
4. Save the configuration.

768 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Enabling Recursive Queries

Enabling Recursive Queries

You can enable the appliance to respond to recursive queries and create a list of allowed networks, IP addresses, and
remote servers that present specified TSIG (transaction signature) keys. When using TSIG keys, it is important that
the appliances and servers involved with the authentication procedure use NTP (Network Time Protocol) for their time
settings (see Using NTP for Time Settings on page 405).
A recursive query requires the appliance to return requested DNS data, or locate the data through queries to other
servers. When a NIOS appliance receives a query for DNS data it does not have and you have enabled recursive
queries, it first sends a query to any specified forwarders. If a forwarder does not respond (and you have disabled the
Use Forwarders Only option in the Forwarders tab of the Member DNS Properties editor), the appliance sends a
non-recursive query to specified internal root servers. If no internal root servers are configured, the appliance sends
a non-recursive query to the Internet root servers. For information on specifying root name servers, see About Root
Name Servers on page 792.
You can enable recursion for a Grid, individual Grid members, and DNS views. For information about enabling
recursion in a DNS view, see Configuring DNS Views on page 814. If you do not enable recursion, the appliance
denies recursive queries from all clients.

Enabling Recursion
To enable recursion and create a list of recursive queriers:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the Grid DNS Properties or Member DNS Properties editor, click Toggle Advanced Mode, select the Queries tab.
3. Click Allow recursion, and then in the Allow recursive queries from section, select one of the following:
— None: Select this if you do not want to configure access control for recursive queries. When you select
None, the appliance allows recursive queries from all clients. This is selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this, the appliance allows clients that
have the Allow permission to send and receive recursive DNS queries. You can click Clear to remove the
selected named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.
— IPv4 Address and IPv6 Address: Select this to add an IPv4 address or IPv6 address. Click the Value field
and enter the IP address of the remote querier. The Permission column displays Allow by default. You
can change it to Deny by clicking the field and selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.
— TSIG Key: In the Add TSIG Key panel, complete the following, and then click Add to add the TSIG key to
the list:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 769

Configuring DNS Services

• Key name: Enter a meaningful name for the key, such as a zone name or the name of the remote
name server. This name must match the name of the same TSIG key on other name servers.
• Key Algorithm: Select either HMAC-MD5 or HMAC-SHA256.
• Key Data: To use an existing TSIG key, type or paste the key in the Key Data field. Alternatively, you
can select the key algorithm, select the key length from the Generate Key Data drop down list, and
then click Generate Key Data to create a new key.
— Any Address/Network: Select to allow or deny queries from any IP addresses.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
4. Save the configuration.

Restricting Recursive Client Queries

By default, the appliance can serve up to 1,000 outstanding recursive client queries. You can change this default
value according to your business needs. After you configure the recursive client queries limit, you can enable the
appliance to send SNMP traps for recursive queries. Enabling SNMP traps for recursive clients can help you identify
possible flood attacks on the DNS recursive server. The appliance sends SNMP traps when the number of recursive
client queries exceeds the configured thresholds. For information about how to set the threshold and reset values,
see Defining Thresholds for Traps on page 1369.
1. From the Data Management tab, select the DNS tab and click the Members tab -> member check box -> Edit icon.
2. In the Member DNS Properties editor, click Toggle Advanced Mode.
3. When the additional tabs appear, click the Advanced subtab of the Queries tab.
4. Select the Limit number of recursive clients to option and enter a number.
5. Save the configuration and click Restart if it appears at the top of the screen.

Controlling AAAA Records for IPv4 Clients

By default, the NIOS appliance returns resource records, including AAAA records, in response to DNS queries. You can
enable the appliance to filter and remove AAAA records in response to queries received over IPv4 for each name
server and DNS view. This feature is useful in a configuration where a client issues a DNS query over IPv4 when it
does not have the ability to use an IPv6 address. When a response returns an IPv6 address however, the client that
sends the query over an IPv4 transport would lose connectivity. By enabling AAAA filtering, you can configure your
name server not to return AAAA records to clients that request queries over an IPv4 transport. Presumably, these
clients then re-query the name server for A records for the same domain name.
Depending on your configuration, the appliance can remove AAAA records for all queries over IPv4 (even when
DNSSEC is enabled), or only for queries that are not DNSSEC-signed. You can also create a list of IPv4 networks and
addresses to which the appliance applies AAAA filtering and vice versa. You can enable and configure AAAA filtering
for the Grid, members, and DNS views.
To control whether you want the appliance to return AAAA records for queries sent over IPv4, you must first enable
AAAA filtering, and then create a list of IPv4 networks and addresses that allow or deny AAAA filtering from the
appliance, as described in Enabling AAAA Filtering.

770 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Controlling AAAA Records for IPv4 Clients

Note: An AAAA record is filtered only when there is also an A record for the same domain name. In this case, the
appliance still sends a response, but without any AAAA or A record in it. When a client queries for an AAAA
record and there is no corresponding A record for it, the appliance returns the AAAA record even if you have
enabled AAAA filtering for this client.

Enabling AAAA Filtering

To enable AAAA filtering and configure a list of IPv4 networks and addresses:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
DNS View: From the Data Management tab, click the DNS tab -> Zones tab-> dns_view check box -> Edit icon.
To override Grid settings, click Override and complete the appropriate fields.
2. In the editor, click the Queries tab and complete the following:
Enable AAAA Filtering: From the drop-down list, select one of the following:
— Break DNSSEC: Select this to remove AAAA records in response to queries sent over IPv4, including those
that are signed by DNSSEC.

Note: Be aware that when you select this option, DNSSEC configuration will no longer be in effect.

— No: Select this to disable AAAA filtering for queries over IPv4. When you select this, the appliance returns
AAAA records in response to all DNS queries issued over IPv4. This is selected by default.
— Yes: Select this to enable AAAA filtering for queries over IPv4. When you select this, the appliance removes
AAAA records in response to all DNS queries issued over IPv4, except for DNSSEC-signed requests.
3. In the AAAA Filtering section, select one of the following:
— None: Select this if you do not want to configure access control for AAAA filtering. The appliance allows all
clients to issue DNS queries over IPv4 when they do not have the ability to use IPv6 addresses. This is
selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this, the appliance allows clients that
have the Allow permission can filter AAAA responses. You can click Clear to remove the selected named
ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.
— IPv4 Address: Select this to add an IPv4 address. Click the Value field and enter the IP address of the
client. The Permission column displays Allow by default. You can change it to Deny by clicking the field
and selecting Deny from the drop-down list. When you select Allow, the appliance applies AAAA
filtering and removes AAAA records in response to queries sent by the specified IPv4 address. When
you select Deny, the appliance does not apply AAAA filtering and thus returns AAAA records.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— Any Address/Network: Select to allow or deny AAAA filtering from any IP addresses.
After you have added access control entries, you can do the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 771

Configuring DNS Services

• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.

Note: Note that if you do not enter any addresses or networks in the table, the appliance applies AAAA filtering
to all IPv4 clients. In other words, the appliance removes AAAA records in responses to all queries sent
over IPv4.

About NXDOMAIN Redirection

When a DNS member with recursion enabled receives a recursive query for data for which it is not authoritative, it
locates the data through queries to other servers. If the query is for a non-existent domain name, the DNS member
receives an NXDOMAIN response from the authoritative name server, which the member then forwards to the DNS
client. An NXDOMAIN response contains a “Name Error” RCODE, signifying that the domain name referenced in the
query does not exist. (For information, you can refer to RFC 1035, Domain Names — Implementation and
Specification.)
You can install a Query Redirection license on a recursive DNS member to control its response to queries for A records
of non-existent domain names and other domain names that you specify. After the license is installed, Grid Manager
displays the NXDOMAIN Rulesets tab where you can create rules that specify how a DNS member responds to queries
for A records for certain domain names and non-existent domain names. Each rule contains a domain name
specification, and the action of the DNS member when the domain name in the query matches that in the rule. After
you create the rules, you then enable the NXDOMAIN redirection feature and list the IP addresses that are included
in the synthesized responses.
Recursive DNS members can redirect responses to queries for A records only. DNS members resolve queries for all
other records as they normally would.
In addition, you can enable DNS members to log queries that match rules with an action of “Redirect” or “Modify”.
You can view the logs in the Syslog viewer. The logs include the queried domain name, source IP address, the pattern
of the matched rule, and the name of the corresponding ruleset.
When DNSSEC is enabled on the Infoblox DNS server, it does not redirect DNS clients that request DNSSEC data for a
non-existent domain name. Instead, it returns an authenticated negative response in the form of an NSEC or NSEC3
RR. (For information about DNSSEC, see Chapter 22, DNSSEC, on page 963.) If DNSSEC is not enabled, the appliance
ignores the request for DNSSEC data and redirects the clients.
To apply the configured NXDOMAIN rules regardless of whether a DNS query requests DNSSEC data, configure the
appliance accordingly. For more information about how to configure this, see Applying Policies and Rules to DNS
Queries that Request DNSSEC Data on page 995.
You can enable NXDOMAIN redirection at the Grid, member, and DNS view levels. Only recursive DNS servers can
redirect DNS clients. Non-recursive DNS members do not redirect DNS clients. For information on enabling recursion
on a DNS member, seeEnabling Recursive Queries on page 769.
Note that if both NXDOMAIN redirection and the blacklisting feature are enabled, the DNS member applies the
blacklist rulesets before the NXDOMAIN rulesets. For information about blacklisting domain names, see About
Blacklists on page 784.

772 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About NXDOMAIN Redirection

About NXDOMAIN Rulesets

An NXDOMAIN ruleset is a list of rules that a DNS member uses to determine its response to recursive queries for A
records it does not have. Each rule consists of a domain name specification or pattern, and an associated action.
Domain names can contain any printable character. You can use certain metacharacters to create domain name
patterns that are used to match the domain names in DNS queries. Pattern matching is case-insensitive. Patterns
support the following metacharacters:
• Use the caret character (^) to indicate the beginning of a pattern. For example, ^foo matches foo.com but not
barfoo.com. The caret character has a special meaning only if it is specified at the beginning of a pattern.
• Use the dollar sign character ($) to indicate the end of a pattern. The dollar sign character has a special
meaning, only if it is specified at the end of the pattern. For example, .com$ matches corp100.com but not
corp100.com.net.
When the pattern contains a $ at the end, NIOS automatically adds a period (.) before the $. For example, if you
enter .com$, NIOS saves it as .com.$. The period indicates that the pattern specifies a complete domain name
that ends with the root label.
• Use the asterisk character (*) as a wildcard that can match zero or more characters in one or more labels of a
domain name. For example, xf*oy matches xfooy.com, but not xfoobary.
A pattern that contains a single asterisk (*) (or an equivalent expression, such as “^*$”) matches any domain
name.
• Use the backslash character (\) with one of the metacharacters ($, ^, * and \) to remove their special meaning. If
\ is followed by any other character, that character is taken as an ordinary character, as if \ is not present. For
example, foo\\\.bar matches foo\.bar, and \* matches a literal asterisk in a domain name.
No other characters have any special meaning. Note in particular that the period character (“.”) only matches a period
used as a separator in a domain name.
The action specifies how the DNS member responds when a domain name in a query matches a pattern. The action
can be one of the following: Pass, Modify or Redirect.
• Pass: The DNS member resolves the query and forwards the response to the DNS client, even if it is an
NXDOMAIN response.
• Modify: The DNS member resolves the query and forwards the response to the DNS client, only if it is not an
NXDOMAIN response. But if the member receives an NXDOMAIN response, it sends the client a synthesized
response that includes predefined IP addresses.
• Redirect: The DNS member does not resolve the query. Instead, it sends the client a synthesized response that
includes predefined IP addresses.
You can configure multiple rulesets. The DNS member applies the rulesets and their rules in the order in which they’re
specified in the configuration. If multiple rulesets contain rules with duplicate patterns, the DNS member applies the
first rule it encounters and ignores the other rules.

Examples
The following example illustrates how the appliance applies NXDOMAIN rulesets.
Ruleset 1:

Pattern Action
a1.corp100.com PASS
*.corp100.com REDIRECT

• If the DNS member receives a query for a1.corp100.com, it resolves the query and forwards the response, even
if it is an NXDOMAIN response, to the client. Note that if the order of the rules was switched, the DNS client
would have been redirected immediately, because the domain name a1.corp100.com matches the
*.corp100.com pattern.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 773

Configuring DNS Services

• If the DNS member receives a query for b1.corp100.com, the member immediately redirects the DNS client to
the specified IP address because the domain name in the query matches the second rule.
• If the DNS member receives a query for b1.corp200.com, it resolves the query because the domain name does
not match any rule. If the DNS member receives an A record from an authoritative server, the member forwards
the response to the client. However, if the member receives an NXDOMAIN response, it redirects the DNS client
to the specified IP address.
In the following example, the rules redirect queries for dotted domain names that do not have “.com” As shown in
the example, an explicit PASS rule is required at the end.
Ruleset 2:

Pattern Action
*.com PASS
.*.$ MODIFY
* PASS

• If the DNS member receives a query for corp100.com which matches the pattern “*.com”, the member resolves
the query and forwards the response, even if it is an NXDOMAIN response, to the client.
• If the DNS member receives a query for corp100.org, which matches the pattern “.*.$”, the member resolves the
query. If the member receives an NXDOMAIN response, it redirects the client to the specified IP address. If the
member receives a non-NXDOMAIN response, it forwards the response to the client.
• If the DNS member receives a query for corp200, the member resolves the query and forwards the response to
the client.

NXDOMAIN Redirection Guidelines

The following summarizes how a DNS member responds to a query for an A record when the NXDOMAIN feature is
enabled:
• If there are no rulesets configured, the DNS member queries other name servers.
— If the DNS member receives a non-NXDOMAIN response from an authoritative server, it forwards the
response to the DNS client.
— If the DNS member receives an NXDOMAIN response from an authoritative server, it redirect the DNS client.
• If rulesets are configured, the DNS member tries to match the domain name in the query with a domain name in
the rules.
— If the DNS member finds a match, it perform the action specified in the rule.
— If the action is “Redirect”, the DNS member redirect the DNS client.
— If the action is “Pass”, the DNS member queries other name servers and forwards the response to the
DNS client.
— If the action is “Modify”, the DNS member queries other name servers. If it receives a non-NXDOMAIN
response, it forwards the response to the DNS client; if it receives and NXDOMAIN response, it redirects
the DNS client.
— If the DNS member does not find a match, the DNS member queries other name servers.
— If the DNS member receives a non-NXDOMAIN response, it forwards the response to the DNS client.
— If the DNS member receives an NXDOMAIN response from an authoritative server, it redirects the DNS
client.
Note that if an A record with a dotted hostname is added to an authoritative zone through a dynamic DNS update,
and that A record should actually belong in an existing delegation, the appliance may not redirect a query for that A
record according to the Blacklist and NXDOMAIN guidelines.

774 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About NXDOMAIN Redirection

Configuring NXDOMAIN Redirection

To enable NXDOMAIN redirection and configure its properties:
1. Configure NXDOMAIN rulesets. You can create NXDOMAIN rulesets through Grid Manager, as described in
Creating Rulesets. You can also specify the rulesets in a CSV file and import the file to the Grid, as described in
About CSV Import on page 101.
2. Enable this feature and specify the redrection IP addresses, as described in Enabling NXDOMAIN Redirection on
page 776.

Creating Rulesets
To create a ruleset:
1. From the Data Management tab -> DNS tab -> NXDOMAIN Rulesets tab, click the Add icon.
2. In the NXDOMAIN Ruleset wizard, complete the following and click Next:
— Name: Enter a name for the ruleset.
— Comment: You can enter additional information.
— Disable: You can disable this ruleset for use later on. The appliance ignores disabled rulesets.
3. Click the Add icon to add a rule to the ruleset table.
— In the Pattern column, enter a domain name or pattern, using the guidelines specified in About NXDOMAIN
Rulesets.
— In the Action column, select PASS, REDIRECT or MODIFY.
— In the Order column, NIOS automatically displays the number of the entry in the list.
The appliance applies the rules in the order they are listed. You can order the list as follows:
— Use the up and down arrows to move rules up or down on the list.
— Use the go-to-top or go-to-bottom arrow to move a rule to the top or bottom of the list.
— Change the Order number of a rule to move it to the desired location.
— Delete a rule by selecting it and clicking the Delete icon.
4. Save the configuration and click Restart if it appears at the top of the screen.

Managing NXDOMAIN Rulesets

To view NXDOMAIN rulesets, navigate to the Data Management tab -> DNS tab -> NXDOMAIN Rulesets tab. The panel
lists the configured rulesets and their associated comments. You can also display the Disabled column which
indicates which rulesets are disabled. From this panel, you can do the following:
• Add more rulesets, as described in the preceding section, Creating Rulesets.
• Edit a ruleset, by clicking its check box and clicking the Edit icon. You can set the following in the NXDOMAIN
Ruleset editor:
— In the General Basic tab, you can change entries in any of the fields.
— In the Rules tab, you can do the following:
— Add a rule by clicking the add icon and specifying the pattern and action.
— Change the pattern or action of a rule, by clicking in the appropriate row.
— Delete a rule by clicking its check box and clicking the Delete icon.
— Move rules up and down, by using the arrows.
— In the Permissions tab, you can set admin permissions for the ruleset. For information about admin
permissions, see Chapter 4, Managing Administrators, on page 183.
• Delete a ruleset, by clicking its check box and clicking the Delete icon.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 775

Configuring DNS Services

Enabling NXDOMAIN Redirection

Only DNS members with recursion enabled can support NXDOMAIN redirection.
You can enable this feature at the Grid level, and override it for a member or DNS view with recursion enabled. You
must specify at least one IP address as the redirection destination. You can specify different redirection IP addresses
and rulesets for each Grid member or DNS view, and you can also define members that do not provide redirection.
This is useful when you want to define a set of “opt out” servers for DNS clients that do not want to be redirected.
You can also enable the DNS member to log queries that match rules with an action of “Redirect” or “Modify”. The
logs include the queried domain name, source IP address, the pattern of the matched rule, and the name of the
corresponding ruleset. The DNS member does not log queries that matched rules with an action of “Pass”.
To enable NXDOMAIN redirection:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
DNS View: From the Data Management tab, select the DNS tab and click the Zones tab -> dns_view check box ->
Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. If the Grid DNS Properties or Member DNS Properties editor is in basic mode, click Toggle Advanced Mode.
3. Click NXDOMAIN and complete the following:
— Enable NXDOMAIN redirection (recursive members only): Select this option to enable recursive DNS
members to synthesize their responses to DNS queries for A records.
— Redirect to: Click the Add icon and enter the IP addresses that the DNS server includes in its synthesized
response. You must specify at least one IP address. You can add up to 12 IP addresses.
— TTL: Specify how long the DNS client caches the A record with the redirected IP address.
— Rulesets: Click the Add icon to add an NXDOMAIN ruleset. Use the up and down arrows to move rulesets up
and down in the list. The appliance applies them in the order they are listed.
— Log redirected queries: Select this check box to log the redirected queries to syslog.
4. Save the configuration and click Restart if it appears at the top of the screen.

Detecting and Mitigating DNS DDoS Attacks

DNS is a tempting target for attacks given that most traditional enterprise firewalls are configured to allow port 53
traffic to service DNS, which gives attackers an easy way to evade your firewall implementation. Since DNS queries
are asymmetrical, they can result in a response many times larger than the query, which means that your DNS system
can be used to amplify an attack.
To protect your DNS servers and DNS service performance, Infoblox provides the following features to detect and
mitigate DNS DDoS attacks, such as NXDOMAIN attacks:
• Automated mitigation of phantom domain attacks (a subset of NXDOMAIN attacks), as described in Automated
Mitigation of Phantom Domain Attacks on page 777.
• Configurable parameters used to detect possible NXDOMAIN attacks, as described in Detecting NXDOMAIN
Attacks on page 779.
• Mitigation of NXDOMAIN responses by removing the LRU (Least Recently Used) items from the list of NX
(non-existent) RRsets. The appliance uses the LRU list to select entries for removal from the cache when the
cache utilization exceeds the allowed threshold. For more information, see Mitigating Possible NXDOMAIN
Attacks on page 783.
• CLI commands for configuring RRL (Response Rate Limiting) to mitigate DNS DDoS attacks by reducing the rate
at which authoritative servers respond to high volumes of malicious queries, as described in Support for RRL
(Response Rate Limiting) on page 784.

776 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Automated Mitigation of Phantom Domain Attacks

Infoblox also offers the following security features to fully protect your DNS infrastructure and implementation:
• Infoblox Internal DNS Security on page 1589
• Infoblox External DNS Security on page 1561
• Infoblox DNS Firewall on page 1669

Automated Mitigation of Phantom Domain Attacks

A phantom domain attack happens when the attacker sets up “phantom” domains that do not respond to DNS
queries. Under normal circumstances, the DNS recursive server contacts authoritative servers to resolve recursive
queries. When phantom domain attacks happen, the recursive server continues to query non-responsive servers,
which causes the recursive server to spend valuable resources waiting for responses. When resources are fully
consumed, the DNS recursive server may drop legitimate queries, causing serious performance issues.
NIOS provides a few configurable parameters for mitigating phantom domain attacks in which recursive server
continues to query non-responsive servers. Before you configure any of the parameters for mitigating phantom
domain attacks, review the guidelines that might help you understand the relationship between these parameters.
For information, see Guidelines for Mitigating Phantom Domain Attacks.
To configure parameters for mitigating phantom domain attacks, see Configuring Parameters for Mitigating Phantom
Domain Attacks on page 777.
All events related to these operations are logged to the syslog. For information about the syslog and how to use it,
see Using a Syslog Server on page 1334.

Guidelines for Mitigating Phantom Domain Attacks

To detect phantom domain attacks, you can review your log messages. One possible indication of attack is when you
receive a log message similar to the following:
2015-04-29T10:20:06+00:00 daemon infoblox named[25390]: warning no more recursive
clients: quota reached
Consider the following guidelines to mitigate the attack:
• Increase the number of recursive clients.
• Use a combination of the following parameters to achieve optimum results:
— Limit recursive queries per server and Limit recursive queries per zone
— Enable holddown for non-responsive servers and Limit recursive queries per zone
• When you enable any of the options, the default values are set at an optimum level for general operations.
Infoblox recommends that you keep the default values when using these commands. Ensure that you
understand the ramifications if you want to change the default values.

Configuring Parameters for Mitigating Phantom Domain Attacks

Note: Changes made to the configuration for mitigating phantom domain attacks take effect immediately on active
DNS service and do not require a service restart.

To adjust the parameters to mitigate phantom domain attack parameters, complete the following:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
To override Grid settings, click Override and complete the appropriate fields.
2. In the Grid DNS Properties or Member DNS Properties editor, click the Security tab and complete the following in
the Non-responsive servers section:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 777

Configuring DNS Services

• Enable holddown for non-responsive servers: When you select this check box, the appliance stops sending
queries to non-responsive servers for a specified time interval (Holddown duration) when the number of
consecutive attempts to contact a non-responsive server exceeds the threshold value (Timeouts to trigger).
No service restart is required when you change this. Clear this check box to disable the holddown. Note that
disabling this does not clear any of the previously configured values. When you enable this feature again,
the appliance preserves the previously configured values.
— Minimum timeout: When the time taken for a timeout to happen exceeds this number, the timeout is
counted towards the number of consecutive timeouts (Timeouts to trigger). You can specify a value
between 0 and 5000 milliseconds. For example, if you set the minimum timeout to 1000 milliseconds,
only timeouts that took longer than 1000 milliseconds are counted towards the number of consecutive
timeouts. The default is 1000 milliseconds.
— Timeouts to trigger: The number of consecutive timeouts before holding down a server. You can specify
a value between 0 and 4294967295. For example, setting the threshold value to 5 means the
appliance stops sending queries to the non-responsive server after five consecutive timeouts. The
default is 5.
— Holddown duration: The holddown duration for a server. You can specify a value between 1 and 86400
seconds. For example, if you set the holddown time to 60 seconds, the server stops sending queries for
60 seconds. The default is 60 seconds.

Note: In order to get enough upstream queries and for the appliance to effectively identify non-responsive
servers and stop sending queries to them, do not set a high value for the Minimum timeout field. The
higher the value you configure for this field, the longer it takes to capture a timeout and the harder it is to
satisfy the total counts of consecutive timeouts (Timeouts to trigger). Until the total count of consecutive
timeouts is exceeded, no mitigation happens against the non-responsive servers. As a result, it is less
likely for the appliance to identify phantom domain attacks when you set the Minimum timeout field at a
high value. Infoblox highly recommends that you keep the default Minimum timeout value to achieve
optimum protection against these attacks.

• Limit recursive queries per server: Select this check box to configure the maximum number of concurrent
recursive queries that the appliance sends to a single upstream name server. Queries above the limit will
be blocked and may result in a SERVFAIL response to the client. When you enable this option, the appliance
dynamically adjusts the concurrent query limit for a specific server based on the ATR (Average Timeout
Ratio). No service restart is required when you change this. Clear this check box to disable this option. Note
that disabling this does not clear any of the previously configured values. When you enable this feature
again, the appliance preserves the previously configured values.
— Maximum fetches per server: The maximum number of concurrent recursive queries that the appliance
sends to a single upstream name server before blocking additional queries to that server. You can
specify a value between 0 and 4294967295. The default value is 500.
— Quota recalculation interval: This determines how often (in number of recursive responses) the
appliance recalculates the average timeout ratio. You can specify a value between 0 and 4294967295.
The default value is 200. Note that if you set this value to 0 (zero), the appliance will never recalculate
the ATR. Infoblox strongly recommends that you do not set this value to 0.
• Limit recursive queries per zone: Select this check box to configure the maximum number of concurrent
recursive queries the DNS server sends for a domain. If the number of recursive queries exceeds the
configured value, the server blocks new queries for that domain and returns a SERVFAIL response to the
client. No service restart is required when you change this. Clear this check box to disable the option. Note
that disabling this does not clear any of the previously configured values. When you enable this feature
again, the appliance preserves the previously configured values.
— Maximum fetches per zone: The maximum number of concurrent recursive queries that a server sends
for one of its domain. When the number of queries exceeds this number, the server blocks new queries
for the domain. You can specify a value between 0 and 4294967295. The default value is 200.

778 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Detecting NXDOMAIN Attacks

Detecting NXDOMAIN Attacks

NXDOMAIN attacks are symmetrical DDoS attacks that involve a large number of DNS clients sending queries for
invalid or non-existent domains, which results in DNS recursion and NXDOMAIN responses. As a result, the DNS
server spends valuable resources processing spurious requests instead of providing legitimate DNS services. When
a DNS server is under NXDOMAIN attack, clients cannot get valid responses because the cache of the DNS server is
flooded with NXDOMAIN results.
Infoblox provides a few options for detecting possible NXDOMAIN attacks. You can track one or all of the following to
raise alerts for these attacks:
• High percentage of NXDOMAIN responses, as described in Tracking NXDOMAIN Responses on page 779.
• Low cache hit ratio for queries, as described in Tracking Cache Hit Ratio of Recursive Queries on page 782.
• High number of dropped UDP packets, as described in Tracking Dropped UDP Packets on page 783.
Each of these options provides configurable parameters that determine if an alert should be raised. When an alert is
triggered, the appliance sends SNMP traps about possible NXDOMAIN attacks. All triggered events are logged to the
syslog. Note that you must enable notifications in order for the appliance to send SNMP traps. For more information
about how to enable this, see Setting SNMP and Email Notifications on page 1371.

Note: The default values for these configurable parameters are set at an optimum level for general operations.
Infoblox recommends that you keep the default values when using these features. Ensure that you understand
the ramifications if you want to change the default values.

Tracking NXDOMAIN Responses

When under NXDOMAIN attack, the ratio of NXDOMAIN responses from upstream servers to all incoming recursive
responses is typically high. When the ratio of NXDOMAIN responses to all incoming recursive responses exceeds the
configured high water threshold, the appliance sends an alert. Note that timeouts are not counted as responses for
this detection.

Note: Changes made to the configuration for tracking NXDOMAIN responses take effect immediately on active DNS
service and do not require a service restart.

To configure the parameters for tracking NXDOMAIN responses, complete the following:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
To override Grid settings, click Override and complete the appropriate fields.
2. In the Grid DNS Properties or Member DNS Properties editor, click the Security tab and complete the following in
the Bogus-query alerting and mitigation section:
• Track the percentage of NXDOMAIN responses to recursive queries: Select this check box to track the
percentage of NXDOMAIN responses from up-stream servers to all incoming recursive responses. Clear this
check box to disable the detection. Note that disabling this does not clear any of the previously configured
values. When you enable this feature again, the appliance preserves the previously configured values. This
is selected by default.
— Minimum responses per interval: Enter the minimum number of incoming DNS responses received
(within the detection interval) before the appliance starts calculating the NXDOMAIN ratio at the end of
the detection interval. The appliance then compares the calculated percentage to the high water
threshold. If the percentage equals or exceeds the high water threshold, the appliance sends an SNMP
trap (if enabled) about possible NXDOMAIN attacks. The default is 1000. Note that the Minimum
responses per interval is implemented to ensure that enough incoming DNS responses are received so
the appliance can calculate a meaningful NXDOMAIN ratio and does not declare possible attacks from a

NIOS 7.3 NIOS Administrator Guide (Rev. A) 779

Configuring DNS Services

small response sample. Therefore, when you change the default value, ensure that you use a
reasonable value so the appliance calculates the NXDOMAIN ratio from a reasonable amount of
responses. Raising an alert using a small response sample may not be a reliable way for detecting
possible NXDOMAIN attacks.
— NXDOMAIN threshold: Enter the Low and High water thresholds at which an alert is triggered. The
appliance sends an alert when the percentage equals or exceeds the High water threshold. When the
percentage in subsequent detection intervals falls below the Low water threshold, the appliance sends
another alert to notify that the percentage of NXDOMAIN responses has gone back to an acceptable
level. The defaults are 70% for Low and 80% for High.
— Detection interval and Responses: These parameters work as alternatives to each other in determining
when the appliance starts calculating the NXDOMAIN ratio. In the case of a very low response rate when
the total responses received within the Detection interval never reach the Minimum responses per
interval, the response counters continue to cumulate into subsequent detection intervals until the
Minimum responses per interval is met. The appliance then sends an alert at the end of the detection
interval. On the other hand, in the case of a very high response rate when the total number of
responses received equals or exceeds the Responses value before the Detection interval is reached,
the Minimum responses per interval does not apply and the appliance sends an alert as soon as the
total responses equal or exceed the Responses value you define here. It does not wait till the end of the
Detection interval. Note that the number of Responses you define here must be the same or greater
than the Minimum responses per interval. The defaults are 10 seconds for the Detection interval and
100000 for Responses.
3. Save the configuration.

Configuration Examples for Tracking NXDOMAIN Responses

The following examples demonstrate how different responses per second affect the calculation of NXDOMAIN ratio.

Example One: Total responses per second = 250 and parameters = default values

Detection Interval (10 seconds)

Total
Responses 0 1st 2nd 3rd 4th 5th 6th 7th 8th 9th 10th
per Second
250/s 0 250 500 750 1000 1250 1500 1750 2000 2250 2500

In this example, the total number of responses is 250 per second and the total number of responses hits the
Minimum responses per interval (default = 1000) at the 4th second of the detection interval. This meets the
requirement for the Minimum responses per interval and triggers an NXDOMAIN ratio calculation at the end of the
detection interval (default = 10 seconds). If the percentage equals or exceeds the high water threshold, the appliance
sends an alert and logs the event to the syslog to notify about possible NXDOMAIN flood attacks. The appliance
resets the response counters for the next detection interval.

Example Two: Total responses per second = 40 per second and parameters = default values

1st Detection Interval (10 seconds)

Total
Responses 0 1st 2nd 3rd 4th 5th 6th 7th 8th 9th 10th
per Second
40/s 0 40 80 120 160 200 240 280 320 360 400

780 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Detecting NXDOMAIN Attacks

2nd Detection Interval (10 seconds)

Total
Responses 0 1st 2nd 3rd 4th 5th 6th 7th 8th 9th 10th
per Second
40/s 440 480 520 560 600 640 680 720 760 800

3rd Detection Interval (10 seconds)

Total
Responses 0 1st 2nd 3rd 4th 5th 6th 7th 8th 9th 10th
per Second
40/s 840 880 920 960 1000 1040 1080 1120 1160 1200

In this example, the total number of responses is 40 per second. During the first detection interval of 10 seconds, the
total number of responses is 400, which does not reach the Minimum responses per interval (default = 1000);
therefore, no NXDOMAIN ratio calculation occurs and the response counters continue to accumulate into the second
detection interval. At the end of the second interval, the total number of responses still does not reach the Minimum
responses per interval; therefore, no NXDOMAIN ratio calculation occurs and the counters continue to accumulate.
Finally, the total number of responses meets the requirement of the Minimum responses per interval when the
appliance receives 1000 responses at the 5th second during the third detection interval. This triggers an NXDOMAIN
ratio calculation at the end of the third detection interval, and the counters reset for the next detection interval. If the
NXDOMAIN percentage equals or exceeds the high water threshold, the appliance sends an alert and logs the event
to the syslog to notify about possible NXDOMAIN flood attacks.

Example Three: Total responses per second = 50000 and parameters = default values

Detection Interval (10 seconds)

Total
Responses 0 1st 2nd 3rd 4th 5th 6th 7th 8th 9th 10th
per Second
50000 0 50000 100000

In this example, the total number of responses per second is 50000. When the total number of responses hits
100000, which equals to the Responses value, the appliance starts calculating the NXDOMAIN ratio and sends an
alert without waiting until the end of the detection interval. If the percentage equals or exceeds the high water
threshold, the appliance sends an alert and logs the event to the syslog to notify about possible NXDOMAIN flood
attacks. The appliance resets the response counters for the next detection interval.

Note: The above configuration examples also apply to how the appliance tracks cache hit ratio of recursive queries,
as described in Tracking Cache Hit Ratio of Recursive Queries on page 782.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 781

Configuring DNS Services

Tracking Cache Hit Ratio of Recursive Queries

Another way to track possible DNS attacks is to monitor the cache hit ratio of recursive queries. A cache hit means
the response to a query can be found in the cache of the DNS server. When the response cannot be found, it is a miss.
Cache hit ratio is the percentage of cache hits to the total number of queries. The higher the ratio, the more efficiently
the cache is operating. When a server is under NXDOMAIN attack, the cache hit ratio tends to drop.
To track cache hit ratio, complete the following:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
To override Grid settings, click Override and complete the appropriate fields.
2. In the Grid DNS Properties or Member DNS Properties editor, click the Security tab and complete the following in
the Bogus-query alerting and mitigation section:
• Track the cache hit ratio of queries: Select this check box to track the cache hit ratio of recursive queries.
Clear this check box to disable the detection. No service restart is required when you change this. Note that
disabling this does not clear any of the previously configured values. When you enable this feature again,
the appliance preserves the previously configured values. This is selected by default.
— Minimum queries per interval: Enter the minimum number of incoming DNS queries received (within
the detection interval) before the appliance starts calculating the cache hit ratio at the end of the
detection interval. The appliance then compares the calculated percentage to the low water threshold.
If the percentage equals or falls below the low water threshold, the appliance sends an SNMP trap (if
enabled) about possible NXDOMAIN attacks. The default is 1000. Note that the Minimum responses
per interval is implemented to ensure that enough incoming DNS queries are received so the appliance
can calculate a meaningful cache hit ratio and does not declare possible attacks from a small number
of incoming queries. When you change the default value, ensure that you use a number that is big
enough so the appliance calculates the cache hit ratio from a reasonable amount of queries.
— Minimum cache utilization: Cache hit ratio detection does not start until cache utilization hits this
number. In other words, the appliance does not calculate the cache hit ratio until the cache utilization
has reached or exceeded this number. The default is 75%.
— Hit ratio threshold: Enter the Low and High thresholds at which an alert is triggered. The appliance
sends an alert when the cache hit percentage equals or drops below the Low water threshold, which
means the cache hit rate is low enough that the server is not operating efficiently, and there could be a
high number of bogus queries that do not have matching responses in the cache. When the cache hit
percentage in subsequent detection intervals reaches or exceeds the High water threshold, the
appliance sends another alert to notify that the cache hit rate has gone back to an acceptable level. The
defaults are 70% for Low and 80% for High.
— Hit ratio detection interval and Responses: These parameters work as alternatives to each other in
determining when the appliance starts calculating the cache hit ratio. In the case of a very low
response rate when the total responses received within the Hit ratio detection interval never reach the
Minimum queries per interval, the response counters continue to accumulate into subsequent
detection intervals until the Minimum queries per interval is met. The appliance then sends an alert at
the end of the detection interval. On the other hand, in the case of a very high response rate when the
total number of responses received equals or exceeds the Responses value before the Hit ratio
detection interval is reached, the Minimum queries per interval does not apply and the appliance
sends an alert as soon as the total responses equal or exceed the Responses value you define here. It
does not wait till the end of the Hit ration detection interval. Note that the number of Responses you
define here must be the same or greater than the Minimum queries per interval. The defaults are 10
seconds for the Hit ratio detection interval and 100000 for Responses.
3. Save the configuration.

782 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Mitigating Possible NXDOMAIN Attacks

Tracking Dropped UDP Packets

When the DNS server starts dropping UDP packets from incoming traffic, it can be an indication of DNS attacks.
Tracking dropped UDP packets can help raise awareness of possible DDoS attacks. For this features, the appliance
tracks all UPD packets, not only DNS queries. When tracking dropped UPD packets, the appliance tracks IPv4 and IPv6
packets independently.
To track dropped UDP packets, complete the following:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
To override Grid settings, click Override and complete the appropriate fields.
2. In the Grid DNS Properties or Member DNS Properties editor, click the Security tab and complete the following in
the Bogus-query alerting and mitigation section:
• Track the number of UDP packets dropped: Select this check box to track the number of dropped UDP
packets. Clear this check box to disable the detection. No service restart is required when you change this.
Note that disabling this does not clear any of the previously configured values. When you enable this
feature again, the appliance preserves the previously configured values. This is selected by default.
— Packet drop detection interval: Enter the time interval of each detection period for tracking dropped
UDP packets. The default is 10 seconds.
— Minimum packets per interval: Enter the minimum number of UDP packets the appliance allows (within
the detection interval) before it starts calculating the percentage of dropped packets to the total
number of packets. The appliance compares the calculated percentage to the high water threshold. If
the percentage equals or exceeds the high water threshold, the appliance sends an SNMP trap (if
enabled). The default is 1000.
— Packet drop threshold: Enter the Low and High water thresholds at which an alert is triggered. The
appliance sends an alert when the percentage equals or exceeds the High water threshold. When the
percentage in subsequent detection intervals equals or falls below the Low water threshold, the
appliance sends another alert to notify that the amount of dropped UDP packets has gone back to an
acceptable level. The defaults are 20% for Low and 30% for High.
3. Save the configuration.

Mitigating Possible NXDOMAIN Attacks

To mitigate possible NXDOMAIN attacks, you can configure the appliance to split the LRU (Least Recently Used) list
into two: one for NX (non-existent) RRsets and the other for all other RRsets. The LRU list is used to select entries that
the appliance removes from the cache when the cache utilization exceeds the allowed threshold, which is a fraction
of the configured maximum cache size.
While this option is enabled, the appliance removes the least recently used items from the LRU list for NX RRsets
before removing items from the LRU list for other RRsets. Doing so helps preserves valid DNS responses in the cache
while eliminating NXDOMAIN responses.
To mitigate NXDOMAIN responses. complete the following:

Note: Changes made to the configuration for mitigating possible NXDOMAIN attacks take effect immediately on
active DNS service and do not require a service restart.

1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
To override Grid settings, click Override and complete the appropriate fields.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 783

Configuring DNS Services

2. In the Grid DNS Properties or Member DNS Properties editor, click the Security tab and complete the following in
the Bogus-query alerting and mitigation section:
• Deprioritize caching of NXDOMAIN responses: Select this check box to split the LRU list into two: one for NX
RRsets and the other for all other RRsets, and to always remove the least recently used items from the list of
NX RRsets first. This is selected by default.
3. Save the configuration.

Support for RRL (Response Rate Limiting)

RRL provides the ability to control excessive UDP responses that are identical or almost identical. For more
information about how RRL works, refer to the BIND Administrators Reference Manual at
https://www.isc.org/downloads/bind/doc/.
You can configure parameters for this feature through the following CLI commands: set dns_rrl and show
dns_rrl. For more information about these commands, refer to the Infoblox CLI Guide.
You can also log RRL events to the syslog. To enable RRL logging, select rate-limit in the Logging Category when you
configure logging for the Grid or member. For more information about how to select logging categories, seeSetting
DNS Logging Categories on page 1340.

About Blacklists
Your organization can prevent customers or employees from accessing certain Internet resources, particularly web
sites, by prohibiting a recursive DNS member from resolving queries for domain names that you specify.
You can create blacklist rules that specify how a DNS member responds to recursive queries for data for which it is
not authoritative. Each rule specifies a domain name and the action of the DNS member when the domain name in
the query matches that in the rule. Instead of resolving the query, the DNS member can redirect the DNS client to
predefined IP addresses or return a REFUSED response code indicating that resolution is not performed because of
local policy.
When the DNS member receives a query for data for which it is not authoritative, it first tries to match the domain
name in the query with a domain name in any of its rules. If it finds a match, it responds according to the action
specified in the rule. If it does not find a match and the NXDOMAIN feature is enabled, the DNS member checks the
NXDOMAIN rulesets for a match and responds accordingly. If the NXDOMAIN feature is not enabled, the DNS member
resolves the query. (For information about the NXDOMAIN feature, see About NXDOMAIN Redirection on page 772.
Infoblox DNS members can modify their responses to queries for A records only. Therefore, if the matched query is
for a record other than an A record, including a query with a type of “ANY”, the DNS member sends a REFUSED
response if the matched rule has an action of “Redirect”.
In Figure 17.1, a DNS client opens a web browser and tries to access xxx.domain.com. When the DNS member
receives the query for xxx.domain.com, it checks its blacklist rulesets and finds xxx.domain.com in a rule with an
action of “Redirect”. The DNS client is redirected to the configured redirection destination IP address 10.1.2.3.

784 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Blacklists

Figure 17.1 Blacklist

1 A DNS client sends its DNS 2 The resolver sends the DNS
resolver a query for server a recursive query for the
xxx.domain.com. A record of xxx.domain.com.
DNS Client DNS Resolver DNS Server Blacklist
Rulesets

5 The resolver sends the IP 4 The DNS server forwards an A 3 The DNS server checks its
address 10.1.2.3 to the record with IP address 10.1.2.3 rulesets and finds a rule, with a
DNS client, which accesses to the resolver. “redirect” action, that matches
the portal at 10.1.2.3. xxx.domain.com.

This feature supports queries for data in IPv4 and IPv6 reverse-mapping zones, as well as forward-mapping zones.
Note that when a user with a Windows DNS client with IPv6 installed tries to access a domain name, the Windows
client sends queries for AAAA records before queries for A records. After the DNS member sends a Refused response
to the query for the AAAA record, the DNS client then sends a query for the A record. The DNS member then responds
according to the blacklist rules.
When DNSSEC is enabled on the Infoblox DNS server, it does not redirect DNS clients that request DNSSEC data. (For
information about DNSSEC, see Chapter 22, DNSSEC, on page 963.) If DNSSEC is not enabled and the query includes
a request for DNS data, the appliance ignores the request for DNSSEC data and redirects the clients.
To apply the configured DNS blacklist rules regardless of whether a DNS query requests DNSSEC data, configure the
appliance accordingly. For more information about how to configure this, see Applying Policies and Rules to DNS
Queries that Request DNSSEC Data on page 995.
You can enable the blacklist feature at the Grid, member, and DNS view levels. Note that only recursive DNS servers
can support this feature. For information on enabling recursion on a DNS member, seeEnabling Recursive Queries on
page 769.

About Blacklist Rulesets

A blacklist ruleset is a list of rules that a DNS member uses to determine its response to recursive queries for certain
domain names. When you enable the blacklist feature, you must define at least one rule in a ruleset. Each rule
consists of a domain name and an associated action. The DNS member matches the domain names in the rules with
the entire domain name in the query, including its suffix. The domain name in the rule can contain any printable
character. Domain name matching is case-insensitive. Unlike the NXDOMAIN rules, blacklist rules do not support
metacharacters in domain names.
The action in a rule is either “Pass” or “Redirect”.
• Pass: The DNS member resolves the query and forwards the response to the DNS client.
• Redirect: The DNS member does not resolve the query. The DNS member redirects the client to the predefined IP
addresses or sends a REFUSED response, depending on your configuration. Note that the DNS member can
redirect the client only if the query is for an A record. If the query is for another resource record, the DNS
member sends a REFUSED response.
You can use the Blacklist wizard, described in Adding a Blacklist Ruleset, to add blacklist rulesets, but not rules. You
can only add rules by importing them in a CSV file, as described in About CSV Import on page 101. Note that if a
blacklist ruleset contains duplicate domain names, the DNS member loads the first rule in the ruleset and discards
the other rules.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 785

Configuring DNS Services

The following example illustrates how the DNS member applies blacklist rules.
Ruleset 1:

Pattern Action
a1.foo.com PASS
foo.com REDIRECT/BLOCK

• If the DNS member receives a recursive query for a1.foo.com, it resolves the query and forwards the response to
the client.
• If the DNS member receives a recursive query for the A record of b1.foo.com, it redirects the DNS client to the
specified IP address. If the query is for another record type, such as an MX record, the member sends a REFUSED
response to the client.

Blacklist Guidelines
The following summarizes how a DNS member responds to a DNS client when the blacklist feature is enabled:
• If the domain name in the query matches a domain name in a rule, the member does the following:
— If the query is for an A record, the member performs the action specified in the rule.
— If the action is “Redirect”, the member performs the action specified in the Blacklist wizard.
• If the action in the wizard is to redirect, the DNS member redirects the client to the listed IP
addresses.
• If the action in the wizard is to return a REFUSED response, the DNS member sends a REFUSED
response to the DNS client.
— If the action in the rule is” Pass”, the DNS member resolves the query and forwards the response to the
DNS client.
— If the query is for a non-A record, the member performs the action in the rule as follows:
— If the action is “Redirect”, the DNS member returns a REFUSED response to the DNS client.
— If the action is “Pass”, the DNS member resolves the query and forwards the response to the DNS
client.
• If the domain name in the query does not match a domain name in a rule:
— If the NXDOMAIN feature is enabled, the DNS member tries to find a match with the NXDOMAIN rules and
responds accordingly.
— If the NXDOMAIN feature is disabled, the DNS member resolves the query and forwards the response to the
DNS client.
Note that if an A record with a dotted hostname is added to an authoritative zone through a dynamic DNS update,
and that A record should actually belong in an existing delegation, the appliance may not redirect a query for that A
record according to the Blacklist and NXDOMAIN guidelines.

Configuring the Blacklist Feature

To configure the blacklist feature:
1. Add blacklist rulesets, as described in Adding a Blacklist Ruleset on page 787.
2. Create one or more CSV files that contain the rules for each ruleset and import the files to the Grid. For information
about importing CSV files, see About CSV Import on page 101.
3. Enable blacklisting, as described in Enabling Blacklisting on page 787.

786 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Blacklists

Adding a Blacklist Ruleset

To add the name of a blacklist ruleset:
1. From the Data Management tab -> DNS tab -> Blacklist Rulesets tab, click the Add icon.
2. In the Blacklist wizard, complete the following:
— Name: Enter a name for the ruleset.
— Comment: You can enter additional information.
— Disable: You can disable this ruleset for use later on. The appliance ignores disabled rulesets.
3. Save the configuration and click Restart if it appears at the top of the screen.
You can then use the CSV Import feature to import the rules for each ruleset.

Managing Blacklist Rulesets

To view rulesets, navigate to the Data Management tab -> DNS tab -> Blacklist Rulesets tab. The panel lists the
configured rulesets and their associated comments. You can also display the Disabled column which indicates which
rulesets are disabled. From this panel, you can do the following:
• Add more rulesets, as described in the preceding section, Adding a Blacklist Ruleset on page 787.
• Edit a ruleset, by clicking its check box and clicking the Edit icon. You can set the following in the Blacklist
Ruleset editor:
— In the General Basic tab, you can change entries in any of the fields.
— In the Permissions tab, you can set admin permissions for the ruleset.
• Delete a ruleset, by clicking its check box and clicking the Delete icon.
• View the rules that were imported in each ruleset by selecting it. For each rule, the panel displays the following:
— Domain name
— The action of the recursive DNS member when the domain name in a query matches the domain name in
the rule.
To delete or edit rules in a ruleset, you must delete the ruleset from this panel, edit the CSV file and re-import it.

Enabling Blacklisting
Only DNS members with recursion enabled can support this feature. You can enable this feature at the Grid level and
override it for a member or DNS view with recursion enabled.
You can also enable the DNS member to log queries that matched blacklist rules. The logs include the queried domain
name, source IP address, the pattern of the matched rule, and the name of the corresponding ruleset.
To enable blacklisting:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
DNS View: From the Data Management tab, select the DNS tab and click the Zones tab -> dns_view check box ->
Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. If the Grid DNS Properties or Member DNS Properties editor is in basic mode, click Toggle Advanced Mode.
3. Click Blacklist and complete the following:
Enable Domain Name Blacklist: Select this check box.
Blacklist Rulesets: To add a ruleset, click the Add icon. If there are multiple rulesets, select one from the Select
Ruleset dialog box. Use the up and down arrows to move rulesets up and down in the list. The appliance applies
rulesets in the order they are listed.
For blacklisted domain names, return: Select the action of the appliance when it receives a query for a record
that matches a rule with an action of Redirect/Block.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 787

Configuring DNS Services

If you selected This list of IP addresses, add an IP address to the Redirect to table by clicking the Add icon and
entering the address. The addresses are listed in round robin fashion in the synthesized response of the DNS
member. You can enter up to 12 IP addresses.
Blacklist TTL: Specify how long the DNS client caches the A record with the redirected IP address.
Log queries for blacklisted domain names: Select this option to enable the appliance to log queries for
blacklisted domain names, including the source IP address of the query.
4. Save the configuration and click Restart if it appears at the top of the screen.

Enabling Zone Transfers

A zone transfer is the process of sending zone data across a network from one name server to another. When the
primary server detects a change to its zone data, it notifies the secondary servers. The secondary servers reply by
checking to see if the serial number they have for the zone is as large as the serial number for the zone on the primary
server. If not, the secondary servers request a zone transfer.
In addition to receiving zone change notifications, a secondary server periodically polls the primary server to see if
their zone data is in sync. In response, the primary server can send a DNS message containing just the changed zone
data, or the entire data set. The first type of transfer is known as an incremental zone transfer, or IXFR. The second
type of transfer is known as a full zone transfer, or AXFR.
A NIOS appliance, acting as the primary name server for a zone, allows zone transfers to secondary name servers by
default. This includes all servers listed in the NS records for that zone. (Secondary name servers in a Grid, however,
receive updated zone data via database replication by default, as explained later in this section.) You can also specify
zone transfers to other name servers, such as when migrating zone data to a new server or to a management system.
You can specify one or more destinations to which the local appliance sends zone transfers. You can also specify the
security and format of the transfers.
Note that secondary name servers periodically query the primary name server to find out if zone data has been
changed. Each query takes a certain amount of time and bandwidth on the network. By default, secondary name
servers limit the rate (serial-query-rate) at which these queries are being sent. Thus when the secondary name
servers are serving a large number of zones, it may take a long time to detect changes to their zone data. You can
configure this value to optimize the query rate on the network. In addition, when you have set up a few secondary
name servers for a large number of zones, a delay in zone transfers may occur due to the default zone transfer
configuration that limits concurrent zone transfers to 10 per secondary server. You can configure the maximum value
of concurrent zone transfers to optimize the zone transfer operation. For information about how to optimize zone
transfers, see Configuring Concurrent Zone Transfers on page 791.
By default, Grid members automatically receive updated zone data via database replication (through an encrypted
VPN tunnel). You can change the default behavior to allow Grid members to use zone transfers instead of Grid
replication.
Keep in mind that a database replication updates zone data for both the active and passive nodes of an HA member.
Therefore, if there is a failover, the new active node (the previous passive node) immediately begins serving zone
data with fresh information. In the case of a zone transfer, the passive node does not receive zone data until after a
failover, when it becomes an HA master. At that time, it performs a zone transfer. If there is a lot of zone data, the
transfer can take up to several minutes, thereby causing a break in the availability of the new HA master.
If you have HA members as secondary servers, zone transfers can result in service interruption when there is a
failover. Furthermore, if the primary server is down when the HA member fails over, the new active node cannot
receive zone data until the primary server comes back online.
You can use TSIG (transaction signature) keys to authenticate zone transfer requests and replies. The same key name
and key value must be on the primary and secondary name servers for TSIG-authenticated zone transfers to occur.
When using TSIG, it is important that both appliances involved with the authentication procedure use NTP (Network
Time Protocol) for their time settings (see Using NTP for Time Settings on page 405).

788 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Enabling Zone Transfers

You can control zone transfers at the Grid, member, and zone levels. This enables you to specify a different set of
name servers for a Grid, member, and zone, if necessary. You can also control which external secondary servers
should receive notifications about zone updates by adding their IP addresses to the also-notify statement for each
authoritative zone that is served by a Grid member. Infoblox recommends that you use this feature to notify hidden
external secondary servers about zone updates, instead of putting them in stealth mode, especially when you plan
to configure a large number of them. For information about how to add IP addresses to the also-notify statement, see
Configuring Zone Transfers on page 789.

Configuring Zone Transfers

To configure zone transfers, you identify the servers to which zone data is transferred and optionally, servers to which
data must not be transferred. For example, you can allow transfers to a network, but not to a specific server in the
network.
You can specify a different set of servers for specific Grid members and zones. For example, if certain Grid members
are primary servers for a zone, then you can specify the secondary servers to which that member is allowed to transfer
zones.
You can also enable the appliance to add all IPv4 and IPv6 addresses for which you allow zone transfers to the
also-notify statement for each authoritative zone that is served by a Grid member. The also-notify statement defines
a list of addresses that receive notifications about zone updates, in addition to the IP addresses listed in the NS
records for the zone. Use this feature to configure a large number of external secondary servers, instead of putting
them in stealth mode.
To configure zone transfer properties:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab, click the Members tab -> member check box -> Edit
icon.
Zone: From the Data Management tab, select the DNS tab, click the Zones tab -> zone check box, and then click
the Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the editor, click Toggle Advanced Mode, select the Zone Transfers tab.
3. In the Allow zone transfers to section, select one of the following:
— None: Select this to deny all clients for DNS zone transfers. This is selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this, the appliance allows remote name
servers that have the Allow permission to send and receive zone transfer data. You can click Clear to remove
the selected named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.
— IPv4 Address and IPv6 Address: Select this to add an IPv4 address or IPv6 address. Click the Value field
and enter the IP address of the remote name server. The Permission column displays Allow by default.
You can change it to Deny by clicking the field and selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 789

Configuring DNS Services

— TSIG Key: In the Add TSIG Key panel, complete the following, and then click Add to add the TSIG key to
the list:
• Key name: Enter a meaningful name for the key, such as a zone name or the name of the remote
name server with which the local server authenticates zone transfer requests and replies. This
name must match the name of the same TSIG key on other name servers that use it to authenticate
zone transfers with the local server.
• Key Algorithm: Select either HMAC-MD5 or HMAC-SHA256.
• Key Data: To use an existing TSIG key, type or paste the key in the Key Data field. Alternatively, you
can select the key algorithm, select the key length from the Generate Key Data drop down list, and
then click Generate Key Data to create a new key.
— DNSone 2.x TSIG Key: Select this when the other name server is a NIOS appliance running DNS One 2.x
code. The appliance automatically populate the value of the key in the Value field. The Permission
column displays Allow by default. You cannot change the default permission.
— Any Address/Network: Select to allow or deny the local appliance to send zone transfers to any IP
address.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
4. Optionally, select the Add allowed IP addresses to also-notify check box to add all IPv4 and IPv6 addresses listed
in the “Allow zone transfers to” table to the also-notify statement for each authoritative zone served by a Grid
member. When you enable this, all external secondary servers that are not defined for the zone and are allowed
zone transfers will receive notifications about zone updates, in addition to name servers assigned to the zone.
Infoblox recommends that you do not configure a large number of external secondary servers in stealth mode. To
ensure that these secondary servers receive notifications about zone updates, add their addresses to the “Allow
zone transfers to” table and grant them the “Allow” permission, and then select this check box.

Note: The appliance includes only IPv4 and IPv6 addresses. It does not include network addresses, TSIG keys,
and denied addresses. When you configure a named ACL, all allowed IPv4 and IPv6 addresses in the
named ACL are added to the also-notify statement.

5. Optionally, you can:

— Modify an item on the list by selecting it and clicking the Edit icon.
— Remove an item from the list by selecting it and clicking the Delete icon.
— Move an item up or down the list. Select it and drag it to its new position, or click the up or down arrow.
6. Save the configuration and click Restart if it appears at the top of the screen.

Specifying a Zone Transfer Format

The zone transfer format determines the BIND format for a zone transfer. This provides tracking capabilities for single
or multiple transfers and their associated servers.
To specify a zone transfer format:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab, click the Members tab -> member check box -> Edit
icon.
To override an inherited property, click Override next to it and complete the appropriate fields.

790 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Enabling Zone Transfers

2. In the editor, click Toggle Advanced Mode.

3. When the additional tabs appear, click the Advanced subtab of the Zone Transfers tab to specify the zone transfer
format. Select one of the following options from the Default Zone Transfer Format drop-down menu:
— many-answers (Secondaries run BIND 8/9): includes as many records as the packet size allows
— one-answer (Secondaries run BIND 4): includes one record per packet
4. To exclude servers, click the Add icon in the Zone Transfer Format Exceptions table and enter the IP address of
the server in the Addresses field.
5. Save the configuration and click Restart if it appears at the top of the screen.

Configuring Concurrent Zone Transfers

The default number of zone transfers that are allowed is set at the Grid or member level. However, you can override
the default value and configure the required concurrent zone transfers. Note that when you increase the number of
concurrent zone transfers, there will be an impact on CPU and memory usage.

Note: The tcp-client value is unconditionally set to 200 to control the total number of simultaneous TCP connection,
which caps the maximum inbound and maximum outbound transfer plus any DNS request made with the TCP.
The tcp-client value specifies the maximum number of simultaneous DNS clients that can be handled with TCP
connections and does not account for UDP connections. The UDP connection accounts for the regular DNS
requests and TCP is used only for AXFR and rare DNS requests that don't fit in a UDP connection.

To specify concurrent zone transfers:

1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Independent appliance: From the System tab, select the System Manager tab, expand the Toolbar and click
System Properties -> Edit.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit.
2. In the editor, click Toggle Advanced Mode.
3. When the additional tabs appear, click the Advanced subtab of the General tab.
4. You can change the zone transfer settings as follows:
— Maximum inbound concurrent zone transfers: The maximum number of inbound zone transfers that can be
performed concurrently. Click Override to override the value inherited from the Grid and enter the required
value. The default value is 10. Make sure that you specify a value from 10 to 100. Otherwise, the appliance
displays an error message. To retain the same value as the Grid, click Inherit.
— Maximum outbound concurrent zone transfers: The maximum number of outbound zone transfers that can
be performed concurrently. Click Override to override the value inherited from the Grid and enter the
required value. The default value is 10. Make sure that you specify a value from 1 to 100. Otherwise, the
appliance displays an error message. To retain the same value as the Grid, click Inherit.
— Maximum concurrent outbound zone transfers per remote name server: The maximum number of zone
transfers that can be performed concurrently from a given remote name server. This configuration can be
done on a per server basis. Click Override to override the value inherited from the Grid and enter the
required value. The default value is 2. Make sure that you specify a value from 2 to 100. Otherwise, the
appliance displays an error message. To retain the same value as the Grid, click Inherit.
— Maximum concurrent SOA queries: The maximum number of concurrent queries a secondary name server
sends to the primary server to find out if the zone serial numbers have been changed. Click Override to
override the value inherited from the Grid and enter the required value. The default value is 20. Make sure
that you specify a value from 20 to 1000. Otherwise, the appliance displays an error message. To retain the
same value as the Grid, click Inherit.
5. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 791

Configuring DNS Services

About Root Name Servers

Root name servers contain the root zone file which lists the names and IP addresses of the authoritative name servers
for each top-level zone. When a a root name server receives a query for a domain name, it provides at least the names
and addresses of the name servers that are authoritative for the top-level zone of the domain name.
You can configure the NIOS appliance to use Internet root name servers or custom root name servers. If you enable
recursive queries and the appliance receives a recursive query it cannot resolve locally, it queries specified
forwarders (if any) and then queries any root name servers you configure. If you do not specify internal root name
servers and the appliance can access the Internet, it queries the Internet root name servers.
You can specify root name servers for the Grid, individual members, and user-defined DNS views. You can specify root
name servers for all DNS views except the default view. The default view uses either the member level root name
servers (if specified) or the Grid level root name servers.
Every Grid member has a default view. If you want to specify root name servers for a default view, override the Grid
root name server setting at the member level and the default view can use the member-level setting.

Specifying Root Name Servers

To specify root name servers for a Grid, member, or DNS view:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab, click the Members tab -> member check box -> Edit
icon.
DNS View: From the Data Management tab, select the DNS tab, click the Zones tab-> dns_view check box -> Edit
icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the Grid DNS Properties and Member DNS Properties editors, you must click Toggle Advanced Mode.
3. When the additional tabs appear, click Root Name Servers.
4. Select one of the following options:
— Use Internet root name servers: This option is selected by default.
— Use custom root name servers: Click the Add icon and enter the following information when a new row
appears:
— Name: Enter a name for the root name server.
— Address: Enter the IP address of the root name server. The feature supports IPv4 or IPv6 values.
5. Optionally, you can:
— Select a server from the list and click the Edit icon, to modify its information.
— Select a server from the list and click the Delete icon.
6. Save the configuration and click Restart if it appears at the top of the screen.

About Sort Lists

A sort list prioritizes A and AAAA records on certain networks when those records are included in responses, sorting
them to the beginning of the list in the response. For example, you can define a sort list when a server has two
interfaces and you want the DNS clients to prefer one interface because it has a faster link.
When you define a sort list on the NIOS appliance, you specify the following:
• The IP address or network of the source of the query
• The IP addresses or networks that the appliance lists first in its response when it receives a query from the
corresponding source address

792 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Sort Lists

When the NIOS appliance receives a query from the specified IP address or network and the DNS lookup produces a
response with multiple addresses, the NIOS appliance sorts the addresses so that those in the sort list are at the
beginning of its response. This feature is also supported for the Infoblox-4030 appliance. For more information, refer
to the Infoblox DNS Cache Acceleration Application Guide.

Defining a Sort List

To define a sort list for a Grid, member, or DNS view:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
DNS View: From the Data Management tab, click the DNS tab -> Zones tab-> dns_view check box -> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the editor, click Toggle Advanced Mode.
3. When the additional tabs appear, click Sort List.
4. Click the Add icon and select either Any to define a sort list for any address and network, or Address/Network to
define a sort list for a particular source IP address or network.
5. Do the following in the new row:
— If you selected Address/Network, enter the IP address or network of the source of the query. The feature
supports IPv4 or IPv6 values.
— Click the Add icon beside the source IP address to add the preferred IP addresses or networks for the
source. You can add as many IP addresses as necessary. When you add multiple IP addresses, you can
change the order of the IP addresses. Select an IP address and drag it to its new position, or click the up or
down arrow, as show inFigure 17.2.

Figure 17.2 Sort List

Click this Add icon to enter a

new source IP address.

Click to
expand/hide the
sort list of each
source address.

Click + to enter the preferred IP address or

network for the specified source address. Click Click the arrow to move an address
- to remove an address from the list. up or down on the list.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 793

Configuring DNS Services

6. Enter the IP address or network in the Prioritized Networks field. You can add as many IP addresses as necessary.
When you add multiple IP addresses, you can change the order of the IP addresses. Select an IP address and drag
it to its new position, or click the up or down arrow.
7. You can add additional information about the source address or network in the Comment field.
8. To add another source IP address or network, click the Add icon again. You can create a separate sort list for each
source IP address or network.
9. Save the configuration and click Restart if it appears at the top of the screen.

Configuring a DNS Blackhole List

The DNS blackhole feature provides the ability to specify IP and network addresses of network devices that you do
not want to use in the DNS resolution process. The DNS blackhole feature is disabled by default. When enabled, the
NIOS appliance does not accept queries from IP addresses in the blackhole list and does not use them to resolve
queries. For example, you can add the IP addresses of name servers that are using DNS incorrectly to prevent the NIOS
appliance from accepting their queries and from using them as resolvers. You can also use this feature to fix
temporary network issues. For example, you can add the IP addresses of delegated servers, configured forwarders,
and DHCP servers that have temporary DNS-related issues.
You can create a DNS blackhole list for the entire Grid or create a separate list for each Grid member. For example, if
one of your Grid members is behind a firewall, you might need to configure a different DNS blackhole list for this
member because the clients that can access it might be mapped differently.
The appliance accepts queries from addresses and networks that are excluded from the blackhole list and uses these
addresses and networks as resolvers. To add an IP address to the blackhole list, enter it and set its permission to
Include. You can also add an IP address to the blackhole list and set its permission to Exclude so its not in the
blackhole list, effectively allowing the NIOS appliance to respond to queries from that address and to use it as a
resolver.
When you add a network to a DNS blackhole list, all the IP addresses in the network are not used in the DNS resolution
process. If you want to allow some IP addresses within the network, add these addresses to the list and set their
permission to “Exclude.” Ensure that you list these IP addresses before the network address because the appliance
applies permissions to the addresses in the order they are listed. For example, when you add the network
10.10.0.0/24 to a DNS blackhole list, all 256 IP addresses in the network are put on the blackhole list. To allow DNS
traffic to the IP addresses 10.10.0.55 and 10.10.0.88, add these two addresses before the network address in the
DNS blackhole list, and then set their permissions to Exclude.
You can define ACEs or a named ACL to determine the IPv4 and IPv6 addresses and networks that you want to include
in or exclude from a blackhole list.

Defining a DNS Blackhole List

To enable the DNS blackhole feature and configure a DNS blackhole list for a Grid or member:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab, click the Members tab -> member check box -> Edit
icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the editor, click the Blackhole tab and complete the following:
Enable Blackhole: Select this check box to enable the DNS blackhole feature. This is disabled by default.
3. Select one of the following:
— None: Select this if you do not want to configure a blackhole list. The appliance allows all clients to resolve
DNS queries. This is selected by default.

794 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Specifying Hostname Policies

— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this, the appliance uses clients that have
the Exclude permission in the DNS resolution process. You can click Clear to remove the selected named
ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.
— IPv4 Address and IPv6 Address: Select this to add an IPv4 address or IPv6 address. Click the Value field
and enter the IP address of the client. The Permission column displays Include by default. You can
change it to Exclude by clicking the field and selecting Exclude from the drop-down list. When you
select Include, the appliance adds the IP address to the blackhole list and does not allow DNS queries
and DNS resolution for this address. When you select Exclude, the appliance excludes the address
from the blackhole list and allows DNS queries and resolution for the address.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.
— Any Address/Network: Select to include or exclude any IP addresses and networks for the DNS
resolution process.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
4. Save the configuration.

Specifying Hostname Policies

You can enforce a naming policy for the hostnames of A, AAAA, Host, MX, NS, and bulk host records based on
user-defined or default patterns. For MX and NS records, the hostname restrictions apply to the text in the RDATA field
(right-hand side) of the resource record name.
Records that you created before you enabled the hostname checking policy need not comply with the hostname
restriction that you specify.
You can select one of three preconfigured policies or define your own host naming policy with a POSIX regular
expression. The policies Infoblox provides implement standard host naming restrictions according to RFC 952, DOD
Internet Host Table Specification, and RFC 1123, Requirements for Internet Hosts -- Application and Support.

Note: The hostname restriction limits the hostname of A, AAAA, Host, MX, NS, and bulk host records only.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 795

Configuring DNS Services

You can define your own hostname restriction policy at the Grid level only. At the member and zone levels, you can
select a predefined policy or a policy that was defined at the Grid level. The appliance supports IDNs for DNS zones
and resource records. For more information about IDNs, see Support for Internationalized Domain Names on page
113. You can use UTF-8 characters when you configure your own hostname checking policy.

Defining Grid Hostname Policies

You can define new hostname policies and set the hostname policy for all zones in the Grid as follows:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
2. In the Grid DNS Properties editor, click Toggle Advanced Mode.
3. When the additional tabs appear, click Host Naming.
The Host Name Policies section lists the following preconfigured record policies:
— Strict Hostname Checking: You can only use hostnames that contain alphanumeric characters and dashes
("-"). You cannot use other special characters, such as underscore ("_"). Note that when you select this
policy, the appliance automatically applies the policy to dynamic DNS updates and zone transfers it
receives. When you select this, you can enter host names through Grid Manager using punycode, but not
IDNs. The appliance stores IDNs that are created through DDNS updates and DNS transfers in punycode.
You can monitor non-compliant host names using the Hostname Compliance report. For information, see
Obtaining a List of Invalid Record Names on page 797.
— Allow Underscore: You can only use hostnames with alphanumeric characters, dashes, and underscores
("-" and "_"). This is the default.
— Allow Any: You can use any hostname.
Select Default from the drop-down list in the Default column to change the Grid default hostname policy.
4. Click Add to define your own hostname checking policy.
5. Enter a record policy name and a regular expression string, and click OK. See Appendix D, "Regular Expressions",
on page 1773 for definitions of regular expressions.
Note that Grid Manager does not validate the regular expressions that you enter. Therefore, you can
inadvertently specify an invalid regular expression that might cause noncompliance errors when you create
records.
6. If you select the Strict Hostname Checking policy, the Apply policy to dynamic updates and inbound zone
transfers (requires Strict Hostname Checking setting) option is enabled by default. It enables the appliance to
apply the policy to dynamic DNS updates and zone transfers that it receives. You can then select which action
the appliance takes when it encounters names that do not conform to the policy. Select either Fail or Warn. If you
select Warn, the appliance allows the dynamic DNS update or zone transfer, but logs a syslog message.

Note: The Strict Hostname Checking policy only allows alphanumeric characters and dashes ("-"). In addition,
this policy allows IDNs that are written in punycode. You cannot use other special characters, such as
underscore ("_"). Therefore, DDNS updates from Microsoft Active Directory controllers may not be
accepted.

7. Save the configuration and click Restart if it appears at the top of the screen.
After you specify a hostname restriction policy, if you create a record name that does not comply with this policy and
try to save it, an error message appears.

796 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Specifying Hostname Policies

Defining Hostname Restrictions

You can select a hostname restriction policy for an individual Grid member or zone. You can specify hostname
restrictions for authoritative forward-mapping zones only. You cannot specify hostname restrictions for forward
zones, stub zones, IPv4 reverse-mapping zones, and IPv6 reverse mapping zones.
To select a hostname restriction policy for a Grid member or zone:
1. Member: From the Data Management tab, select the DNS tab, click the Members tab -> member check box -> Edit
icon.
Zone: From the Data Management tab, select the DNS tab and click the Zones tab-> dns_view -> zone check box
-> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the Member DNS Properties editor, click Toggle Advanced Mode.
3. When the additional tabs appear, click Host Naming.
4. Click Override.
5. From the Host Name Policy drop-down list, select a predefined policy or a policy that was defined at the Grid
level.
6. If you select the Strict Hostname Checking policy, the Apply policy to dynamic updates and inbound zone
transfers (requires Strict Hostname Checking setting) is enabled by default. It enables the appliance to apply
the policy to dynamic DNS updates and zone transfers that it receives. You can then select which action the
appliance takes when it encounters names that do not conform to the policy. Select either Fail or Warn. If you
select Warn, the appliance allows the dynamic DNS update or zone transfer, but logs a syslog message.

Note: The strict hostname checking policy only allows alphanumeric characters and dashes. It does not allow
for the use of other special characters, such as underscore ("_"). Therefore, DDNS updates from Microsoft
Active Directory controllers might not be accepted.

7. Save the configuration and click Restart if it appears at the top of the screen.

Obtaining a List of Invalid Record Names

You can retrieve a list of all record names that do not comply with the current hostname checking policy of a zone.
These could be records that were created before the current host naming policy was set. In addition, if you selected
the Strict Hostname Checking policy and allowed illegal hostnames in DDNS updates and inbound zone transfers
with a warning, those records are listed in this report as well.
To display the Hostname Compliance report:
1. From the Data Management tab, select the DNS tab and click the Zones tab-> dns_view -> zone check box.
2. Click Hostname Compliance.
The Hostname Compliance Report for the zone displays. It lists the record name, type, value, and comment for
all records that do not comply with the hostname restriction policy of the zone.
From the report, you can select a record and do the following:
• Click the Edit icon to open the record editor.
• Click the Delete icon to move it to the Recycle Bin.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 797

Configuring DNS Services

About DNS64
To support the increasing number of IPv6 and dual-stack networks, Infoblox DNS servers now support DNS64, a
mechanism that synthesizes AAAA records from A records when no AAAA records exist. When you enable DNS64 on
an Infoblox DNS server, it can operate with a third-party NAT64 device so IPv6-only nodes can communicate with
IPv4-only nodes without any changes to either of the devices.
As illustrated in Figure 17.3, when an IPv6-only host requests the AAAA record of an IPv4-only server and none exists,
a DNS64-enabled server can retrieve the A record of the IPv4 server and synthesize an AAAA record. The IPv6-only
host can then use the synthesized AAAA record, which contains the IPv6 proxy address for the IPv4 address in the
original A record, to initiate communication with the IPv4 host.

Figure 17.3

IPv6 Network IPv4 Network

IPv6 Client DNS Server

1 2
corp100.com

A Record
3

Synthesized
AAAA Record

4
Packet
corp100.com

Router NAT64 Device mail.corp100.com

server
Following are the steps illustrated in Figure 17.3:
1. An IPv6-only host sends a recursive query for the AAAA record of the IPv4 server mail1.corp100.com.
2. The Infoblox DNS server attempts to resolve the request for the AAAA record, and determines that an AAAA record
for mail1.corp100.com does not exist. The DNS server then performs a query for the A record of
mail1.corp100.com.
3. The DNS server creates a synthetic AAAA resource record from the information in the A record, and returns the
synthesized AAAA record to the requesting IPv6 host.
4. The host receives the synthetic AAAA record and sends a packet to the destination address specified in the
synthetic AAAA record. The packet is routed to the IPv6 interface of the NAT64 device, which translates the packet
from IPv6 to IPv4 and forwards it to the server, mail1.corp100.com.
Infoblox DNS servers can return synthesized AAAA records to both IPv4 and IPv6 clients when the client explicitly
requests an AAAA record and none exists for the requested host. If a host has multiple A records, the DNS server
synthesizes an AAAA record for each A record.
Infoblox DNS servers can also synthesize records for reverse-mapping zones. When a DNS server receives a query for
a PTR record in the IP6.ARPA domain whose address matches a configured DNS64 prefix, the server synthesizes a
CNAME record that contains an IPv4 address derived from the IPv6 address in the query. The server then sends a
query for the PTR record so it can resolve the IPv4 address to the hostname.
For example, if a DNS server that is configured to synthesize records for the prefix 2001:db8::/96 receives a query for
the PTR record of 2001:db8::0102:0304, it synthesizes a CNAME record that contains the IPv4 address
4.3.2.1.in-addr.arpa. The server then resolves the PTR record of the IPv4 address 4.3.2.1.in-addr.arpa.

798 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS64

If the server obtains the PTR record, then it sends the synthesized CNAME record and the PTR record to the client. If
the zone exists, but there is no PTR record, then the server sends the synthesized CNAME record only. If the zone does
not exist, then the server responds with a SERVFAIL with no answers.
Additionally, Infoblox DNS servers can generate synthesized records for DNSSEC secure zones, but only for
non-DNSSEC clients. A DNS client or resolver includes the EDNS OPT pseudo-RR with the DO (DNSSEC OK) bit set to
indicate that they are requesting DNSSEC data. DNS servers can generate synthesized AAAA records only when the
request does not have the DO bit set. This ensures that DNSSEC clients receive only valid responses.
For additional information about DNS64, refer to the following Internet drafts:
• http://tools.ietf.org/html/draft-ietf-behave-dns64-11
• http://tools.ietf.org/html/draft-ietf-behave-address-format-10

Configuring DNS64
You can enable DNS64 on both authoritative and recursive DNS servers. You can configure DNS64 at the Grid,
member or DNS view level.
To configure DNS64 on Infoblox DNS servers:
1. Create at least one DNS64 synthesis group. A synthesis group specifies the IPv6 prefix of the synthesized AAAA
records. For more information, see Adding a DNS64 Synthesis Group on page 799.
2. Optionally, specify additional parameters for the synthesis group. For more information, see Setting DNS64
Group Properties on page 800.
3. Enable the DNS64 service and assign a synthesis group to the Grid, a member or a DNS view. For more
information, see Enabling DNS64 Service on page 803.
On the NAT64 device, you must specify the IPv6 prefixes that are configured on the DNS server.

About Synthesis Groups

A synthesis group specifies, among other things, the IPv6 prefix for the synthesized AAAA records. Infoblox DNS
servers provide a default DNS64 synthesis group with the well-known prefix 64:ff9b::/96, which is reserved for
representing IPv4 addresses in the IPv6 address space. You can keep the default group, change the prefix or delete
the group. You can also add a synthesis group for a Network-Specific Prefix (NSP), which is an IPv6 prefix assigned to
an organization to create IPv6 representations of IPv4 addresses.
After you create a synthesis group, you can define rules to restrict the synthesis of AAAA records to certain IPv4
addresses and networks, and specify the DNS clients and networks to which the server can send synthesized AAAA
records. For more information, see Setting DNS64 Group Properties on page 800.
Note that though you can control the synthesis of AAAA records, the DNS server always synthesizes CNAME records
when it receives a query for an IPv6 PTR record whose address matches a prefix in a DNS64 synthesis group. You can
also configure the DNS server to generate synthesized AAAA records for DNS queries that have the DO bit set.

Adding a DNS64 Synthesis Group

To add a synthesis group:
1. From the Data Management tab, select the DNS tab -> DNS64 Groups tab, and then click the Add icon.
2. In the DNS64 Synthesis Group wizard, complete the following:
— Name: Enter a name for the group.
— Prefix: The IPv6 prefix used for the synthesized AAAA records. The default is the well-known prefix
64:FF9B::/96. The prefix length must be /32, /40, /48, /56, /64, and /96, and all bits beyond the specified
length must be zero.
— Comment: Optionally, enter additional information about the group.
— Disabled: Select this check box if you would like to disable the group at this time. Note that you cannot
disable the group if it is the only group that is used by a Grid, member or DNS view that has DNS64 enabled.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 799

Configuring DNS Services

— Apply to queries requesting DNSSEC records: Select this to generate synthesized AAAA records for DNS64
synthesis groups that request DNSSEC data.
3. Click Next to define extensible attributes for the synthesis group. For information, see Using Extensible Attributes
on page 427.
4. Save the configuration

Viewing DNS64 Synthesis Groups

To view synthesis groups, from the Data Management tab, select the DNS tab -> DNS64 Groups tab. This tab displays
the following information about each group:
• Name: The group name.
• Prefix: The IPv6 prefix that is assigned to the group.
• Comment: The comment that was entered for the group.
• Site: The value of this attribute, if specified.
You can display the following additional column:
• Disabled: Indicates whether the group is disabled.
You can do the following:
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Edit the properties of a synthesis group.
— Select the synthesis group, and then click the Edit icon.
• Move a synthesis group to the Recycle Bin.
— Select the synthesis group, and then click the Delete icon. Note that you cannot delete a synthesis group
that is assigned to a Grid, member or DNS view.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Export the synthesis groups to a .csv file.
— Click the Export icon.
• Print the list of synthesis groups.
— Click the Print icon.

Setting DNS64 Group Properties

After you create a DNS64 synthesis group, you can specify the following:
• The IPv4 and IPv6 DNS clients and networks to which the DNS server is allowed to send synthesized AAAA
records with the specified IPv6 prefix.
• The IPv4 addresses and networks for which the DNS server can synthesize AAAA records with the specified
prefix.
• IPv6 addresses or prefix ranges that cannot be used by IPv6 only hosts, such as IP addresses in the ::ffff:0:0/96
network. When the DNS server retrieves an AAAA record that contains an IPv6 address that matches an
excluded address, it does not return the AAAA record. Instead, it synthesizes an AAAA record from the A record.
Note that a DNS server synthesizes the AAAA record of a host that has both A and AAAA records when all the
IPv6 addresses in the AAAA records match the excluded addresses. If the host has multiple AAAA records and
some of them contain excluded IPv6 addresses, then the server returns the remaining AAAA records.
You can add individual access control entries (ACEs) or use a named access control list (ACL) to define these clients.
For information about how to define named ACLs, see Defining Named ACLs on page 400.

800 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS64

To configure DNS64 group properties:

1. From the Data Management tab, select the DNS tab -> DNS64 Groups tab -> group check box -> Edit icon.
2. In the General tab of the DNS64 Synthesis Groups editor, you can do the following:
— Modify the name, prefix or comment.
— Select the Disabled check box, if you want to disable the group at this time.
— Select the Apply to queries requesting DNSSEC records check box to have the DNS server generate
synthesized AAAA records for DNS64 synthesis groups that request DNSSEC data.
Perform DNS64 synthesis for these clients: Specify IPv4 and IPv6 hosts and networks to which Infoblox DNS
servers can send synthesized AAAA records. The default is to allow any IPv4 and IPv6 address and network.
Select one of the following:
— None: Select this if you do not want to define specific addresses or networks to which the appliance sends
synthesized AAAA records. When you select this, the appliance sends synthesized AAAA records to all
clients. This is selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this option, the appliance sends
synthesized AAAA records to the clients that have the Allow permission in the list. You can click Clear to
remove the selected named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.
— IPv4 Address and IPv6 Address: Select this to add an IPv4 address or IPv6 address. Click the Value field
and enter the IP address. The Permission column displays Allow by default. You can change it to Deny
by clicking the field and selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.
— Any Address/Network: Select this to allow or deny any IP addresses to which the appliance sends
synthesized AAAA records.
Mapped IPv4 Addresses: Specify IPv4 addresses and networks for which the DNS server synthesizes AAAA
records. The default is to allow the DNS server to synthesize AAAA records for any IPv4 address in any network.
Select one of the following:
— None: Select this if you do not want to define specific IPv4 addresses or networks for which the DNS server
synthesizes AAAA records. The appliance synthesizes AAAA records for all IPv4 clients. This is selected by
default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this option, the appliance synthesizes
AAAA records for the clients that have the Allow permission in the list. You can click Clear to remove the
selected named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 801

Configuring DNS Services

— IPv4 Address: Select this to add an IPv4 address. Click the Value field and enter the IP address. The
Permission column displays Allow by default. You can change it to Deny by clicking the field and
selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— Any Address/Network: Select this to allow or deny any IPv4 addresses for which the appliance
synthesizes AAAA records.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
Exclude IPv6 addresses: Specify IPv6 addresses of AAAA records that the appliance treats as nonexistent. The
DNS server does not return the AAAA record of an address from this list. Instead, it synthesizes an AAAA record
from the A record.
— None: Select this if you do not want to define specific IPv6 addresses or networks of AAAA records that the
appliance treats as nonexistent. The appliance treats all IPv6 addresses as nonexistent. This is selected by
default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this option, the appliance synthesizes
AAAA records from A records for the clients that have the Allow permission in the list. You can click Clear to
remove the selected named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.
— IPv6 Address: Select this to add an IPv6 address. Click the Value field and enter the IP address. The
Permission column displays Allow by default. You can change it to Deny by clicking the field and
selecting Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.
— Any Address/Network: Select this to allow or deny any IP addresses of AAAA records that the appliance
treats as nonexistent.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.

802 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS64

• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
— Extensible Attributes: You can modify the attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab displays if you logged in as a superuser. For information, see About Administrative
Permissions on page 195.
3. Save the configuration and click Restart if it appears at the top of the screen.

Enabling DNS64 Service

You can enable DNS64 at the Grid, member, and DNS view level. At least one DNS64 synthesis group must be
configured before you can enable DNS64.
To enable DNS64 and apply DNS64 synthesis groups:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
DNS View: From the Data Management tab, select the DNS tab -> Zones tab -> dns_view check box -> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the Grid and Member DNS Properties editor, click Toggle Advanced Mode, and then click DNS64. In the View
DNS Properties editor, just click DNS64.
3. Do the following in the DNS64 tab:
— Enable DNS64: Select this check box.
— Synthesis Groups: Click the Add icon and select a synthesis group.
4. Save the configuration and click Restart if it appears.

DNS Record Scavenging

The DNS scavenging feature allows you to remove unused DNS resource records from zone data to prevent the
accumulation of unneeded records. A scavenging operation determines, based on predefined rules, which records
are not needed, i.e. are reclaimable, and removes them. For information about scavenging rules, see Scavenging
Rules on page 804.
Scavenging is used for records with the dynamic record source type. Dynamic records are those created
automatically, for example, via a dynamic DNS update. Static records, i.e. records that you add manually, can be
identified as reclaimable based on scavenging rules but are not subject to scavenging. You can see the source type
for each record in the DNS Resource Records viewer in Grid Manager.
You can use the records scavenging feature at the following levels in NIOS:
• Grid: scavenging is performed in all views and zones of the Grid.
• DNS view: scavenging is performed in all zones of the view.
• Authoritative zone (a Grid primary or unassigned zone): scavenging is performed in the specified zone, but not
in the subzones.
You can either scavenge DNS records immediately or schedule automatic scavenging. For more information, see
Scavenging DNS Records Immediately and Scheduling Automatic Scavenging on page 806.
You can organize and monitor records identified as reclaimable by using Smart Folders. For information, see Chapter
3, Smart Folders, on page 173.
Scavenging events are logged in the NIOS syslog. You can view it, as described in Viewing the Syslog on page 1341
and Searching in the Syslog on page 1343.
The records are removed to the Recycle Bin and can be restored from there. For more information, see Restoring
Reclaimed Records on page 808.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 803

Configuring DNS Services

Note: Membership in the DNS Admin group is required to complete scavenging operations. For details, see
Administrative Permissions for DNS Records Scavenging on page 808.

Scavenging Rules
You can configure the following match rules to identify reclaimable DNS resource records:
• Resource Record Type: This rule allows you to specify the record type to run scavenging on. A record is
reclaimable if its type matches or does not match the type specified in the rule. The record types that support
scavenging include the following:
— A
— AAAA
— PTR
— CNAME
— DNAME
— MX
— SRV
— NAPTR
— TXT
• Creation Time: This rule allows you to identify reclaimable records based on the record’s creation timestamp.
You can see the “Creation Time” value for the records in the DNS Resource Records viewer.

Note: In the case of upgrade to NIOS 7.3, the creation time is not initialized. Therefore the “Creation Time” rule
does not apply to the records created before the upgrade.

• Last Queried Time: This rule allows you to identify reclaimable records based on when they were last queried for
their DNS data. You can see the last queried time for the records in the DNS Resource Records viewer.

Note: If you use this rule, also select Enable last queried time monitoring for resource records in the Grid, view,
or zone scavenging properties, as described in the next section.

• Last Discovered Time: This rule allows you to identify reclaimable records based on the record’s last discovered
timestamp. This rule is applicable to A, AAAA, and PTR records.
• Record Source: This rule allows you to specify the record source – static or dynamic – to be used as a filter when
identifying reclaimable records.
• Associated Records: This rule allows you to identify reclaimable records based on whether they have or do not
have associated records. Record associations are supported for address records (A, AAAA, and PTR).
Additionally, you can reclaim the associated records when reclaiming the original ones by enabling the option
When reclaiming A, AAAA, or PTR records, also reclaim the corresponding, symmetric A, AAAA, and PTR records
in the scavenging properties, as described in the next section.
• Extensible Attributes: You can specify extensible attributes that reclaimable records should match in addition to
the scavenging rules described above.

Configuring DNS Record Scavenging Properties

You can configure the DNS record scavenging properties at the Grid, DNS view, or DNS zone level. According to the
NIOS inheritance pattern for object properties, the scavenging properties configured at a given level are inherited by
the level below, unless overridden.
To configure the DNS record scavenging properties:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
DNS view: From the Data Management tab, select the DNS tab and click the Zones tab -> dns_view check box ->
Edit icon.

804 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS64

DNS zone: From the Data Management tab, select the DNS tab and click the Zones tab -> click a DNS view -> zone
check box -> Edit icon.
2. If the properties editor is in basic mode, click Toggle Advanced Mode.
3. Click DNS Scavenging.
4. Enable last queried time monitoring for resource records: Select this if you are going to use the Last Queried Time
rule. This setting enables monitoring the time when the resource record was last queried for its DNS data. For
more information on DNS queries monitoring for resource records, see DNS Queries Monitoring on page 808.
5. Enable last queried time monitoring for zones: This setting enables monitoring the time when the zone, i.e. at
least a single record in it, was last queried for its DNS data. The data resulting from zone last queries time
monitoring is displayed in the zones viewer (Data Management -> DNS -> Zones -> click a DNS view to open zones
list).

Note: Enabling monitoring for a zone does not enable monitoring for child zones.

6. Select Enable record scavenging.

7. To override the inherited properties, click Override and complete the fields.
8. Under Match the following rule, create a rule as follows. For information about rules, see Scavenging Rules on
page 804.
— Choose Filter: Select a criterion from the drop-down list.
— Choose Operator: Select an operator for the filter criterion.
— In the value field, enter the value for the filter field.
To add another rule:
— Click + to add another rule at the same level.
— Click |<- to add an all (logical AND) or any (logical OR) operator line and a parenthetical rule that is indented
one level and above the first rule.
— Click ->| to add an all (logical AND) or any (logical OR) operator line and a parenthetical rule that is indented
one level.
To logically combine the whole ruleset, select Match all of the following rules or Match any of the following
rules.
After you add all the match rules, you can click Reset to remove the previously configured rules and start again.
9. Under Match records with the following extensible attribute, add an extensible attribute to use as an additional
criterion for finding necessary records.
— Choose Filter: Select a criterion from the drop-down list.
— Choose Operator: Select an operator for the filter criterion.
— In the value field, enter the value for the filter field.
To add another extensible attribute, click +.
To logically combine the extensible attributes set, select Match all records with the following extensible
attributes or Match any records with the following extensible attributes.
After you add all the extensible attributes, you can click Reset to remove the previously configured attributes
and start again.

Note: The extensible attributes rule is always combined with the rest of the match rules using the AND operator.

10. When reclaiming A, AAAA or PTR records, also reclaim the corresponding, symmetric A, AAAA and PTR records:
Select this if you want to reclaim records associated to the ones identified as reclaimable.
11. To configure a schedule for automatic records scavenging, select Enable scheduled record scavenging. See
Scheduling Automatic Scavenging on page 806.
12. Click Save & Close or Save.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 805

Configuring DNS Services

Scheduling Automatic Scavenging

You can schedule a scavenging operation only at the Grid level. For a scavenging operation at the view or zone level,
you can use the schedule inherited from the Grid.

Note: Infoblox recommends manually testing the configured scavenging settings before enabling scheduled
scavenging.

1. In the DNS record scavenging properties described in the previous section, select the Enable scheduled record
scavenging check box.
2. To enable automatic scavenging after records are marked as reclaimable, select After marking a record as
reclaimable, automatically reclaim the record.
3. Click the Scheduling icon and complete the following in the Scavenging Scheduler dialog:
— Select how often you want to execute the scavenging. You can select Once, Hourly, Daily, Weekly, or
Monthly.
— If you select Once, complete the following:
• Enter the day in the date picker and select a month from the drop-down list.
• Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
• Choose the Time Zone.
— If you select Hourly, complete the following:
• Schedule every hour(s) at: Enter the number of hours between each scavenging instance. You can
enter a value from 1 to 24.
• Minutes past the hour: Enter the number of minutes past the hour. For example, enter 5 if you want
to schedule the scavenging operation five minutes after the hour.
• Choose the Time Zone.
— If you select Daily, complete the following:
• Click either Every day or Every weekday.
• Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
• Choose the Time Zone.
— If you select Weekly, complete the following:
• Schedule every week on: Select any day of the week.
• Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
• Choose the Time Zone.
— If you select Monthly, complete the following:
• Schedule the day of the month: Enter the day of the month and the monthly interval. For example,
to schedule the rule update on the first day after every 2 months, you can enter Day 1 every 2
month(s).
• Enter a time in the hh:mm:ss AM/PM format. You can also select a time from the drop-down list.
• Choose the Time Zone.
4. Click OK.

Scavenging DNS Records Immediately

To perform record scavenging for the Grid, a DNS view, or a zone according to the predefined rules, use the Scavenge
Records command from the Toolbar. This adds a background task that starts immediately or, if another scavenging
task is in progress, after its completion.
The scavenging is split into two stages that you can execute separately or together:

806 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS64

• Mark records as reclaimable: This stage analyzes the records against the scavenging rules. The records
matching the rules are marked as reclaimable, i.e. their “Reclaimable” flag is set to “Yes” in the DNS Resource
Records viewer. These records can be reclaimed by using the second stage, unless you disable scavenging for
them as described in Disabling Scavenging for Individual Records on page 807.
• Reclaim records marked as reclaimable: This stage automatically removes the records marked as reclaimable in
the result of the execution of the first option. Running only the “Reclaim records marked as reclaimable” stage
without the analysis stage does not perform a new analysis on the affected records. It only removes the records
marked as reclaimable during the previous analysis.
Also, you can reset the reclaimable flag of the records. As an example of when this may be useful: if records have
previously been marked as reclaimable and under a revised scavenging policy some records may no longer be
reclaimable.

Note: To start immediate scavenging of DNS records, you must first carefully define the scavenging properties, as
described in Configuring DNS Record Scavenging Properties on page 804.

To scavenge DNS records immediately:

1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Scavenge Records ->
Scavenge Grid Records.
DNS view: From the Data Management tab, select the DNS tab, click a DNS view, expand the Toolbar, and then
click Scavenge Records -> Scavenge View Records.
DNS zone: From the Data Management tab, select the DNS tab, click a DNS view, click a zone, expand the
Toolbar, and then click Scavenge Records -> Scavenge Zone Records.
2. Select one of the following:
— Scavenge Records: Select this to proceed to the record scavenging. Go to the next step.
— Reset reclaimable flag: Select this to set the “Reclaimable” flag of all affected records to “No”.
3. If you chose Scavenge Records, select one of the following options or both of them:
— Mark records are reclaimable
— Reclaim records marked as reclaimable

Note: Static records are never reclaimed automatically even if they are marked as reclaimable. You can only
delete static records manually from the DNS Resource Records viewer.

4. Click Start.
To check the progress of the current scavenging task, you can use the DNS Record Scavenging widget in the
Dashboard. For more information, see DNS Record Scavenging on page 172. You can also view a scavenging report,
as described in DNS Scavenged Object Count Trend on page 1504.
The scavenging task may be subject for an approval workflow. For information on approval workflows, see Configuring
Approval Workflows on page 94.

Note: Keep in mind that the Enable record scavenging property for a lower scavenging scope (e.g. view or zone) can
override this property for the upper scope (i.e., Grid or view respectively). For example, if you run scavenging
on the Grid with the scavenging option disabled, and there are some views or zones on which scavenging is
enabled, this results in the records of the affected views and zones being scavenged. Vice versa, if scavenging
is disabled for certain views or zones and you run scavenging on the Grid with the scavenging option enabled,
the corresponding views and zones are excluded from scavenging.

Disabling Scavenging for Individual Records

You can disable scavenging for individual records, even if they are marked as reclaimable. In this case, the record is
never reclaimed unless you enable the scavenging for it again.
To disable scavenging for a record:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 807

Configuring DNS Services

1. In the DNS Resource Records viewer, select the appropriate record.

2. Click Edit.
3. In the record properties dialog, click DNS Scavenging.
4. Select the Disable scavenging for this record check box.
5. Click Save & Close.
Additionally, you can see the following information in the resource record scavenging properties:
• Record creation time
• Record last queried time
• Whether the record is reclaimable
For records synced from MS servers, the creation timestamp is not synced. This implies the following limitations:
• When a zone is converted from MS to NIOS, the timestamp is initialized to the time when the operation occurs.
• When a zone is converted from NIOS to MS, the timestamp is reset.

Administrative Permissions for DNS Records Scavenging

By default, only superusers can perform DNS records scavenging. Limited-access users can use the scavenging
functionality if they have the corresponding DNS scavenging permissions. For more information about admin
permissions, see About Administrative Permissions on page 195.
The DNS scavenging permissions are global to Grid Manager. They are used in addition to the regular DNS global and
object permissions. For more information about the DNS permissions, see Administrative Permissions for DNS
Resources on page 241.
The following operations require scavenging permissions:
• Modifying scavenging properties for the Grid, a view, or a zone
• Configuring a scavenging schedule
• Performing a scavenging task
• Viewing the DNS Record Scavenging dashboard widget
• Viewing the DNS Scavenged Object Count Trend report

Restoring Reclaimed Records

A reclaimed record remains in the Recycle Bin until the bin is emptied. You can restore the deleted records from the
Recycle Bin, as described in Restoring Objects from the Recycle Bin on page 74.
The Recycle Bin does not display information on whether a record was deleted during a scavenging process or
manually. Therefore, you cannot restore the reclaimed data only.
When a record is restored from the Recycle Bin, its Reclaimable flag is reset to “No”.

Note: Only a super user can restore records reclaimed during a recurring scavenging task.

DNS Queries Monitoring

The DNS resource records monitored for their Last Queried time are listed in Data Management -> DNS -> Query
Monitoring. The Query Monitoring tab provides a Last Queried report for the monitored resource records, including
the following information:
• Zone: FQDN of zone.
• Name: FQDN of resource record.
• Record Type: Resource record type.
• Record Data: Value of resource record, such as address of an A record.
• Monitored Since: Date monitoring started.

808 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS64

• Last Queried: Displays "Not Monitored", "Not Queried Since xxxx", or date of last query.

Note: This report does not display the Last Queried information for automatically generated NS records.

To enable last queried time monitoring for resource records, do the following in the DNS scavenging properties for the
Grid, a view, or a zone:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
DNS view: From the Data Management tab, select the DNS tab and click the Zones tab -> dns_view check box ->
Edit icon.
DNS zone: From the Data Management tab, select the DNS tab and click the Zones tab -> click a DNS view -> zone
check box -> Edit icon.
2. If the properties editor is in basic mode, click Toggle Advanced Mode.
3. Click DNS Scavenging.
4. Select the Enable last queried time monitoring for resource records check box. For more information, see
Configuring DNS Record Scavenging Properties on page 804.
5. Click Save & Close.

Note: Exporting the query monitoring data may take longer than usual if the report contains a lot of records. Also, if
a Grid secondary server uses zone transfer to update zone data from a Grid primary server, NIOS does not
monitor queries made to the Grid secondary server and it does not update the last queried timestamp for the
resource records in a zone.

When multiple values are specified with the same filter, the filter applies or logic, e.g. ‘a’ or ‘b’. Other perspectives in
NIOS UI apply and logic, e.g., ‘a’ and ‘b’. You can use the following filters to get specific information in this report:
• DNS View: DNS view name.
• Not Queried: Specify a date when the last query was made. The only operator is "Since".
• Zone: FQDN of zone.
• Type: Only a single record type filter can be specified. This filter has the following resource records:
— A Records
— AAAA Records
— BulkHost
— CNAME Records
— DNAME Records
— DS Records
— DTC LBDN Records
— Host Address
— Host Alias
— Host Record
— MX Records
— NAPTR Records
— NS Records
— PTR Records
— Resource Record
— SRV Records
— Shared A Record
— Shared AAAA Record
— Shared CNAME Record
— Shared MX Record

NIOS 7.3 NIOS Administrator Guide (Rev. A) 809

Configuring DNS Services

— Shared SRV Record

— TXT Records
— Other Records

Note: NIOS does not monitor queries or update timestamp for DNSSEC records, except for DS records. As a result,
the Query Monitoring tab displays “Not Monitored” in the Last Queried column for all DNSSEC records. In
addition, the Not Queried filter does not display any DNSSEC records.

810 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 18 DNS Views
DNS views enable the NIOS appliance to serve different versions of DNS data based on the host accessing it. The
topics in this chapter include:
• Using Infoblox DNS Views on page 812
— About DNS Views and Network Views on page 814
• Configuring DNS Views on page 814
— Adding a DNS View on page 815
— Defining Match Clients Lists on page 815
— Defining a Match Destinations List on page 817
— Managing the DNS Views of a Grid Member on page 819
— Managing Recursive DNS Views on page 820
— Managing the Order of DNS Views on page 820
— Managing DNS Views on page 821
• Configuration Example: Configuring a DNS View on page 823

NIOS 7.3 NIOS Administrator Guide (Rev. A) 811

DNS Views

Using Infoblox DNS Views

DNS views provide the ability to serve one version of DNS data to one set of clients and another version to another
set of clients. With DNS views, the NIOS appliance can provide a different answer to the same DNS query, depending
on the source of the query.
In Figure 18.1, the appliance has two views: an Internal and an External DNS view. When the appliance receives
queries from DNS clients, it responds with data from either the Internal or External DNS view, depending on the
source IP address. When the appliance receives a query from Client A and determines that it can resolve the query
from data in the Internal view, the appliance responds with the IP address of the site in the Internal view. When the
appliance receives a query from Client B and determines that it can resolve the query from data in the External view,
it responds with the IP address in the External view.

Figure 18.1 Internal and External Views

A-1 Client A, an internal client, sends a A-2 The appliance retrieves the
request for sales.corp100.com. answer from the internal view.

Client A Internal View

A-3 The appliance responds corp100.com zone
with 10.1.1.5. 10.1.1.5 sales.corp100.com

B-1 Client B, an external client, sends External View

a request for sales.corp100.com.
corp100.com zone
192.168.1.5 sales.corp100.com

B-3 The appliance responds B-2 The appliance retrieves the

with 192.168.1.5. answer from the external view.
Client B

You can configure both forward and reverse mapping zones in DNS views and provide DNS services, such as name
resolution, zone transfers and dynamic DNS updates. For information about these services, see Configuring DNS
Services on page 751.
You can provide multiple views of a given zone with a different set of records in each DNS view. In Figure 18.2, both
views contain the corp100.com zone and the sales.corp100.com zone. The finance.corp100.com zone is only in the
internal DNS view, and only internal users are allowed to access records in that zone. Resource records can also exist
in multiple zones. In the example, the A records for serv1.sales.corp100.com and serv2.sales.corp100.com are in the
sales.corp100.com zones in both views.

Figure 18.2 Zone Data in Each DNS View

Internal DNS View corp100.com sales.corp100.com finance.corp100.com

MX rmail.corp100.com A serv1.sales.corp100.com A server.finance.corp100.com
NS dnsoneA.corp100.com A serv2.sales.corp100.com A printer.finance.corp100.com
A host1.corp100.com A serv3.sales.corp100.com A fin1.finance.corp100.com
A host2.corp100.com A printer.sales.corp100.com A fin2.finance.corp100.com
A host1.sales.corp100.com
A host2.sales.corp100.com

External DNS View corp100.com sales.corp100.com

MX email.corp100.com A web3.sales.corp100.com
A web1.corp100.com A ftp.sales.corp100.com
A web2.corp100.com A serv1.sales.corp100.com
A serv2.sales.corp100.com

812 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using Infoblox DNS Views

You can control which clients access a DNS view through the use of a match list specifying IP addresses and/or TSIG
(transaction signature) keys. When the NIOS appliance receives a request from a client, it tries to match the source IP
address and/or TSIG key with its match list when determining which DNS view, if any, the client can access. After the
appliance determines that a client can access a DNS view, it checks the zone level settings to determine if it can
provide the service that the client is requesting.
For information on TSIG keys or defining zone transfer settings, see Enabling Zone Transfers on page 788. For more
information on match lists, see Defining Match Clients Lists on page 815. For information on defining query settings,
refer to Controlling DNS Queries on page 767.
Figure 18.3 illustrates how the NIOS appliance resolves a query for a domain name in a zone of a DNS view. In the
example, the internal DNS view is listed before the external DNS view. Therefore, when the appliance receives a
query, it checks the match list of the internal DNS view first. If it does not find the source address in the match list of
the internal DNS view, it checks the match list of the external DNS view. The match list of the external DNS view allows
all IP addresses.
Next, the NIOS appliance checks the zone level settings to determine if it is allowed to resolve queries from the client
for domain names in that zone. After the appliance determines it is allowed to respond to queries from this client, it
resolves the query and sends back the response to the client.

Figure 18.3 Query Resolution

Internal View

1 A client sends a query 2 The NIOS appliance

for web1.corp100.com. checks if the host IP corp100.com
address is allowed in the
match list of the internal
view. It does not find the finance.corp100.com
client address in the match
list Match List
cs.corp100.com
NIOS
Appliance
Client External View

5 The appliance 3 The NIOS appliance checks if

sends the answer the host IP address is Match corp100.com
back to the client. allowed in the match list of Any
the external view. The match Match List
list allows all IP addresses. cs.corp100.com

4 The NIOS appliance checks if it can respond to queries for

domain names in the corp100.com zone from this client. It
determines that it can. The appliance then looks for the
requested domain name in the corp100.com zone.

When you create more than one DNS view, as shown in Figure 18.3, the order of the views is important. View order
determines the order in which the NIOS appliance checks the match lists. In Figure 18.3, the internal DNS view is
listed before the external DNS view. If the views were reversed, no hosts would receive DNS replies from the internal
DNS view because the match list of the external DNS view allows replies to clients with any IP address. For information
on how to order views, see Managing the DNS Views of a Grid Member on page 819.
In a Grid, each Grid member can host its own set of views. A Grid member can serve as the primary or secondary server
for multiple views of a particular zone. For information about specifying primary and secondary servers, see Assigning
Zone Authority to Name Servers on page 839.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 813

DNS Views

About DNS Views and Network Views

The NIOS appliance provides one default DNS view, which is always associated with the default network view. You
can create additional network and DNS views. A network view is a single routing domain with its own networks. For
information about network views, see Configuring DHCP for IPv4 on page 1109.
The default DNS view initially allows all IP addresses access, and has the same recursion setting as the Grid. You can
change these properties and rename the default DNS view, but you cannot delete it. When you upgrade or migrate
from a name server, or an earlier version of software that does not support DNS views, the appliance places all the
zones defined in the older release in the default DNS view. You can then create additional views and organize the
zones in each view.
When you create a network view, the appliance automatically creates a corresponding DNS view with “default.”
prepended to the name of the network view. You can rename the system-defined DNS view and configure its
properties.
If the appliance contains only one network view, all DNS views are associated with that network view. If there are 20
or less network views configured, the appliance displays the network views in the drop-down list on the left of the top
navigation bar of the Data Management tab of Grid Manager. The appliance displays the Network View Selector dialog
box if there are more than 20 network views configured. You can adjust the page size of the selector by choosing the
number of network views to be displayed on each page from the Page Size drop-down list. If the number of network
views exceeds the selected number, the selector displays the data on multiple pages. If you have a large number of
network views, select a larger page size so you can quickly locate a network view without excessive paging through
the list. The default page size is 10.
A DNS view can be in one network view only, but a network view can have multiple DNS views. If you enable dynamic
DNS updates, you must specify which DNS view receives the updates. In a network view, only one DNS view can
receive the dynamic DNS updates. For information, see Sending DDNS Updates to a DNS Server on page 931.

Configuring DNS Views

Following are the tasks to configure a DNS view:
1. Add a DNS view, as described in Adding a DNS View on page 815.
2. Add zones to the DNS view. You can add authoritative forward-mapping and reverse-mapping zones, as well as
delegated, forward, and stub zones. For information about configuring each type of zone, see Configuring
Authoritative Zones on page 829 and Configuring Delegated, Forward, and Stub Zones on page 857.
You can optionally do the following:
1. Define a Match Clients list and a Match Destination list to restrict access to the DNS view. For more information,
see Defining Match Clients Lists on page 815 and Defining a Match Destinations List on page 817.
2. Copy resource records from one zone to another. This is useful when different DNS views have the same zone and
have multiple resource records in common. For information, see Managing DNS Views on page 821.
3. Create resource records in a group and share the group among multiple zones. For information, see About Shared
Record Groups on page 900.
4. Specify which interface IP address is published in the glue A record of the DNS view. For information, see
Changing the Interface IP Address on page 819.
5. Manage recursive views. For information, see Managing Recursive DNS Views on page 820.
6. Manage the order of the DNS views, as this determines the order in which the NIOS appliance checks the Match
Clients list. For information, see Managing the Order of DNS Views on page 820.
7. Configure forwarders for a DNS view. For more information, see Using Forwarders on page 767.
8. Enable AAAA filtering and configure a list of IPv4 networks and addresses for allowing or denying AAAA filtering
from the appliance. For information, see Controlling AAAA Records for IPv4 Clients on page 770.

814 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Views

Adding a DNS View

You can add up to 255 DNS views. When you add a DNS view, specify the following:
• The network view in which you are creating the DNS view.
The appliance lists the network views only when there are multiple network views. Otherwise, it automatically
associates the DNS view with the default network view.
• A Match Clients list specifying the hosts allowed access to the DNS view.
If you do not define a list, the appliance allows all hosts to access the DNS view. For more information, see
Defining Match Clients Lists on page 815.
• Whether recursive queries are allowed.
When a name server is authoritative for the zones in a DNS view, you can disable recursion since your name
server should be able to respond to the queries without having to query other servers.
if you want to allow a Grid member to respond to recursive queries from specific IP addresses, you can create an
empty DNS view, that is, one that has no zones in it, and enable recursion. For information, see Configuration
Example: Configuring a DNS View on page 823.

Note: This setting overrides the recursion setting at the Grid and member levels.

To configure a new DNS view:

1. If there is more than one network view in the Grid, select the network view in which you are creating the DNS view.
2. From the Data Management tab -> DNS tab, expand the Toolbar and click Add -> Add DNS View.
3. In the Add DNS View wizard, complete the following fields:
— DNS View: Enter the name of the DNS view. It can be up to 64 characters long and can contain any
combination of printable characters. Each DNS view must have a unique name. You cannot create two DNS
views with the same name, even if they are in different network views.
— Comment: Optionally, enter information about the DNS view. You can enter up to 256 characters.
— Enable Recursion: This field’s initial default state is inherited from the Grid. It is inactive and greyed out
until you click Override. After you click override, you can select or clear the check box to define a setting that
applies to the DNS view only.
Note that a DNS view actually inherits its recursion setting from the Grid members that serve its zones.
When you first create a DNS view though, it does not have any zones and therefore inherits its setting from
the Grid. After you create zones in the DNS view, Grid Manager can then determine the associated members
and display the resulting inheritance. If a DNS view has multiple zones served by multiple members with
different recursion settings, you can view the different settings in the Multi-Inheritance viewer.
You can click Inherit to have the DNS view inherit its recursion setting from the Grid.
— Disable: Select this check box to disable this DNS view.
4. Save the configuration and click Restart if it appears at the top of the screen, or click Next to define a Match
Clients list. For information, see Defining Match Clients Lists on page 815.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Defining Match Clients Lists

When you configure a DNS view, you can create a Match Clients list to identify source IP addresses and TSIG keys that
are allowed or denied access to the DNS view. The NIOS appliance determines which hosts can access a DNS view by
matching the source IP address or TSIG key with its Match Clients list. After the appliance determines that a host can
access a DNS view, it checks the zone level settings to determine whether it can provide the service that the host is
requesting for that zone.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 815

DNS Views

If you do not configure a Match Clients list, then all devices are allowed access to the DNS view. However, if you
configure a Match Clients list, then only those devices in the list with “Allow” permission can access the DNS view.
All other devices are denied access, including Grid members. Therefore, to allow a primary server of a zone to receive
dynamic DNS updates from member DHCP servers, you must add the members to the Match Clients list as well. Note
that if you “Deny” permission to certain IP addresses or networks, you must add the “Allow Any” permission at the
end of the Match Clients list to ensure that all other IP addresses and networks that are not in the “Deny” list are
allowed access to the DNS view. You can add individual ACEs (access control entries) or a named ACL (access control
list) to the Match Clients list. For information about named ACLs and how to define them, see Defining Named ACLs
on page 400.

Defining a Match Clients List for a DNS View

You can define a Match Clients list for a DNS view when you add a new DNS view (second step of the Wizard) or when
you edit an existing DNS view. For information about adding a DNS view, see Adding a DNS View on page 815. To
define a Match Clients list for an existing DNS view:
1. From the Data Management tab, click the DNS tab -> Zones tab-> dns_view check box -> Edit icon. Or, if there is
only one DNS view, for example the predefined default view, you can just click the Edit icon beside it.
2. In the DNS View editor, select the Match Clients tab, and select one of the following:
— None: Select this if you do not want to configure a Match Clients list. The appliance allows all clients to
access the DNS view. This is selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this option, the appliance allow access to
the DNS view from sources that have the Allow permission in the named ACL. You can click Clear to remove
the selected named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding.
— IPv4 Address and IPv6 Address: Select this to add an IPv4 address or IPv6 address. Click the Value field
and enter the IP address. The Permission column displays Allow by default. You can change it to Deny
by clicking the field and selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.
— TSIG Key: In the Add TSIG Key panel, complete the following, and then click Add to add the TSIG key to
the list:
• Key name: Enter a meaningful name for the key, such as a zone name or the name of the client or
Grid member. This name must match the name of the same TSIG key on other name servers.
• Key Algorithm: Select either HMAC-MD5 or HMAC-SHA256.
• Key Data: To use an existing TSIG key, type or paste the key in the Key Data field. Alternatively, you
can select the key algorithm, select the key length from the Generate Key Data drop down list, and
then click Generate Key Data to create a new key.
— DNSone 2.x TSIG Key: Select this when the other name server is a NIOS appliance running DNS One 2.x
code. The appliance automatically populate the value of the key in the Value field. The Permission
column displays Allow by default. You cannot change the default permission.

816 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Views

— Any Address/Network: Select this to allow or deny any IP addresses to access the DNS view.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
3. Save the configuration and click Restart if it appears at the top of the screen. You can also click the Schedule icon
at the top of the editor to schedule this task. In the Schedule Change panel, enter a date, time, and time zone.

Defining a Match Destinations List

You can define a Match Destinations list that identifies destination addresses and TSIG keys that are allowed access
to a DNS view. When the NIOS appliance receives a DNS request from a client, it tries to match the destination address
or TSIG key in the incoming message with its Match Destination list to determine which DNS view, if any, the client
can access. After the appliance determines that a host can access a DNS view, it checks the zone level settings to
determine whether it can provide the service that the host is requesting for that zone.
You can define a Match Destination list when you edit an existing DNS view as follows:
1. From the Data Management tab, click the DNS tab -> Zones tab-> dns_view check box -> Edit icon. Or, if there is
only one DNS view, for example the predefined default view, you can just click the Edit icon beside it.
2. In the DNS View editor, select the Match Destinations tab, and select one of the following:
— None: Select this if you do not want to configure a Match Destinations list. The appliance allows all
destination addresses to access the DNS view. This is selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this option, the appliance allows access
to the DNS view from the destination addresses that have the Allow permission in the named ACL. You can
click Clear to remove the selected named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.
— IPv4 Address and IPv6 Address: Select this to add an IPv4 address or IPv6 address. Click the Value field
and enter the IP address. The Permission column displays Allow by default. You can change it to Deny
by clicking the field and selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.
— TSIG Key: In the Add TSIG Key panel, complete the following, and then click Add to add the TSIG key to
the list:
• Key name: Enter a meaningful name for the key, such as a zone name or the name of the client or
Grid member. This name must match the name of the same TSIG key on other name servers.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 817

DNS Views

• Key Algorithm: Select either HMAC-MD5 or HMAC-SHA256.

• Key Data: To use an existing TSIG key, type or paste the key in the Key Data field. Alternatively, you
can select the key algorithm, select the key length from the Generate Key Data drop down list, and
then click Generate Key Data to create a new key.
— DNSone 2.x TSIG Key: Select this when the other name server is a NIOS appliance running DNS One 2.x
code. The appliance automatically populate the value of the key in the Value field. The Permission
column displays Allow by default. You cannot change the default permission.
— Any Address/Network: Select this to allow or deny any IP addresses to access the DNS view.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
3. Save the configuration and click Restart if it appears at the top of the screen. You can also click the Schedule icon
at the top of the editor to schedule this task. In the Schedule Change panel, enter a date, time, and time zone.

Enabling the Match Recursive Only Option

You can enable the match-recursive-only option for the DNS view. When you enable this option, only recursive queries
from matching clients match the selected DNS view. This option can be used in conjunction with the match client list
and match destination list. Ensure that you configure those options and the order of the DNS views accordingly if you
want to also enable the match-recursive-only option.
To enable the match-recursive-only option, complete the following:
1. From the Data Management tab, click the DNS tab -> Zones tab-> dns_view check box -> Edit icon. Or, if there is
only one DNS view, for example the predefined default view, you can just click the Edit icon beside it.
2. In the DNS View editor, select the General tab -> Advanced tab, and select the following:
— Enable match recursive only option: This option is disabled by default. Select this option to enable the
match-recursive-only option for the DNS view. When you select this option, only recursive queries from
matching clients match this view. Note that this option can be used in conjunction with the match-clients
and match-destinations options. Ensure that you configure those options and the order of the DNS views
accordingly if you want to also enable match-recursive-only.
3. Save the configuration.

Note: You can also enable or disable the match-recursive-only option for a specific DNS view on a specific member
by using the CLI command set enable_match_recursive_only. For information about this command, refer
to the Infoblox CLI Guide.

Copying Zone Records

Different views of the same zone may have a number of records in common. If this is the case, you can copy zone
records between views and zones.

Note: You cannot copy shared records and records that the NIOS appliance automatically creates, such as NS records
and glue A records.

To copy zone records between DNS zones and views:

818 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Views

1. From the Data Management tab -> DNS tab, click Copy Records from the Toolbar.
2. In the Copy Records dialog box, Grid Manager displays the last selected zone or the zone from which you are
copying zone records in the Source field. Complete the following to copy records:
— Destination: Click Select Zone to select the destination zone. When there are multiple zones, Grid Manager
displays the Zone Selector dialog box from which you can select one. After you select the zone, Grid
Manager displays the associated DNS view.
— Copy All records: Select this option to copy all the zone records, including those records not created on the
NIOS appliance, such as HINFO records.
— Copy Specific Records: Select this option to copy specific types of records. Select a resource record type
from the Available column and click the right arrow to move it to the Selected column.
— Copy Options: Select one of the following:
— Delete all records in destination before copying the records: Select to delete all resource records in the
destination zone before the records are copied.
— Overwrite existing records: Select to overwrite existing resource records that have the same domain
name owners as the records being copied.
3. Click Copy & Close.

Note: When you copy resource records between zones and there are pending scheduled tasks associated with these
records, the appliance allows the copying of zone records before it executes the scheduled tasks.

Managing the DNS Views of a Grid Member

A Grid member can serve zones in different DNS views. You can manage the DNS views associated with a Grid
member as follows:
• You can specify which interface IP address is published in glue A records in the DNS view, as described in
Changing the Interface IP Address on page 819.
• You can assign an empty recursive view to a member, as described in Managing Recursive DNS Views on page
820.
• You can control the list of DNS views as described in Changing the Order of DNS Views on page 821.

Changing the Interface IP Address

By default, a Grid member publishes its LAN address in glue A records in the DNS view. You can change this default
for each DNS view associated with a member. You can specify the NAT IP address or another IP address.
To specify the interface IP address for glue A records in a view:
1. From the Data Management tab, click the DNS tab -> Members tab -> member check box, and then click the Edit
icon.
2. In the Member DNS Configuration editor, click Toggle Expert Mode if the editor is in basic mode, and then select
the DNS Views tab.
The Address Of Member Used in DNS Views table lists the default DNS view and DNS views with zones that are
served by the member.
3. To change the address, click the entry in the Interface column of a DNS view, and select one of the following:
— NAT IP Address: Select this to use the member NAT address for glue A records in a Grid setting. Select this
when you want to notify the Grid Master that it should expect packets from this member on the NAT
address, not the configured interface address. The Grid Master broadcasts this NAT address to all NAT
members outside of its NAT group. Do not use this option for an independent appliance serving as a DNS
server. Select Other IP Address to publish the NAT address for the independent appliance. For information
about NAT compatibility, see NAT Groups on page 275.
— Other IP Address: Select this to specify another address for glue A records, or to publish the NAT address for
an independent appliance. Enter the address in the Address field.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 819

DNS Views

Note: The 255.255.255.255 limited broadcast address is reserved. The appliance does not automatically create
glue A records for this address. You can however create an NS record without the associated glue records.

4. Save the configuration and click Restart if it appears at the top of the screen.

Managing Recursive DNS Views

When you add a DNS view that has recursion enabled, the appliance resolves recursive queries from hosts on the
Match Clients list of that view. If the DNS view contains zones and you delete those zones, the appliance retains the
view in its configuration file, as long as recursion is enabled in the view. Such a view is called an empty recursive DNS
view because it does not contain any zones. It enables the appliance to respond to recursive queries from the
specified clients.
In a Grid, all members automatically store DNS views that have recursion enabled in their configuration files. If you
do not want a Grid member to respond to recursive queries for clients in a particular DNS view, you can remove the
view from the member’s configuration file.
To delete or retain an empty recursive DNS view in the DNS configuration file of a Grid member:
1. From the Data Management tab, click the DNS tab -> Members tab-> Grid_member check box -> Edit icon.
2. In the Member DNS Configuration editor, click Toggle Expert Mode if the editor is in basic mode, and then select
the DNS Views tab.
3. The Recursive Views Assigned to this Member section lists the empty recursive DNS views. Move a DNS view to
the Selected column to explicitly assign the view to the Grid member and include it in the DNS configuration file
of the member. Move a DNS view to the Available column to remove it from the configuration file of the member.
Empty recursive DNS views that you retain in the configuration file are automatically listed at the bottom of the
list of DNS views. You can move them up on the list when you manually change the order of the DNS views, as
described in Managing the DNS Views of a Grid Member on page 819.
4. Save the configuration and click Restart if it appears at the top of the screen.

Managing the Order of DNS Views

When a member receives a query from a DNS client, it checks the Match Client lists in the order the DNS views are
listed in the Order of DNS Views table of the DNS Views tab in the DNS Member editor. The NIOS appliance can order
DNS views automatically, or you can order the DNS views manually. If you choose to have the appliance automatically
update the order of the DNS views, it does so after each of the following events:
• Adding a DNS view to a member.
• Removing a DNS view from a member.
• Changing the address match list of a DNS view hosted by the member.

About IP Addresses and the Order of DNS Views

NIOS appliances with both IPv4 and IPv6 enabled can contain both types of addresses in the Match Clients list. When
you enable IPv6 on the appliance, the order of DNS views in the GUI may be affected. Views are ordered and sorted
automatically based on Match Clients lists. Views with IPv6 enabled are sorted as follows:
• If the Match Clients lists of all views contain IPv4 addresses only—The appliance orders views based on IPv4
addresses.
• If the Match Clients lists of all views contain IPv6 addresses only—The appliance orders views based on IPv6
addresses.
• If the Match Clients list of one DNS view has IPv6 addresses and all other views have IPv4 addresses—The
appliance orders views based on IPv4 addresses, and the IPv6 address is given lowest priority in the ordering.
• If the Match Clients list of one DNS view has IPv4 addresses and all other DNS views have IPv6 addresses—The
appliance orders DNS views based on IPv6 addresses, and the IPv4 address is given lowest priority in the
ordering.

820 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Views

• If the Match Clients list of one DNS view has both IPv4 and IPv6 addresses—The appliance orders DNS views
based on both IPv4 and IPv6 addresses, but more priority is given to the IPv4 addresses in the ordering.
The DNS views are ordered based on the number of IP addresses that are matched by the Access Control Lists (ACLs).
The order of the DNS view is as follows:
• ANY
• Large Network
• Small Network
• Multiple Addresses
• Single Address
The actual precedence of the order of the views is also based on the ACL elements:
• any match: precedence = UINT_MAX + 1
• address match: precedence += 1
• TSIG match: precedence += 1
• network match: precedence += 129 - split (BOTH v4 and v6)
Note that views with the same precedence are sorted based on the internal view name. For example, ‘_default’ or ‘0’.

Note: Only superusers can change the order of the views.

Changing the Order of DNS Views

To change the order of DNS views:
1. From the Data Management tab, click the DNS tab -> Members tab-> Grid_member check box -> Edit icon.
2. In the Member DNS Configuration editor, click Toggle Expert Mode if the editor is in basic mode, and then select
the DNS Views tab.
3. In the Order of DNS Views section, select one of the following:
— Order DNS Views Automatically: Click this to automatically order views after adding a new DNS view,
removing a DNS view, or changing the match client list.
— Order DNS Views Manually: This able lists the DNS views that have zones assigned to the Grid member and
the empty recursive views associated with the member. Select a DNS view, then click an arrow to move it up
or down in the list.
4. Save the configuration and click Restart if it appears at the top of the screen.

Managing DNS Views

You can list the DNS views, and then modify, disable, or remove any custom DNS view. You can modify and disable
the default DNS view; however, under no circumstances can it be removed.

Listing DNS Views

After you configure additional DNS views, you can list all DNS views by navigating to the Data Management tab -> DNS
tab -> Zones panel. This panel lists DNS views only after you modify the default DNS view or add a DNS view. If you
never added DNS views or modified the default DNS view, this panel does not display the default DNS view. Instead,
it lists the zones in the default DNS view. To display the properties of the default DNS view and edit it, use the Global
Search function to locate and edit it.
Note that if you have not used Grid Manager to add a new DNS view, and you import DNS views through the Data
Import Wizard or the API, you must log out and log back in to Grid Manager to display the newly imported DNS views.
For each DNS view, this panel displays the following by default:
• Comment: Comments that were entered for the DNS view.
• Site: Values that were entered for this pre-defined attribute.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 821

DNS Views

You can also display the following column:

• Disabled: Indicates if the DNS view is enabled or disabled. Disabled DNS views are excluded from the
named.conf file.
From this list, you can do the following:
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• List the zones in a DNS view by clicking a DNS view name.
• Edit information about a DNS view, as described in the next section.
• Delete a DNS view, as described in Deleting DNS Views on page 823.

Modifying DNS Views

To modify a DNS view:
1. From the Data Management tab, click the DNS tab -> Zones tab-> dns_view check box -> Edit icon.
2. In the DNS View editor, you can do the following:
— In the General tab, you can change any of the information you entered through the wizard. You can also
disable a DNS view to temporarily block access to a DNS view. Disabling a DNS view excludes it from the
named.conf file. For a description of the fields, see the online Help or Configuring DNS Views on page 814.
— In the Match Clients tab, define or update a Match Clients list, as described in Defining Match Clients Lists
on page 815.
— In the Match Destinations tab, define or update match destinations, as described in Defining a Match
Destinations List on page 817.
— In the Forwarders tab, configure forwards for the view, as described in Using Forwarders on page 767.
— In the Queries tab, enable AAAA filtering and configure a list of IPv4 networks and addresses for allowing or
denying AAAA filtering, as described in Enabling AAAA Filtering on page 771.
— In the DNSSEC tab, you can specify parameters for DNSSEC as described in Configuring DNSSEC on a Grid
on page 971.
— In the Root Name Servers tab, you can configure root name servers, as described in About Root Name
Servers on page 792.
— In the Sort List tab, define a sort list for the DNS view, as described in Defining a Sort List on page 793.
— In the Blacklist tab, define blacklist rulesets, as described in Enabling Blacklisting on page 787.
— In the Extensible Attributes tab, you can modify the attributes. For information, see Using Extensible
Attributes on page 427.
— The Permissions tab displays if you logged in as a superuser. For information, see About Administrative
Permissions on page 195.
— In the Record Scavenging tab, define the rules for DNS records scavenging in the DNS view, as described in
Configuring DNS Record Scavenging Properties on page 804.
— In the Updates tab, specify the secure dynamic updates settings, as described in Secure Dynamic Updates
on page 959.
3. Save the configuration and click Restart if it appears at the top of the screen.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

822 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Views

Deleting DNS Views

You can delete a DNS view if it is not the only view associated with a network view and if it is not selected for dynamic
DNS updates. You cannot remove the system-defined default DNS view. When you remove a DNS view, the NIOS
appliance removes the forward and reverse mappings of all the zones defined in the DNS view.
To delete a DNS view:
• From the Data Management tab, select the -> DNS tab-> Zones tab-> dns_view check box.
To delete the DNS view immediately, click the Delete icon, and then click Yes to confirm the delete request. To
schedule the deletion, click Schedule Deletion and in the Schedule Change panel, enter a date, time, and time
zone. For information, see Scheduling Deletions on page 90.
Grid Manager moves the view to the Recycle Bin, from which you can restore or permanently delete it.

Configuration Example: Configuring a DNS View

In Figure 18.4, Member-A is a member of a Grid. It is the primary name server for the corp100.com zone in the internal
DNS view. It allows the IP address 192.168.10.1 and the 10.2.2.0/24 subnet access to DNS zone data in the internal
DNS view. At the zone level, it allows transfers to an external secondary server, Infoblox-B, with an IP address of
192.168.10.1. Infoblox-B is a secondary server for the corp100.com zone. The process follows these steps:
1. Adding an Internal DNS View on Member-A
2. Adding a Zone to a DNS View
3. Copying Records Between DNS Zones, from the corp100.com zone in the default DNS view to the corp100.com
zone in the internal DNS view
4. Verifying the Configuration

Figure 18.4 Configuring a DNS View

Master

Grid

Member-A 10.0.0.1 Infoblox-B 192.168.10.1

Primary Name Server External Secondary Name
for corp100.com Server for corp100.com

View “internal” { zone “corp100.com” {

match-clients {192.168.10.1; 10.2.2.0/24; }; type slave;
zone “corp100.com” { masters { 10.0.0.1; };
type master;
};
allow-query {10.2.2.0/24; };
allow-transfer {11.0.0.1; } //auto added
};
};

Adding an Internal DNS View

1. Expand the Toolbar and click Add -> Add DNS View.
2. In the Add DNS View wizard, specify the following, and then click Next:
— Name: internal
— Comment: internal DNS view
3. In the Match Clients panel, click Add and select IPv4 Network from the drop-down list.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 823

DNS Views

4. Do the following for IP addresses in the network 10.2.2.0/24:

— Enter 10.2.2.0/24 in the in the Address field.
— The Permission field displays Allow by default. Leave it as is.
— Click Add.
You will have 255 allowed client addresses in the Match Clients list when you are done.
5. Save the configuration and click Restart if it appears at the top of the screen.

Adding a Zone to a DNS View

1. Expand the Toolbar and click Add -> Zone -> Add Auth Zone.
2. In the Add Auth Zone wizard, click Add an authoritative forward-mapping zone and click Next.
3. Specify the following, and then click Next:
— Name: Enter corp100.com.
— DNS View: Select Internal from the drop-down list.
4. In step 3 of the wizard, do the following:
a. Select Use this set of name servers.
b. Click the Add icon and select Grid Primary.
c. Click Select Member and select Member A from the Select Grid Member dialog box.
d. Click Add to add the Grid member to the list of name servers.
e. Click the Add icon again and select External Secondary.
f. Enter the following information, and then click Add:
— Name: InfobloxB
— IP Address: 192.168.10.1
5. Click Save & Edit to display the Authoritative Zone editor and continue with the zone configuration.
6. Click Queries.
7. Click Override, and then click the Add icon and select IPv4 Network.
— Enter 10.2.2.0/8 in the in the Address field.
— The Permission field displays Allow by default. Leave it as is.
— Click Add.
This allows queries that the appliance answers from its internal DNS view.
8. Save the configuration and click Restart if it appears at the top of the screen.

Copying Records Between DNS Zones

1. Navigate to the default DNS view and select the corp100.com zone.
2. Expand the Toolbar and click Copy Records.
3. In the Destination field, click Select Zone, and then select the corp100.com zone in the Internal DNS view.
4. Select Copy all records, and then click OK.
5. Save the configuration and click Restart if it appears at the top of the screen.
The records from corp100.com in the default DNS view are copied to corp100.com in the internal DNS view.

Note: Only superusers can copy A, AAAA, shared A, and shared AAAA records with a blank name. Limited-access
users must have read/write permission to Adding a blank A/AAAA record in order to copy A, AAAA, shared A,
and shared AAAA records with a blank name, otherwise the copying records operation might fail. You can
assign global permission for specific admin groups and roles to allow to copy A, AAAA, shared A, and shared
AAAA records with a blank name. For more information, see Administrative Permissions for Adding Blank A or
AAAA Records on page 245.

824 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Views

Verifying the Configuration

1. In the DNS tab, click Members and select the Member-A check box .
2. Expand the Toolbar and click View -> View DNS Configuration.
3. In the DNS Configuration File viewer, scroll through the contents of the file.
Verify that the internal DNS view section is similar to the configuration file shown.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 825

DNS Views

826 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 19 Configuring DNS Zones
This chapter provides general information about DNS zones that you can configure and manage on the Infoblox
appliance. The topics in this chapter include:
• About Authoritative Zones on page 829
— Configuring Authoritative Zones on page 829
— Creating an Authoritative Forward-Mapping Zone on page 830
— Creating an Authoritative Reverse-Mapping Zone on page 830
— Creating a Root Zone on page 832
— Adding an Authoritative Subzone on page 833
— Locking and Unlocking Zones on page 834
— Enabling and Disabling Zones on page 834
• Removing Zones on page 852
• Configuring Authoritative Zone Properties on page 834
— IDN Support For DNS Zones on page 838
• About DNS Integrity Check for Authoritative Zones on page 836
— Configuring DNS Integrity Check on page 836
— Monitoring DNS Data Discrepancies for Authoritative Zones on page 837
• Assigning Zone Authority to Name Servers on page 839
— Specifying a Primary Server on page 840
— Specifying Secondary Servers on page 843
• Configuring Domain Controller List on page 846
— Configuring Domain Controller List on NIOS on page 846
— Configuring Domain Controller List on the Microsoft Server on page 847
• Using Name Server Groups on page 847
— Adding Name Server Groups on page 848
— Viewing Name Server Groups on page 848
— Applying Name Server Groups on page 849
• Importing Zone Data on page 849
— About Importing Data into a New Zone on page 851
— About Importing Data into an Existing Zone on page 851
— Importing Data into Zones on page 851
• Removing Zones on page 852
• Restoring Zone Data on page 854

NIOS 7.3 NIOS Administrator Guide (Rev. A) 827

Configuring DNS Zones

• Configuring Delegated, Forward, and Stub Zones on page 857

— Configuring a Delegation on page 857
— Configuring a Forward Zone on page 860
— Configuring Stub Zones on page 864
• Viewing Zones on page 873

828 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authoritative Zones

About Authoritative Zones

An authoritative zone is a zone for which the local (primary or secondary) server references its own data when
responding to queries. The local server is authoritative for the data in this zone and responds to queries for this data
without referencing another server.
There are two types of authoritative zones:
• Forward-mapping – An authoritative forward-mapping zone is an area of domain name space for which one or
more name servers have the responsibility to respond authoritatively to name-to-address queries.
• Reverse-mapping – A reverse-mapping zone is an area of network space for which one or more name servers
have the responsibility to respond to address-to-name queries.

Configuring Authoritative Zones

You can configure and manage authoritative forward-mapping and IPv4 and IPv6 reverse-mapping zones on an
Infoblox appliance. In a Grid, an authoritative forward-mapping zone is an area of domain name space for which one
or more Grid members have the responsibility to respond authoritatively to name-to-address queries. The Grid
members can function as primary or secondary servers for the zone.
You can add arpa as the top-level forward-mapping zone and manage its resource records. You can also add
in-addr.arpa (for ipv4 addresses) and ip6.arpa (for ipv6 addresses) as the top-level reverse-mapping zones.
You can create these top-level reverse-mapping zones under an arpa or a root parent forward-mapping zone or
without a parent zone. If you want arpa, in-addr.arpa, and ip6.arpa zones on the appliance, you must manually create
them. These zones are not auto-created.
Sample IPv4 reverse-mapping zone hierarchy:
. (root zone) > arpa > in-addr.arpa > 10.in-addr.arpa
Sample IPv6 reverse-mapping zone hierarchy:
. (root zone) > arpa > ip6.arpa > a.ip6.arpa
Following are the tasks to configure an authoritative zone:
1. Create the zone. The following sections explain how to create authoritative forward-mapping zones,
reverse-mapping zones, subzones, and a custom root zone:
— Creating an Authoritative Forward-Mapping Zone on page 830
— Creating an Authoritative Reverse-Mapping Zone on page 830
— Creating a Root Zone on page 832
2. Assign an Infoblox appliance as the primary or secondary server of the zone. For information, see Assigning Zone
Authority to Name Servers on page 839.
3. Import resource records or add resource records manually. The following provides information about resource
records:
— Managing Resource Records on page 880
— Importing Zone Data on page 849
4. Configure additional parameters. For information, see Configuring Authoritative Zone Properties on page 834.
5. Optionally, associate the zone with one or more networks. This is useful when you want to restrict the A, AAAA
and host records to IP addresses from specific networks. For information, see Associating Networks with Zones
on page 1093.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 829

Configuring DNS Zones

Creating an Authoritative Forward-Mapping Zone

An authoritative forward-mapping zone is an area of domain name space for which one or more Grid members have
the responsibility to respond authoritatively to name-to-address queries.

Note: A single forward-mapping zone can map names to both IPv4 and IPv6 addresses.

To create an authoritative forward-mapping zone:

1. From the Data Management tab, select the DNS tab, expand the Toolbar, and click Add -> Zone -> Add Auth Zone.
2. In the Add Authoritative Zone wizard, click Add an authoritative forward-mapping zone and click Next.
3. Specify the following:
— Name: Enter the domain name for the zone. Omit the trailing period (“ . ”) that signifies the root zone. You
can use IDNs as well. For information about IDNs, see Support for Internationalized Domain Names on
page 113.
— DNS View: This field displays only when there is more than one DNS view in the current network view. Select
a DNS view from the drop-down list.
— Comment: Enter a descriptive comment about the zone.
— Disable: Click this check box to temporarily disable this zone. For information, see Enabling and Disabling
Zones on page 834.
— Lock: Click this check box to lock the zone so that you can make changes to it and prevent others from
making conflicting changes. For information, see Locking and Unlocking Zones on page 834
4. Save the configuration, or click Next to continue to the next steps in the wizard as follows:
— Define the name servers for the zone. For information on specifying primary and secondary servers, see
Assigning Zone Authority to Name Servers on page 839. For information on specifying name server groups,
see Using Name Server Groups on page 847.
— If you have assigned a Microsoft server as the primary server for the zone and if the zone is AD-integrated,
you can configure a list of domain controllers that are allowed to add NS records to the zone. For
information see, Configuring Domain Controller List on page 846.
— Define extensible attributes. For information, see Using Extensible Attributes on page 427.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.
5. Click Restart if it appears at the top of the screen.

Creating an Authoritative Reverse-Mapping Zone

An authoritative reverse-mapping zone is an area of network space for which one or more name servers—primary and
secondary—have the responsibility to respond to address-to-name queries. Infoblox supports reverse-mapping
zones for both IPv4 and IPv6 addresses. You can add in-addr.arpa and ip6.arpa as the top-level reverse-mapping
zones. Note that you cannot add these zones using their IP addresses or netmasks, however, you can add them by
name "in-addr.arpa" and "ip6.arpa" respectively.

Specifying an RFC 2317 Prefix

RFC 2317, Classless IN-ADDR.ARPA delegation is an IETF (Internet Engineering Task Force) document that describes a
method of delegating parts of the DNS IPv4 reverse-mapping tree that correspond to subnets smaller than a /24 (from
a /25 to a /31). The DNS IPv4 reverse-mapping tree has nodes broken at octet boundaries of IP addresses, which
correspond to the old classful network masks. So, IPv4 reverse-mapping zones (and delegation points) usually fall
on /8, /16, or /24 boundaries.

830 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authoritative Zones

With the proliferation of CIDR (Classless Inter-Domain Routing) support for routing, ISPs no longer assign entire /24
networks to customers that only need a handful of IPv4 addresses. In general, IPv4 address assignments no longer
fall on classful boundaries. For DNS, a problem comes into play when an ISP gives a customer an address range that
is smaller than a /24, but the customer also wants to be delegated the DNS reverse-mapping zone.
If the ISP gives you, for example, a subnet with a 25-bit mask, then you only have half of the /24 address range. If you
configure your DNS server to be authoritative for the zone corresponding to a /24 subnet, the DNS server cannot
resolve half of the possible reverse-mapping records in the zone. RFC 2317 defines an approach, considered a best
practice, which addresses this issue.
In addition to IPv4 reverse-mapping zones, you can also configure IPv4 reverse-mapping delegation zones that have
an RFC2317 prefix. For more information about configuring a delegation for a reverse-mapping zone, see Configuring
a Delegation on page 857.

Note: Before enabling RFC 2317 support for zones, disable forwarders for the zone, especially when any sort of
delegation (including RFC 2317) is being used. If you do not, reverse lookups may fail. For more information,
contact Infoblox Support for the Tech Note on RFC 2317 delegation.

Adding an IPv4 Reverse-Mapping Zone

To add an IPv4 reverse-mapping zone:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Zone -> Add Auth Zone.
2. In the Add Authoritative Zone wizard, click Add an authoritative IPv4 reverse-mapping zone and click Next.
3. Specify the following zone information:
— Enter one of the following to identify the zone:
— IPv4 Network: Enter the IPv4 address for the address space for which you want to define the
reverse-mapping zone and select a netmask from the Netmask drop-down list. Alternatively, you can
specify the address in CIDR format, such as 192/8.
To use an RFC 2317 prefix, select a netmask value that is between 25 to 31, inclusive. Grid Manager
displays the RFC 2317 Prefix field. Enter a prefix in the text field. Prefixes can include alphanumeric
characters. For information, see Specifying an RFC 2317 Prefix on page 830.
— Name: Enter the domain name of the reverse-mapping zone.
— DNS View: This field displays only when there is more than one DNS view in the current network view. Select
a DNS view from the drop-down list.
— Comment: Optionally, enter additional information about the zone.
— Disable this zone: Select this option to temporarily disable this zone. For information, see Enabling and
Disabling Zones on page 834.
— Lock this zone: Select this option to lock the zone so that you can make changes to it and prevent others
from making conflicting changes. For information, see Locking and Unlocking Zones on page 834.
4. Save the configuration, or click Next to continue to the next steps in the wizard as follows:
— Define the name servers for the zone. For information on specifying primary and secondary servers, see
Assigning Zone Authority to Name Servers on page 839. For information on specifying name server groups,
see Using Name Server Groups on page 847.
— If you have assigned a Microsoft server as the primary server for the zone and if the zone is AD-integrated,
you can configure a list of domain controllers that are allowed to add NS records to the zone. For
information see, Configuring Domain Controller List on page 846.
— Define extensible attributes. For information, see Using Extensible Attributes on page 427.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.
5. Click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 831

Configuring DNS Zones

Adding an IPv6 Reverse-Mapping Zone

To add an IPv6 reverse-mapping zone:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Zone -> Add Auth Zone.
2. In the Add Authoritative Zone wizard, click Add an authoritative IPv6 reverse-mapping zone and click Next.
3. Enter the following zone information:
— Enter one of the following to identify the zone:
— IPv6 Network Prefix: Enter the 128-bit IPv6 address for the address space for which you want to define
the reverse-mapping zone. When you enter an IPv6 address, you can use double colons to compress a
contiguous sequence of zeros. You can also omit any leading zeros in a four-hexadecimal group. For
example, the complete IPv6 address 2006:0000:0000:0123:4567:89ab:0000:cdef can be shortened
to 2006::123:4567:89ab:0:cdef. Note that if there are multiple noncontiguous groups of zeros, the
double colon can only be used for one group to avoid ambiguity. The NIOS appliance displays an IPv6
address in its shortened form, regardless of its form when it was entered. Choose the network prefix
that defines the IPv6 network address space.
— Name: Enter the domain name of the reverse-mapping zone.
— DNS View: This field displays only when there is more than one DNS view in the current network view. Select
a DNS view from the drop-down list.
— Comment: Enter a descriptive comment about the zone.
— Disable: Click this check box to temporarily disable this zone. For information, see Enabling and Disabling
Zones on page 834.
— Lock: Click this check box to lock the zone so that you can make changes to it and prevent others from
making conflicting changes. For information, see Locking and Unlocking Zones on page 834.
4. Save the configuration, or click Next to continue to the next steps in the wizard as follows:
— Define the name servers for the zone. For information on specifying primary and secondary servers, see
Assigning Zone Authority to Name Servers on page 839. For information on specifying name server groups,
see Using Name Server Groups on page 847.
— Define extensible attributes. For information, see Using Extensible Attributes on page 427.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Creating a Root Zone

The NIOS appliance allows you to create an internal root zone for your organization. When the appliance receives a
query for DNS data that is not in its cache or authoritative data, it can query an internal root server after querying any
specified forwarders. If you do not specify an internal root server and the appliance can access the Internet, it queries
the Internet root servers. For information on root name server, see About Root Name Servers on page 792.
To create a root zone, create an authoritative forward-mapping zone as described in Creating an Authoritative
Forward-Mapping Zone on page 830 and specify the following:
• Enter a period (.) in the Name field.
• Optionally, enter a comment.
• Select a Grid member as the primary name server for the root zone.
Once created, the root zone automatically becomes the parent of all the zones under the root zone.

832 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authoritative Zones

Adding an Authoritative Subzone

After creating a zone, you can add more zones at the same level, or add subordinate zones (subzones). The subzones
can be authoritative, delegated, forward, or stub. For simplicity, the zones created in this example are authoritative
(as are all zones by default). For information about configuring the other zone types, see Configuring Delegated,
Forward, and Stub Zones on page 857.
You create an authoritative zone when you assign authority for all the resource records of a particular domain to one
or more name servers. You create a subzone when you assign authority for all the resource records of a subdomain
to name servers. The name servers can be the same as, or different from, the name servers that serve resource
records for the parent domain.
The distinction between domains and zones is that domains provide a logical structure to the DNS name space while
zones provide an administrative structure. The difference between domains and subdomains and zones and
subzones is that the terms subdomains and subzones reference their relationship to a parent domain or zone. With
the exception of the root domain and root zone, all domains are subdomains and all zones are subzones.
You can organize a domain based on logical divisions such as type (.com, .gov, .edu; or sales, eng, sup) or location
(.uk, .jp, .us; or hq, east, west). Figure 19.1 on page 833 shows one way to organize the external (public) name space
and the internal (private) name space for a corporation with the domain name corp100.com. The external name space
follows standard DNS conventions. Internally, you create an individual subdomain and corresponding subzone for
each department.

Figure 19.1 Domains and Subdomains, and Forward-Mapping Zones and Subzones

The DNS name space is logically The DNS name space is administratively
structured into domains and subdomains. structured into zones and subzones.

“ . “ = root domain . “ . “ (root) name server

top-level domain “com” com

(subdomain of “ . “) “com” name server

domain “corp100“ 
(subdomain of “com”) corp100 name server for
“corp100.com” ,
“sales.corp100.com” ,
and
“eng.corp100.com”
“sales”, “eng”, and “sup” (subdomains of “corp100“ )

sales eng sup name server for

“sup.corp100.com”

sales.corp100.com. eng.corp100.com. sup.corp100.com.

Note: Throughout this documentation, the trailing dot indicating the root zone is not shown, although its presence
is assumed.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 833

Configuring DNS Zones

The procedure for adding a subzone is the same as that used to add an authoritative zone. The only difference is that
you specify the subzone name in the Name field. For information about adding authoritative zones, see Configuring
Authoritative Zones on page 829.

Locking and Unlocking Zones

You can lock a zone when you create or edit it to prevent other administrators from making conflicting changes. When
you lock a zone, Grid Manager displays LOCKED beside the zone name when you view the records and subzones of
the zone in the Zones panel. When other administrators try to make changes to a locked zone, the system displays a
warning message that the zone is locked by admin_name.
You can perform dynamic updates through mechanisms such as DDNS and nsupdate on a locked zone. The system
can also add auto-generated records such as glue A records and NS records to a locked zone. Locks on a zone do not
impact its child zones.
Only a superuser or the administrator who locked the zone can unlock it. Locks do not expire; you must manually
unlock a locked zone.

Enabling and Disabling Zones

The NIOS appliance allows you to disable and enable a zone when you create or edit it. When you disable a zone, Grid
Manager removes it from the DNS configuration file, but not from the database. This feature is especially helpful when
you have to move or repair the server for a particular zone. You can easily disable a zone temporarily, and then enable
it after the move or repair is completed.

Note: When you temporarily disable a zone that has an associated NS group, the appliance removes all the
automatically generated NS records, glue A or AAAA records, and PTR records from the zone. The appliance
automatically generates the NS records, glue A or AAAA records, and PTR records when you re-enable the zone.

Configuring Authoritative Zone Properties

A zone inherits some of its properties from the Grid or from the member that serves it as a primary or secondary
server. When you edit a zone, you can override properties set at the Grid or member level and modify the original zone
settings, as well.
To configure authoritative zone properties:
1. From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and then click the Edit icon.
2. In the Authoritative Zone editor, you can do the following in each tab:
— General: Modify the original zone settings, except the zone name.
— Name Servers: Specify primary and secondary servers as described in Assigning Zone Authority to Name
Servers on page 839.
— Settings: Set certain properties if the primary server is a Grid member. If the zone’s primary server is an
external server, then all these fields, except Don’t use forwarders to resolve queries in subzones, are
read-only with the information derived from the SOA record of the zone.
— The Serial Number field displays the zone’s current serial number. You can change the serial number in
an SOA record only if the primary server of the zone is a Grid member.
The serial number in the SOA record increments every time the record is modified. This serial number
plays a key role when and how zone data is updated via zone transfers. The NIOS appliance allows you
to change the serial number (in the SOA record) for the primary server so it is higher than the secondary
server, thereby ensuring zone transfers come from the primary server (as they should).
— Override the Grid or member TTL settings as described in About Time To Live Settings on page 753.
— Override the email settings, as described in Adding an Email Address to the SOA Record on page 757.

834 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Authoritative Zone Properties

— Change the primary name server that is specified in the SOA MNAME of a zone, as described in
Changing the SOA Name for a Zone on page 841.
— Don’t use forwarders to resolve queries in subzones: If the DNS members are configured to use
forwarders to resolve queries that they cannot resolve locally, you can select this check box to disable
the use of forwarders to resolve queries for data in the subzones.
— Queries: Set restrictions for queries as described in Controlling DNS Queries on page 767.
— Zone Transfers: Specify to which servers zone transfers are allowed as described in Enabling Zone Transfers
on page 788.
— Updates: Set dynamic DNS update properties as described in Configuring DNS Servers for DDNS on page
927.
— Active Directory: Set parameters to allow zones to receive GSS-TSIG authenticated DDNS updates from
DHCP clients and servers in an AD domain. For information, see Supporting Active Directory on page 930.
— Extensible Attributes: Define extensible attributes. For information, see Using Extensible Attributes on page
427.
— Permissions: Define administrative permissions. For information, see About Administrative Permissions on
page 195.
3. Click Toggle Advanced Mode if the editor is in basic mode. When the additional tabs appear, you can do the
following in each tab:
— General: Click the Advanced subtab and view the networks associated with the zone. This tab is visible only
if the primary server is a Grid member, a Microsoft server, or unassigned.
If a zone is associated with one or more networks, the IP addresses of its host, A and AAAA records must
belong to the associated networks. You cannot change the network associations in this editor. Navigate to
the DHCP Network editor of the network, to change the zone associations. For information, see Associating
Networks with Zones on page 1093.
— DNS Integrity Check: Configure the appliance to monitor DNS data in the NS RRsets for authoritative zones.
The appliance generates alerts when data discrepancies have been detected so you can mitigate possible
DNS domain hijacking. For more information, see About DNS Integrity Check for Authoritative Zones on
page 836.
— Host Naming: Set restrictions for host names. For information, see Specifying Hostname Policies on page
795.
— Shared Record Groups: Add shared record groups to a zone. For information, see About Shared Record
Groups on page 900.
— DNSSEC: Configure DNSSEC properties. For information, see Chapter 22, DNSSEC, on page 963.
— Record Scavenging: Define the rules for DNS records scavenging in the zone, as described in Configuring
DNS Record Scavenging Properties on page 804.
— Updates: Click the Advanced subtab and specify the secure dynamic updates settings, as described in
Secure Dynamic Updates on page 959.
4. Save the configuration and click Restart if it appears at the top of the screen.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 835

Configuring DNS Zones

About DNS Integrity Check for Authoritative Zones

In certain DNS domain hijacking scenarios, hijackers alter the DNS data of a domain after gaining control of it. They
consequently redirect users to a fraudulent site, instead of the legitimate site, on the Internet. To protect your
authoritative DNS server against this type of DNS domain hijacking, you can configure the appliance to periodically
monitor DNS data for top-level or parent authoritative zones. Based on your configuration, the appliance periodically
checks DNS data in the NS RRsets for these zones and compares the data with that in the appliance database. It then
reports data discrepancies through SNMP traps and logs related events in the syslog. You can also monitor the status
of DNS data discrepancies, if any, through the DNS Integrity Check widget on the Task Dashboard. The severity in data
discrepancies can help identify possible domain hijacking.
DNS integrity check is supported on all Infoblox appliances, including Advanced Appliances used primarily for
Infoblox External DNS Security. For information about Infoblox External DNS Security, see About Infoblox External DNS
Security on page 1563. You can configure DNS integrity check for any selected authoritative zones, but you cannot
configure it at the Grid, member, or DNS view level.
When you enable this feature, the appliance queries the NS RRsets and glue records for the top-level authoritative
zones and compare the data with that in the appliance database. It does not query data for sub zones or delegated
zones in the Grid.

Configuring DNS Integrity Check

To configure the appliance to check NS and glue records for a top-level or parent authoritative domain, complete the
following:
1. From the Data Management tab, select the DNS tab -> Zones tab -> top-level authoritative zone that you want to
monitor, and then click the Edit icon from the Toolbar. Note that you can configure this feature only at the zone
level. You can also configure zones that have the same name in different DNS views.

Note: Once you configure a zone for DNS integrity check, you will not be able to add a parent zone above this
zone. You must disable DNS integrity check for this zone before you can add the parent zone.

2. In the Authoritative Zone editor, toggle to the Advanced Mode, select the DNS Integrity Check tab -> Basic tab and
complete the following:
— Enable: Select this check box to enable the DNS integrity check feature.
— Member: Click Select Member to select the Grid member you want to use for DNS integrity check. When you
select a member, ensure that the member is configured to send and receive DNS queries and responses
from Grid primaries (including stealth primaries) for the zone being monitored. Note that queries generated
by DNS integrity check for the first reachable internal Grid primary (including a stealth primary) are logged in
relevant DNS reports. For information about reports, see Infoblox Reporting and Analytics on page 1379.
— Check Frequency: Enter how often the appliance monitors DNS data for the authoritative zone. Select the
time unit from the drop down list. The appliance periodically queries DNS data for the top-level zone based
on the time interval you configure here. The default value is one hour, and the minimum configurable value
is 15 minutes.
— Enable Verbose Logging: Select this to enable detailed logging of events related to DNS integrity check.
When you select this option, the appliance logs additional information in the syslog when DNS data
discrepancies are detected. It also logs a message when no data discrepancies are found during a DNS data
check. When you clear this check box, the appliance logs standard information in the syslog and does not
log an event when no data discrepancies are found during a DNS integrity check. This is disabled by default.
For information about the syslog, see Viewing the Syslog on page 1341.
3. Save the configuration.

836 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS Integrity Check for Authoritative Zones

Monitoring DNS Data Discrepancies for Authoritative Zones

When the appliance detects DNS data discrepancies between the authoritative and delegated zones, it reports the
discrepancies through SNMP traps and email notifications, if configured. For more information, see Setting SNMP and
Email Notifications on page 1371. The appliance classifies data discrepancies by severity, as follows:
— Critical: Data in the NS RRsets for the authoritative and delegate zones are completely out of
synchronization.
— Severe: Some data in the NS RRset between the authoritative and delegate zones overlaps and some data
is different.
— Warning: The NS RRset for the authoritative zone is a subset of the NS RRset for the delegate zone. It is
possible that incorrect IP addresses have been entered at the registrar.
— Informational: The NS RRset for the delegate zone is a subset of the NS RRset for the authoritative zone.
This could indicate a possible delay in domain registration.
— Normal: There are no DNS data discrepancies between the NS RRsets for the authoritative and delegated
zones.
— None: No DNS discrepancies data has been collected or DNS integrity check has not been performed.
When different Grid primaries report different severity levels for the same data check, the appliance reports the most
severe discrepancy level. When different Grid primaries report the same severity for the data check, the appliance
reports only the first check.
You can use the following methods to monitor DNS data discrepancies for selected authoritative zones:
• Viewing syslog events, as described in Viewing the Syslog on page 1341.
• Monitoring DNS data discrepancy status through the DNS Integrity Check dashboard widget, as described in
DNS Integrity Check on page 161.
• Receiving SNMP traps and email notifications, as described in Setting SNMP and Email Notifications on page
1371.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 837

Configuring DNS Zones

About Domains and Zones

After creating a zone, you can add more zones at the same level, or add subordinate zones (subzones). The subzones
can be authoritative, delegated, forward, or stub.
The distinction between domains and zones is that domains provide a logical structure to the DNS name space while
zones provide an administrative structure. The difference between domains and subdomains and zones and
subzones is that the terms subdomains and subzones reference their relationship to a parent domain or zone. With
the exception of the root domain and root zone, all domains are subdomains and all zones are subzones.
You can organize a domain based on logical divisions such as type (.com, .gov, .edu; or sales, eng, sup) or location
(.uk, .jp, .us; or hq, east, west). Figure 19.1 on page 833 shows one way to organize the external (public) name space
and the internal (private) name space for a corporation with the domain name corp100.com. The external name space
follows standard DNS conventions. Internally, you create an individual subdomain and corresponding subzone for
each department.

Figure 19.2 Domains and Subdomains, and Forward-Mapping Zones and Subzones

The DNS name space is logically The DNS name space is administratively
structured into domains and subdomains. structured into zones and subzones.

“ . “ = root domain . “ . “ (root) name server

top-level domain “com” com

(subdomain of “ . “) “com” name server

domain “corp100“ 
(subdomain of “com”) corp100 name server for
“corp100.com” ,
“sales.corp100.com” ,
and
“eng.corp100.com”
“sales”, “eng”, and “sup” (subdomains of “corp100“ )

sales eng sup name server for

“sup.corp100.com”

sales.corp100.com. eng.corp100.com. sup.corp100.com.

On the Infoblox appliance, you can configure and manage DNS zones and subzones.

IDN Support For DNS Zones

Grid Manager supports IDNs for DNS zones and resource records. For information about IDN, see Support for
Internationalized Domain Names on page 113. You can use either IDN or punycode (representation of IDN) to create
DNS zones. Even if you use punycode to create a zone, the appliance automatically generates the corresponding IDN
and displays the zone name in its native characters. Make sure that you use valid punycode to create a DNS zone. If
you specify an invalid punycode, the appliance retains the punycode and does not convert it into IDN. Note that the
appliance displays both the IDN and punycode for an IDN zone.

838 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Assigning Zone Authority to Name Servers

The following table summarizes how the appliance displays IDNs at the DNS zone level:

NIOS DNS Domain (Punycode

Input NIOS Displays... in the GUI) Conversion Guidelines

hello.com hello.com hello.com No conversion

прывітанне.com прывітанне.com xn--80adk5aaihr3f9e.com IDN to punycode
xn--80adk5aaihr3f9e.com прывітанне.com xn--80adk5aaihr3f9e.com Punycode to IDN
\xyz format \xyz format \xyz format No conversion

Assigning Zone Authority to Name Servers

Forward-mapping zones answer name-to-address queries, and reverse-mapping zones answer address-to-name
queries. When you create an authoritative forward-mapping zone or reverse-mapping zone, you assign zone authority
to a name server and define it as the primary server for the zone. A primary server is designated as the primary source
for the zone and maintains a master copy of the zone data.
In a traditional DNS configuration, zone updates are performed based on a model that consists of a single primary
server and one or multiple secondary servers, which receive read-only zone updates from the primary through
database replications or zone transfers. Since the primary server contains editable zone data and is designated as
the primary source for the zone, it can become a single point of failure when it becomes unavailable. To avoid a single
point of failure for zone transfers, you can configure multiple primary servers for an authoritative zone.
When you define multiple primary servers for a zone, each primary has a copy of the zone’s authoritative data that
can be updated independently. When you modify zone data, the appliance replicates updated data among all
primary servers. When there are conflicts between zone updates, the appliance generally selects the latest updates
based on the timestamps the updates were made by the clients to the primary servers. Therefore, accurate time
synchronization among all servers in the DNS configuration is very important. For more information about other best
practices for configuring multiple primaries for an authoritative zone, see Best Practices for Defining Multiple
Primaries for Authoritative Zones on page 840.
You can also create one or more secondary name servers for a zone. A secondary server for a zone receives read-only
zone data from the primary server. If a zone is part of an internal DNS structure for a private network, the inclusion of
a secondary DNS server is optional, though highly recommended. If a zone is part of an external DNS structure for a
public network such as the Internet, then a secondary server in a different subnet from the primary server is required.
This requirement provides an additional safeguard against localized network failures causing both primary and
secondary name servers for a zone to become inaccessible.

Note: The primary/secondary relationship between name servers is also known as a master/slave relationship. You
can enter, modify, and remove zone data on the primary (or master) servers, which can then send new and
modified data in a read-only format to the secondary (or slave) servers. Both primary and secondary name
servers are authoritative for the zone data they serve. The distinction between them is how they get their zone
data.

In Grid Manager, you can specify the primary and secondary servers for a zone or you can specify a name server
group. A name server group is a collection of one or more primary servers and one or more secondary servers. For
information on name server groups, see Using Name Server Groups on page 847.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 839

Configuring DNS Zones

Best Practices for Defining Multiple Primaries for Authoritative Zones

Before you configure multiple primary servers for a zone, consider the following guidelines to ensure data integrity:
• This feature is designed to increase availability of the DNS service by allowing multiple primaries for a zone. It
will not increase overall throughput of DNS update traffic, as ultimately all updates must be replicated to (and
processed by) all of the primaries.
• When determining which appliances should act as primaries for the zone, consider that an additional SOA
record will be required in the database for each primary. This will add to the overall record count for the zone,
and each SOA will need to be updated for any change to the zone, which can impact performance.
• Enable NTP for all members (at the member level) and ensure that their times are properly synchronized with
their local time servers. Ensure that you select the “Exclude the Grid Master as an NTP server” option. The
appliance selects the latest zone updates based on the timestamps the updates were made by clients to the
primary servers. This is especially important when there are conflicts between two or more zone updates. For
information about NTP, see Using NTP for Time Settings on page 405.
• When specifying the primary server for secondaries, you can choose to have the appliance automatically select
it for you based on latency determination or you can manually specify it. When manually selecting a primary for
zone updates, consider using one that is close in proximity to the secondary servers, which can result in better
service performance. For information about setting preference for the primary server, see Adding Grid
Secondaries on page 844.
• You can configure a default primary for DDNS updates to a zone with multiple primary servers. To enhance
service performance, select a default primary that is close in proximity to the DHCP server that provides DDNS
updates. This is especially useful if you have DHCP members that are located in different locations. You can
configure a different default primary for each DHCP member based on their locations. For more information, see
Defining the Default Primary for DDNS Updates to Zones with Multiple Primaries on page 918.
• DNSSEC is not supported for zones with multiple primary servers. These zones must be unsigned. For
information about DNSSEC, see About DNSSEC on page 965.
• When determining which appliances should act as primaries for the zone, consider that an additional SOA
record will be required in the database for each primary. This will add to the overall record count for the zone,
and each SOA will need to be updated for any change to the zone, which can impact performance.

Specifying a Primary Server

When you create a zone, the primary server can be a Grid member, an external DNS server that you specify, or a
Microsoft DNS server that is managed by a Grid member. For information about managing Microsoft Windows DNS
servers, see Chapter 34, Managing Microsoft Windows Servers, on page 1251.
Although a zone typically has only one primary server, you can specify multiple primary servers for an authoritative
zone. You can configure multiple Grid primaries or multiple external primaries (including Microsoft AD-integrated
servers) for a zone, but you cannot configure both at the same time for the same zone. In addition, you can configure
one Microsoft server, but not multiple Microsoft servers (except for Microsoft AD-integrated servers), as the primary
server for a zone. Note that each primary server that you configure for a zone has its own MNAME for the SOA record
and serial number. For information about how to view and modify certain values in the SOA record, see Viewing and
Modifying SOA Records on page 870.
A hidden primary provides data to its secondary servers, which in turn respond to DNS queries using this data. One
of several advantages of this approach is that you can take the primary server offline for administrative or
maintenance reasons without causing a disruption to DNS service (within the expiration interval set for the validity
of its zone data—the default is 30 days).
When you add an authoritative forward-mapping zone and assign responsibility for the zone to a primary name server
whose host name belongs to the name space of the zone, the NIOS appliance automatically generates an NS (name
server) record and an A (address) record for the name server. This type of A record is called a glue record because it
“glues” the NS record to the IP address (in the A record) of the name server.

840 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Assigning Zone Authority to Name Servers

In Grid Manager, you can specify the primary server for a zone when you create it using the Add Authoritative Zone
wizard or when you edit an existing zone using the Authoritative Zone editor. For information on how to add a new
zone through the wizard, see Configuring Authoritative Zones on page 829. The following procedure describes how
to access the editor of a zone. To specify a primary server for an existing zone:
1. From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and then click the Edit icon.
2. In the Authoritative Zone editor, click Name Servers.
3. Select Use this set of name servers.
4. Click the Add icon and select one of the following options for a primary server:
— Grid Primary: Choose this option to select a Grid member as the primary server for the zone. See Specifying
Grid Primary Servers on page 841.
— Microsoft Primary: Choose this option to select a Microsoft DNS server as the primary server for the zone.
See Specifying Microsoft Primary Servers on page 842.
— External Primary: Choose this option if the appliance is in a Grid and you want to specify a primary server
outside the Grid (“external” to the Grid). See Specifying External Primary Servers on page 842.
5. Save the configuration and click Restart if it appears at the top of the screen.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Specifying Grid Primary Servers

In the Add Grid Primary panel, do the following, and then click Add to add the Grid member to the list of name servers
for the zone as primary:
• If no member is displayed, click Select to specify a Grid member. When there are multiple members, Grid
Manager displays the Member Selector dialog box from which you can select a primary name server. To select
multiple primary servers, click Select and then Add again.
• Stealth: Click this to hide the NS record for the primary name server from DNS queries. The NIOS appliance does
not create an NS record for the primary name server in the zone data. Clear the check box to display the NS
record for the primary name server in responses to queries.

Changing the SOA Name for a Zone

If the primary name server of a zone is a Grid member, the NIOS appliance allows you to change the SOA (start of
authority) name that is automatically created when you initially configure the zone. For example, you might want to
hide the primary server for a zone. If your appliance is named dns1.zone.tld, and for security reasons, you may
want to show a secondary server called dns2.zone.tld as the primary server. To do so, you would go to
dns1.zone.tld zone (being the true primary) and change the SOA to dns2.zone.tld to hide the true identity of the
real primary server.
To change the SOA name for a zone:
1. From the Data Management tab, select the DNS tab -> Zones tab-> dns_view -> zone check box -> Edit icon.
2. In the Authoritative Zone editor, click Settings.
3. Click Override beside the Primary name server field and enter the new SOA name. This field supports IDN.
4. Save the configuration and click Restart if it appears at the top of the screen.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 841

Configuring DNS Zones

Specifying Microsoft Primary Servers

You can assign a Microsoft server as the primary server of a zone when it is managed by a Grid member in read/write
mode. For information, see Chapter 34, Managing Microsoft Windows Servers, on page 1251. When a Microsoft
server is the primary server of a zone, the zone supports only standard DNS resource records. It does not support the
Infoblox record types host records, bulk host records, and shared record groups. You cannot add any of these records
to the zone nor assign a DNS zone with these records to a Microsoft server as the primary server.
In the Add Grid Primary panel, do the following to assign a Microsoft primary server:
1. Complete the following:
— Select Use this set of name servers.
— Click the Add icon and select Microsoft Primary.
2. In the Add Microsoft Primary panel, do the following, and then click Add to add the Microsoft primary server to
the list of name servers for the zone:
— If no server is displayed, click Select Server to specify a Microsoft server. When there are multiple servers,
Grid Manager displays the Server Selector dialog box from which you can select a Microsoft server. Grid
Manager lists Microsoft servers that are managed in read/write mode. It does not include Microsoft servers
managed in read-only mode.
— Information to create NS record: Grid Manager automatically creates the NS record. After you select a
server, Grid Manager populates the Name and IP Address fields. Grid Manager uses this information when it
creates the NS record, unless you select Stealth. You can specify a different FQDN or IP address for the NS
record; for example, for a multihomed server.
— Store the zone in Active Directory (AD Integrated Zone): This is enabled and selected by default only if the
Microsoft server is a domain controller. Note that you can enable Active Directory integration only after the
Microsoft server has been synchronized at least once because its AD ability is not known before the
synchronization. This is disabled when the Microsoft server is not a domain controller.
— Stealth: Select this option to hide the NS record for the primary name server from DNS queries. Grid
Manager does not create an NS record for the primary name server in the zone data. Clear this option to
display the NS record for the primary name server in responses to queries. Note that this option is not
available for AD-integrated zones.

Specifying External Primary Servers

In the Add External Primary panel, do the following, and then click Add to add the external primary server to the list
of name servers for the zone:
• Name: Type a resolvable domain name for the external primary server.
• Address: Type the IP address of the external primary server.
• Multi-master: This appears only when there is more than one external primary assigned to the zone. Select this
check box for external primary servers when the zone is in another Grid and has multiple Grid primaries. When
you select this option, it is selected for all external primaries assigned to the zone. This zone is identified as an
external zone with multiple primary servers.
• Use TSIG: To authenticate zone transfers between the local appliance and the external primary server using a
TSIG (transaction signature), select this check box. Infoblox TSIGs use HMAC-MD5 hashes. These are keyed
one-way hashes for message authentication codes using the Message Digest 5 algorithm. For details, see RFC
1321, The MD5 Message-Digest Algorithm, and RFC 2104, HMAC: Keyed-Hashing for Message Authentication.
— Key name: Type or paste the name of the TSIG key you want to use. This must be the same name as that of
the TSIG key on the external primary server.
— Key Data: Type or paste a previously generated key. This key must also be present on the external primary
server. You can generate a TSIG key, or obtain the TSIG key name and key from the external name server, by
accessing the server yourself or by requesting the server administrator to deliver them to you through some
out-of-band mechanism. Then type or copy-and-paste the name and key into the appropriate fields.

842 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Assigning Zone Authority to Name Servers

• Use 2.x TSIG: If you want to use TSIG authentication and the external primary name server is a NIOS appliance
running DNS One 2.x code, select this check box. The local appliance generates the required TSIG key for
authenticating DNS messages to and from appliances running DNS One 2.x code.

Note: On the appliance you configure as a secondary server for a zone, you must associate a TSIG key for each
primary server to which the secondary server requests zone transfers. On the appliance you configure as a
primary server for a zone, you can set a TSIG key at the Grid, member, or zone level. Because the secondary
server requests zone transfers, it must send a specific key in its requests to the primary server. Because the
primary server responds to the requests, it can have a set of TSIG keys from which it can draw when
responding. As long as the primary server can find the same TSIG key that the secondary sends it, it can verify
the authenticity of the requests it receives and authenticate the responses it sends. Use NTP to synchronize
the time on both name servers that use TSIG-authenticated zone transfers.

Specifying Secondary Servers

A secondary name server is as authoritative for a zone as a primary server. Like a primary server, a secondary server
answers queries from resolvers and other name servers. The main difference between a secondary and primary server
is that a secondary server receives all its data from a primary server, or possibly from another secondary server that
relays zone data it receives. The zone data passes from a primary to a secondary server (and possibly from that
secondary server on to another secondary server). This process is called a zone transfer.
The advantage of using primary and secondary name servers is that you enter and maintain zone data in one place—
on the primary server. The data is then distributed to the one or more secondary servers.
Secondary servers can be Grid members, external DNS servers or Microsoft DNS servers that are managed by Grid
members. In Grid Manager, you can specify the secondary server for a zone when you create it using the Add
Authoritative Zone wizard and when you edit an existing zone using the Authoritative Zone editor. For information on
how to add a new zone through the wizard, see Configuring Authoritative Zones on page 829. The following
procedure describes how to access the editor of a zone.
To specify a secondary server for an existing zone:
1. From the Data Management tab -> DNS tab -> Zones tab -> zone check box, and then click the Edit icon.
2. In the Authoritative Zone editor, click Name Servers.
3. Select Use this set of name servers.
4. Click the Add icon and select one of the following options:
• Grid Secondary: Selects the local appliance as the secondary server (or if the appliance is deployed in a
Grid and you want to make a different member the secondary server). See Adding Grid Secondaries on
page 844.
• Microsoft Secondary: Select this option if you want to specify a managed Microsoft DNS server as a
secondary server. See Specifying Microsoft Secondary Servers on page 845.
• External Secondary: Select this option if the appliance is in a Grid and you want to specify a secondary
server outside the Grid (“external” to the Grid), or if the appliance is deployed independently from a Grid.
See Specifying External Secondaries on page 845.
5. Save the configuration and click Restart if it appears at the top of the screen.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 843

Configuring DNS Zones

Adding Grid Secondaries

When adding Grid secondaries to a zone that has multiple primary servers, the appliance selects a primary server as
the active server based on the method that you have selected. If you select Automatic, the primary is selected based
on latency determination, which occurs separately on each primary. When available, the primary server that has the
lowest latency is preferred. When you select Manual, latency determination is ignored, and the first available primary
server in the list is selected as the active server. Thus if the first primary on the list is not available, the next available
primary is used. Depending on which primary server is selected, the Grid secondary returns the FQDN of the primary
in the MNAME field of the zone SOA record. It also includes the version of the zone content that it serves.
In the Add Grid Secondary panel, enter the following, and then click Add to add the Grid secondary server to the list
of name servers for the zone:
• If no member is displayed, click Select to specify a Grid member. When there are multiple members, Grid
Manager displays the Member Selector dialog box from which you can select a secondary name server.
• Stealth: This setting applies only if the primary server is a Grid member or Microsoft server. Select this to hide
the NS record for the secondary name server from DNS queries. The NIOS appliance does not create an NS
record for this name server in the zone data. Select the check box again to display the NS record for the
secondary name server in responses to queries. A secondary server in stealth mode is also known as a “hidden
secondary”. 
For example, you can configure a hidden secondary when a secondary server is at a branch office with a slow
connection to the rest of corporate network. Configure local hosts at the branch office to send DNS queries to
the secondary server, but keep it hidden from other name servers on the rest of the network so that they do not
send it queries. Instead, they use a server located in a different part of the network that has faster connection
speeds.
• Lead Secondary: This option becomes available only after you specify the primary name server as external.
When a primary server is external to a Grid whose members are secondary servers, you can select this check
box to designate one member as a lead secondary. The primary server sends zone transfers to the lead
secondary, which distributes the zone data to the other secondary servers in the Grid using zone transfers (not
the Grid data replication mechanism). After you designate a Grid member as a lead secondary for a zone, you do
not have to configure members to use the lead secondary server. All other Grid members acting as secondary
servers for the zone automatically use the lead secondary to get zone data. Using a lead secondary simplifies
the addition, modification, and removal of other secondary servers in the Grid. As long as the lead secondary
remains unchanged, you need not update intervening firewall policies or the external primary server whenever
you make changes to non-lead secondary Grid members. This approach also reduces the amount of traffic
between primary and secondary servers.
• Update Zones Using: This option becomes available only after you specify a Grid member as the primary server.
— Grid Replication (recommended): Select this check box to use Grid replication to move zone data from the
primary to secondary servers.
— DNS Zone Transfers: Select this check box to use the DNS zone transfer process to move zone data from the
primary to secondary servers.
• Primary Preference: This appears only for Grid secondaries that are assigned to zones with multiple primaries.
Select one of the following to set preference for selecting the primary server:
— Automatic: Choose this to allow the appliance to select the optimum primary server for zone updates based
on latency determination, which prefers the primary server that has the lowest latency. This is selected by
default.
— Manual: Choose this to manually select primaries for zone updates. In the Available Primaries and Selected
Primaries tables, click a name server and use the arrows to select and deselect primaries between the
tables. Then use the up and down arrows next to the Selected Primaries table to put the selected primaries
in a preferred order. The secondary servers will get zone updates from the selected primary server based on
the given order. To optimize service performance, select primary servers that are close in proximity to the
secondary servers.

844 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Assigning Zone Authority to Name Servers

Specifying Microsoft Secondary Servers

You can assign a Microsoft server as the primary server of a zone when it is managed by a Grid member in read/write
mode. For information, see Chapter 34, Managing Microsoft Windows Servers, on page 1251.
Since Microsoft servers cannot replicate data from the Grid, when a DNS zone is defined as a secondary on a
Microsoft server, the Microsoft server obtains the content of the zone only through DNS zone transfers.
• In the Add Microsoft Secondary panel, do the following:
— If no server is displayed, click Select Server to specify a Microsoft server. When there are multiple servers,
Grid Manager displays the Server Selector dialog box from which you can select a Microsoft server. Grid
Manager lists Microsoft servers that are managed in read/write mode. It does not include Microsoft servers
managed in read-only mode.
— Information to create NS record: Grid Manager automatically creates the NS record. After you select a
server, Grid Manager populates the Name and IP Address fields. Grid Manager uses this information when it
creates the NS record, unless you select Stealth.
— Stealth: This setting applies only if the primary server is a Grid member or a Microsoft server. Select this
option to hide the NS record for the secondary name server from DNS queries. Grid Manager does not
create an NS record for this name server in the zone data. Clear this option to display the NS record for the
secondary name server in responses to queries.

Specifying External Secondaries

In the Add External Secondary panel, enter the following, and then click Add to add the external secondary server to
the list of name servers for the zone:
• Name: Enter a resolvable domain name for the external secondary server.
• Address: Enter the IP address of the external secondary server.
• Stealth: This setting applies only if the primary server is a Grid member or a Microsoft server. Click this check
box to hide the NS record for the secondary name server from DNS queries. The NIOS appliance does not create
an NS record for the secondary name server in the zone data. Select the check box again to display the NS
record for the secondary name server in response to queries.

Note: To avoid an impact on your database performance, Infoblox recommends that you do not configure a large
number of external secondary servers in stealth mode. To ensure that these secondary servers receive
notifications about zone updates, you can allow zone transfers for these IP addresses and then enable the
appliance to add them to the also-notify statement. For information about how to configure this feature,
see Configuring Zone Transfers on page 789.

• Use TSIG: To authenticate zone transfers between the local appliance and the external secondary server using a
TSIG (transaction signature), select this check box. Infoblox TSIGs use HMAC-MD5 hashes. These are keyed
one-way hashes for message authentication codes using the Message Digest 5 algorithm. For details, see RFC
1321, The MD5 Message-Digest Algorithm, and RFC 2104, HMAC: Keyed-Hashing for Message Authentication.
— Key name: Type or paste the name of the TSIG key you want to use. This must be the same name as that
of the TSIG key for this zone on the external secondary server.
— Key: Type or paste a previously generated key. On the external secondary server, this key must also be
present and associated with this zone. You can generate a TSIG key, or you can obtain the TSIG key
name and key from the external name server, either by accessing the appliance yourself or by
requesting the appliance administrator to deliver them to you through some out-of-band mechanism.
Then, type or copy-and-paste the name and key into the appropriate fields.
• Use 2.x TSIG: Select this check box to use TSIG authentication and the external secondary name server is a NIOS
appliance running DNS One 2.x code. The local appliance generates the required TSIG key for authenticating
DNS messages to and from appliances running DNS One 2.x code.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 845

Configuring DNS Zones

Note: On the appliance you configure as a secondary server for a zone, you must associate a TSIG key for each
primary server to which the secondary server requests zone transfers. On the appliance you configure as a
primary server for a zone, you can set a TSIG key at the Grid, member, or zone level. Because the secondary
server requests zone transfers, it must send a specific key in its requests to the primary server. Because the
primary server responds to the requests, it can have a set of TSIG keys from which it can draw when
responding. As long as the primary server can find the same TSIG key that the secondary sends it, it can verify
the authenticity of the requests it receives and authenticate the responses it sends. Use NTP to synchronize
the time on both name servers that use TSIG-authenticated zone transfers.

Configuring Domain Controller List

When you configure an AD-integrated authoritative zone, by default all the domain controllers that belong to the
domain automatically add NS records to the AD-integrated zone, which might be undesirable in some deployment
scenarios. For example, if a domain controller is deployed in a company’s branch office, it is unlikely that the domain
controller should be registered as the name server for the company’s top-level zones. By configuring a domain
controller list for the AD-integrated zone, you can control which domain controllers are allowed to add NS records to
the zone. If you configure a domain controller list for an AD-integrated zone, only those in the list can add NS records
to the zone. You can configure the domain controller list for AD-integrated zones either on the NIOS appliance or on
the Microsoft server.

Configuring Domain Controller List on NIOS

You can configure a domain controller list for an AD-integrated authoritative zone to allow NS record creation for
specific domain controllers. You can add, modify, and delete the entries in the domain controller list if the Microsoft
server assigned to the zone is managed in read/write mode. If you have not configured the domain controller list
while configuring an AD-integrated zone, you can perform the configuration later while editing the zone.
Note the following about the domain controller list:
• If the domain controller list is empty for an AD-integrated zone, all domain controllers that belong to the domain
can add NS records to the AD-integrated zone.
• If you remove a domain controller from the domain controller list of an AD-integrated zone, the NS record that
belongs to the domain controller is not automatically deleted. You must manually delete the NS record from the
AD-integrated zone.
To configure a domain controller list for an AD-integrated zone:
1. From the Data Management tab, select the DNS tab -> Zones tab -> click the Add icon and select Authoritative Zone
from the drop-down menu.
2. Complete the details as mentioned in Configuring Authoritative Zones on page 829 and then complete the
following to specify a list of domain controllers that are allowed to add NS records to the AD-integrated zone:
— No: Select No if you do not want to configure a domain controller list for the AD-integrated zone. If you
select No, all domain controllers that belong to the domain can add NS records to the AD-integrated zone.
— Yes: Select Yes to configure a domain controller list for the AD-integrated zone.
If you select Yes, click the Add icon of the Domain Controller table and select one of the following from the
drop-down menu:
— Add: Select this to manually add the IP addresses of the domain controllers to the list. Grid Manager
adds a new row to the table. Specify the following:
• Address: Enter the IP address of the domain controller.
• Comment: Enter information about the domain controller.
To remove an entry from the list, select the entry and click the Delete icon.

846 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using Name Server Groups

— Auto-populate: Select this to automatically populate the Domain Controller table with the list of domain
controllers. In the Add Prepopulated Domain Controllers panel, select one of the following options:
• Zone: Select this to copy the list of domain controllers from an existing AD-integrated zone in the
NIOS database. Click Select to select the AD-integrated zone. Click Clear to remove the selected
zone.
• Servers in Domain: Select this to add the IP addresses of all the Microsoft servers available in the
NIOS database which belong to the same AD domain as the primary Microsoft server assigned to
the zone.
Click Add to add the list of domain controllers to the table. Grid Manager automatically populates the
Domain Controller table with the list of domain controllers in ascending order by IP address.

Note: The Auto-populate option to add the domain controller list is only available while configuring the
AD-integrated zone. It is not available when you edit the domain controller list in the Authoritative Zone
editor.

3. Save the configuration.

Configuring Domain Controller List on the Microsoft Server

You can configure a list of domain controllers that are allowed to add NS records to an AD-integrated zone on the
Microsoft server using the dnscmd command line utility as follows:
dnscmd DNS Server /Config Zone Name /AllowNSRecordsAutoCreation Ip Addresses
For example, if you are configuring a domain controller list for an AD-integrated zone foo.net on the DNS server,
192.69.0.1, use the following command:
dnscmd 192.69.0.1 /config foo.net /AllowNSRecordsAutoCreation 192.69.0.6 192.69.0.9
For more information about configuring a domain controller list for an AD-integrated zone on the Microsoft server see
https://technet.microsoft.com/en-us/library/cc755848%28v=ws.10%29.aspx.

Using Name Server Groups

An NS (name server) group is a collection of one or more primary DNS servers and secondary DNS servers. Grouping
a commonly used set of primary and secondary DNS servers together simplifies zone creation by enabling you to
specify a single NS group instead of specifying multiple name servers individually. After you create an NS group, you
can then assign it to serve authoritative forward-mapping and reverse-mapping zones. When you assign an NS group
to a zone, Grid Manager automatically generates an NS record, a glue A or AAAA record, and a PTR record for each
name server available in the NS group. But if the zone is disabled, Grid Manager does not generate these records.
Grid Manager generates authoritative A, AAAA, and PTR records when:
• A Grid member is added to a Grid, whose host name belongs to the name space of the authoritative zone and
vice versa.
• An external name server is assigned to a zone, whose host name belongs to the name space of the authoritative
zone.

Note: Grid Manager does not generate an NS record when the DNS service for the member is disabled.

The performance of the following functions significantly improve when you assign an NS group to a zone instead of
specifying multiple name servers individually:
• Starting and Stopping the DNS service.
• Reparenting the zones after removing or restoring a zone.
• Modifying the zone data.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 847

Configuring DNS Zones

Note: Only superusers can create and manage name server groups.

You can also group a set of external name servers as a delegation name server group and assign it to delegated zones.
For information see, Using Delegation Name Server Groups on page 859.

Adding Name Server Groups

To add a name server group:
1. From the Data Management -> DNS tab, do one of the following:
— Click the Name Server Groups tab -> Add icon -> Group -> Name Server Group.
— From the Toolbar, click the Add icon -> Group -> Name Server Group
2. In the Name Server Group wizard, do the following:
— Name: Type a name that provides a meaningful reference for this set of servers.
— Name Servers: Click the Add icon and select one of the following options for every server that you are
adding to the NS group:
— Grid Primary: Choose this option to select a primary name server or multiple primary servers for the
zone. See Specifying Grid Primary Servers on page 841.
— Grid Secondary: Choose this option to select a Grid member as a secondary server for the zone. See
Adding Grid Secondaries on page 844.
— External Primary: Choose this option if the appliance is in a Grid and you want to specify a primary
server outside the Grid (“external” to the Grid). See Specifying External Primary Servers on page 842.
— External Secondary: Choose this option if the appliance is in a Grid and you want to specify a
secondary server outside the Grid (“external” to the Grid), or if the appliance is deployed
independently from a Grid. See Specifying External Secondaries on page 845.
— Default NS Group: Select this to specify this name server group as the default.
— Comment: Optionally, enter additional information about the NS group.
3. Save the configuration and click Restart if it appears at the top of the screen, or click Next to define extensible
attributes. For information, see Using Extensible Attributes on page 427.
A newly created name server group appears in the Name Server Groups tab. You can then associate it with
forward-mapping and reverse-mapping zones.

Viewing Name Server Groups

You can view the configured authoritative and delegation name server groups by navigating to the Data Management
tab -> DNS tab -> Name Server Groups tab.
The panel displays the following information about each name server group:
• Name: The name of the name server group.
• Type: The name server group type. Possible values are Authoritative and Delegation.
• Comment: Comments that were entered for the name server group.
• Site: Values that were entered for this pre-defined attribute.
You can do the following:
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Edit the properties of a name server group.

848 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Importing Zone Data

— Select the check box beside a name server group, and then click the Edit icon.
• Delete a name server group.
— Select the check box beside a name server group, and then click the Delete icon. Note that you cannot
delete a delegation name server group that is assigned to a zone.
• Export the list of Grid members to a .csv file.
— Click the Export icon.
• Print the list of Grid members.
— Click the Print icon.

Applying Name Server Groups

In Grid Manager, you can assign a name server group to a zone when you first create it using the Add Authoritative
Zone wizard and when you edit an existing zone using the Authoritative Zone editor. For information on creating a
zone using the wizard, see Configuring Authoritative Zones on page 829. The panels used to assign a name server
group to a zone are the same in the wizard or and editor. The only difference is the way you access it. The following
procedure describes how to specify a name server group when editing a forward-mapping zone:
1. From the Data Management tab -> DNS tab -> Zones tab -> zone check box, and then click the Edit icon.
2. In the Authoritative Zone editor, click Name Servers.
3. Select Use this name server group, and then select the name server group from the drop-down list.

Note: If you apply a name server group to at least one zone or specify it as the default group, you cannot rename or
remove it. To rename or remove a group, you must first disassociate it from all zones and unassign it as the
default group.

Importing Zone Data

Importing zone information alleviates having to manually enter data through the Infoblox GUI. You can import data
from existing name servers, as well as from NIOS appliances running version 3.1r4 or later. You can import existing
zone data when you create a new zone and when you edit an existing zone. You can import one zone (and its
subzones) at a time.
For the remainder of this section, the name server that stores the existing zone data (which is imported) is referred
to as the source name server (regardless of whether it is a third-party server or another NIOS appliance). The
appliance that receives the zone data is referred to as the destination appliance. The following illustration shows the
import zone data process.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 849

Configuring DNS Zones

Figure 19.3 Importing Zone Data Process

1 Use the management system to

allow zone transfers on the source
DNS server to the NIOS appliance 2 Log in to the appliance and
IP address (10.1.1.5) specify the IP address of the NIOS
source DNS server when you Appliance
create or modify a zone. (10.1.1.5)
Management
System
(10.1.1.3) Login

3 The appliance sends a request to

import the specified zone data from
the source DNS server at 10.1.1.15.

Source DNS
Server
(10.1.1.15)

4 The source DNS server sends the

specified zone(s) data listed in the
zone file to the appliance.

zone data

The appliance imports zone data through a zone transfer. Therefore, the source name server must be authoritative
for the zone data being imported. You must also configure the source name server to allow zone transfers to the
destination appliance. On the source name server, you might need to modify the allow-transfer substatement to
include the IP address of the destination appliance prior to importing the data. If you are importing zone data to an
HA pair, use the VIP (virtual IP) address shared by the HA pair. For a single independent appliance, use the LAN IP
address. If you are importing zone data to a Grid, always use the IP address of the Grid Master.
If the source name server is an Infoblox appliance, you can configure it to allow zone transfers as described in
Enabling Zone Transfers on page 788. Note that a NIOS appliance, acting as the primary name server for a zone, by
default allows zone transfers to its secondary name servers. If the zone import fails, the zone to which the data is
imported will be disabled and the system does not create records and delegated subzones.

Note: The appliance does not encode punycode when you import zone data containing punycode. For example, a
zone data containing IDNs in punycode is stored in punycode for the data being imported. The data is
managed in punycode only.

850 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Importing Zone Data

About Importing Data into a New Zone

When the appliance imports data to a newly created zone, it imports the existing A, CNAME, DNAME, SRV, TXT, MX,
PTR, host, and bulk host records, but creates NS (and A records matching that NS record) and SOA records
appropriate for the destination server. The NS and SOA records are auto-created when a destination appliance is
specified as the primary or secondary name server for the new zone. If the imported zone has extra NS records, they
are rewritten to specify the source server as an external secondary. Delegation is also added for any subzones. The
subzone records are not imported.

About Importing Data into an Existing Zone

When you import zone data into an existing zone, the zone retains the NS and SOA records automatically created
when the zone was originally created and replaces all other records—A, PTR, MX, TXT, SRV, CNAME, DNAME, host, and
bulk host. The local appliance also retains subzones and records in the subzones that exist locally. If there are no
duplicates, the destination appliance records are retained. If the imported zone has extra NS records, those records
change to designate the source server as an external secondary.

Importing Data into Zones

In Grid Manager, you can import zone data when you create the zone using the Add Authoritative Zone wizard and
when you edit an existing zone. For information on how to add a new zone through the wizard, see Configuring
Authoritative Zones on page 829. The last step of the wizard provides the option to import zone data. The following
procedure describes how to import data into an existing zone.

Note: Only superusers can import zone data that contains A, AAAA, shared A, or shared AAAA records with a blank
name. Limited-access users must have read/write permission to Adding a blank A/AAAA record in order to
import zone data that contains A, AAAA, shared A, or shared AAAA records with a blank name, otherwise the
import zone data operation might fail. You can assign global permission for specific admin groups and roles
to allow to import A, AAAA, shared A, or shared AAAA records with a blank name. For more information, see
Administrative Permissions for Adding Blank A or AAAA Records on page 245.

To import data into an existing zone:

1. From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and then click Import Zone in
the Toolbar.
2. In the Import Zone dialog box, specify the following:
— The IP address of the name server from which you want to import data.
— Optionally, click the Automatically create Infoblox host records from A records check box.
3. Click Import.
When the local server successfully imports the zone data, a Confirmation message appears. If the local server
cannot import the zone data, an Error message appears, recommending that you verify the correctness of the IP
address of the remote server and zone information.

Note: If NIOS resolves the IP address of the imported zone data, an external secondary member is added to the
list of name servers with the exact IP address. If NIOS cannot resolve the IP address of the imported zone
data, it adds an external secondary member with the IP address 255.255.255.255 to the list of name
servers.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 851

Configuring DNS Zones

Removing Zones
Depending on the configuration, you may or may not be able to delete or schedule the deletion of a zone and all its
contents. Superusers can determine which group of users are allowed to delete or schedule the deletion of a zone
and all its contents. For information about how to configure the recursive deletion of zones, see Configuring Recursive
Deletions of Networks and Zones on page 327.
Note that you must have Read/Write permission to all the subzones and resource records in order to delete a zone.
The possible effects of removing or re-parenting are illustrated in Figure 19.4.
The appliance puts all deleted objects in the Recycle Bin, if enabled. You can restore the objects if necessary. When
you restore a parent object from the Recycle Bin, all its contents, if any, are re-parented to the restored parent object.
For information about the Recycle Bin, see Using the Recycle Bin on page 73.

Figure 19.4 Removing or Reparenting Subzones

Remove Zone B and … … remove its subzones. or … reparent its subzones.

Zone A Zone A Zone A

Zone B Zone B Zone B

Subzone C Subzone C Subzone C

The NIOS appliance removes zone B, The NIOS appliance removes zone B and
subzone C, and all their resource its resource records. It reparents subzone
records. C to zone A. It creates a new NS record in
zone A for subzone C and possibly
changes admin privileges for subzone C.

If you choose to reparent the subzones, be aware of the following caveats and possible effects of the reparenting:
• You cannot remove a zone and reparent its subzones if at least one of the subzones is a delegated zone. You
must first remove any delegated subzones, and then you can remove the zone and reparent its subzones.
• If there are AD (Active Directory) subzones (_msdcs, _sites, _tcp, _udp, domaindnszones, foresetdnszones) and
you opt to remove the parent zone only, the NIOS appliance reparents all subzones except the AD subzones,
which it removes regardless of the removal option you specify.
• The subzone reparenting option is unavailable when you select multiple zones for removal.
• A record created under a top-level reverse-mapping zone is reparented when its immediate parent zone is
created. If that parent zone is deleted, the record is restored to the top-level reverse-mapping zone.

852 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Removing Zones

Examples:
Example 1:
Step 1 - Add 10.in-addr.arpa under . (root zone)
Step 2 - If you add 10.in-addr.arpa, it is created under . (root zone)
Step 3 - if you add in-addr.arpa, then 10.in-addr.arpa is reparented under in-addr.arpa
Example 2
• Deleting in-addr.arpa from the hierarchy might lead to 10.in-addr.arpa reparenting under . (root
zone), depending on the Remove zone only/ Remove all subzones option you select.
• If in-addr.arpa is restored, it is restored under . (root) zone with all its resource records.
Example 3
• Consider in-addr.arpa zone having 10.10.in-addr.arpa + 10.0.0.1 (PTR record)
— If you add 10.in-addr.arpa, then 10.10.in-addr.arpa is reparented under 10.in-addr.arpa
and 10.0.0.1 PTR record is reparented from in-addr.arpa to 10.in-addr.arpa.
— If you delete 10.in-addr.arpa, then 10.10.in-addr.arpa is reparented under in-addr.arpa
(depending on the Remove zone only/ Remove all subzones option) and 10.0.0.1 PTR record is
deleted along with 10.in-addr.arpa zone.
• When you remove a zone and reparent its subzones, any subzone that inherited its admin access settings from
its previous parent zone (as opposed to having specific access settings for the subzone) now receive their
settings from its new parent zone, which might be different. See Figure 19.5.

Figure 19.5 Changed Admin Access Settings after Reparenting Subzones

If you remove Zone B and … … reparent its subzones …

Zone A Zone A
Read/Write Read/Write

Zone B Zone B
Deny Deny

Subzone C
Subzone C
Inherits
Inherits “Deny”
“Read/Write”

… the admin access settings for subzone C change because the privileges for its new parent
zone (zone A) are different from those of its previous parent zone (zone B).
Before you remove zone B, subzone C inherits a “Deny” admin access setting from zone B.
After the removal, subzone C inherits “Read/Write” access from its new parent zone, zone A.
Note that if you set a specific “Deny” admin access privilege for subzone C before removing its
parent zone (zone B), subzone C retains its specified “Deny” setting.

Note: Instead of removing a zone, you can also disable it. For more information, see Enabling and Disabling Zones
on page 834.

To remove a zone:
1. From the Data Management tab, select the DNS tab -> Zones tab.
2. Click the check box of the zones you want to delete.
3. Click the Delete icon.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 853

Configuring DNS Zones

4. Select one of the following. Note that these options appear only if you are allowed to delete zones and all its
contents. For information about how to configure this, see Configuring Recursive Deletions of Networks and
Zones on page 327.
— Remove zone only: Select this to remove the zone and all its content. The appliance reparents all subzones
to the parent zone of the zone that you want to remove, except for the automatically created AD (Active
Directory) subzones.
— Remove all subzones: Select this to remove the selected zone, all its subzones, and all the resource records
of the selected zone and its subzones.
5. Click Yes.
You can also schedule the deletion for a later time. Click Schedule Deletion and in the Schedule Change panel, enter
a date, time, and time zone. For information, see Scheduling Deletions on page 90. For information about scheduling
recursive deletions of zones, see Scheduling Recursive Deletions of Network Containers and Zones on page 90.

Restoring Zone Data

After you import or delete a zone, if you want the original zone back, you can restore it using the Recycle Bin. When
you import a zone for the first time, the appliance saves the zone and its resource records as a single object in the
Recycle Bin. It keeps the subzones with the zone. See Restoring Zone Data After a Zone Import Example on page 855.
When you reimport data into a zone, the software saves the zones, its resource records, and the delegated subzones
created by the previous import operation in the Recycle Bin. It keeps the subzones (not created during the zone
import) with the zone. See Restoring Zone Data After a Zone Reimport Example on page 856
If the zone import succeeds, the system adds resource records from the source to the target zone. It also adds
delegated subzones for the source subzones. If the zone import fails, the system does not create records and
delegated subzones. In either case, you can retrieve the original zone and its subzones from the Recycle Bin as
follows:
1. Delete the zone using the steps described in the section Removing Zones on page 852.
2. Select Remove zone only to remove the zone and its resource records. The NIOS appliance reparents all subzones
to the parent zone of the zone that you remove. Do not select Remove all subzones.
Automatically created AD (Active Directory) subzones are an exception. Even if you select Remove zone only, the
NIOS appliance still removes AD subzones.
3. In the Finder panel, click Recycle Bin.
4. Select the zone you want to restore and click the Restore icon.
The zone is restored back to its original state. The resource records are reparented back under it.

854 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Restoring Zone Data

Restoring Zone Data After a Zone Import Example

In the example shown in Figure 19.6:
1. import data from a source zone with subzones Sub x and Sub y into zone B with subzones Sub B1 and Sub B2.
The appliance stores zone B and its resource records in the Recycle Bin.
To retrieve zone B after the import:
2. Delete subzone B using the Remove zone only option.
The appliance reparents subzones Sub B1 and Sub B2 to the Zone A, which is the zone above Zone B.
3. After the import, you can restore zone B from the Recycle Bin. The appliance reparents the subzones Sub B1 and
Sub B2 back to zone B.

Figure 19.6 Restoring Zones After a Zone Import

3 Restore Zone B
2 To restore Zone B
from the Recycle
Bin. The appliance
after the import, reparents subzones
Zone A 1 You import Zone A delete Zone B and B1 and B2 back to
select the Remove Zone B.
subzones x and y Zone only option.
to Zone B
Zone B

Zone B
Source Zone B

Sub x The appliance saves Sub B1 The appliance

Zone B and its reparents the
Sub y resource records in the Sub B2 subzones B1 and B2
Recycle Bin.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 855

Configuring DNS Zones

Restoring Zone Data After a Zone Reimport Example

In the example shown in Figure 19.7:
1. You reimport data from the source zone with subzones Sub x and Sub y into zone B with subzones Sub B1 and
Sub B2.
To retrieve zone B after the import:
2. Delete the delegated subzones x and y and then remove subzone B using the Remove zone only option.
The appliance stores zone B and its resource records and the previously-imported subzones Sub x and Sub y (as
delegated subzones) in the Recycle Bin. It reparents subzones Sub B1 and Sub B2 to the zone above zone B
(Zone A).
3. After the import, you can restore zone B and the subzones Sub x and Sub y from the Recycle Bin. The appliance
reparents the subzones Sub B1 and Sub B2 back to zone B.

Figure 19.7 Restoring Zones After a Zone Reimport

To restore Zone B after 3 Restore Zone B and

the import, delete the subzones x and y from
2 delegated subzones x
the Recycle Bin. The
and y under Zone B appliance reparents its
1 and then remove Zone subzones B1 and B2
Zone A You import Zone A B by selecting the back to Zone B.
subzones x and y Remove Zone only
into Zone B. option.
Zone B

Source Zone B Zone B

Sub x
Sub x Sub B1
The appliance saves Zone The appliance Sub y
Sub y B and the subzones x and Sub B2 reparents the
y from the previous import subzones B1 and
(as delegated zones) in Sub x B2 to Zone A.
the Recycle Bin. Sub y

856 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Delegated, Forward, and Stub Zones

Configuring Delegated, Forward, and Stub Zones

In addition to authoritative zones, the NIOS appliance allows you to configure delegated, forward, and stub zones. A
delegated zone is a zone managed by (delegated to) another name server who owns the authority for the zone. A
forward zone is where queries are sent before being forwarded to other remote name servers. A stub zone contains
records that identify the authoritative name servers in another zone. This section covers the following topics:
• Configuring a Delegation
• Configuring a Forward Zone on page 860
• Configuring Stub Zones on page 864

Configuring a Delegation
Instead of a local name server, remote name servers (which the local server knows) maintain delegated zone data.
When the local name server receives a query for a delegated zone, it either responds with the NS record for the
delegated zone server (if recursion is disabled on the local server) or it queries the delegated zone server on behalf
of the resolver (if recursion is enabled).
For example, there is a remote office with its own name servers, and you want it to manage its own local data. On the
name server at the main corporate office, define the remote office zone as delegated, and then specify the remote
office name servers as authorities for the zone.
You can delegate a zone to one or more remote name servers, which are typically the authoritative primary and
secondary servers for the zone. If recursion is enabled on the local name server, it queries multiple delegated name
servers based on their round-trip times. You can also add arpa as a top-level forward-mapping zone and delegate its
subzones.
You can also configure TTL settings of auto-generated NS records and glue A and AAAA records for delegated zones
in forward-mapping, IPv4 reverse-mapping, and IPv6 reverse-mapping zones. For information, see About Time To Live
Settings on page 753.
The delegation must exist within an authoritative zone with a Grid primary server.

Configuring a Delegation for a Forward-Mapping Zone

To create a delegation for a forward-mapping zone:
1. From the Data Management tab, select the DNS tab -> Zones tab.
2. Click the parent zone to open it.
Grid Manager displays the Records and Subzones tabs of the zone.
3. From the Subzones tab, click the Add icon -> Zone -> Add Delegation.
4. In the Add Delegation wizard, specify the following:
— Name: This field displays a dot followed by the domain name of the current zone. Enter one or more labels
before the dot to specify the domain name of the subzone.
— DNS View: This field displays only when there is more than one DNS view in the network view. Displays the
DNS view of the current zone.
— Comment: Optionally, enter additional text about the zone.
— Disable: Click this check box to temporarily disable this zone. For information, see Enabling and Disabling
Zones on page 834
— Lock: Click this check box to lock the zone so that you can make changes to it, and also prevent others from
making conflicting changes. For information, see Locking and Unlocking Zones on page 834.
5. Click Next to assign a delegation name server group or define the name servers for the zone. Select one of the
following:
— Use this name server group: Select this to assign a delegation name server group for the delegated zone.
You can select the delegation name server group from the drop-down list.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 857

Configuring DNS Zones

— Use this set of name servers: Select this to define name servers for the delegated zone. In the Name
Servers panel, click the Add icon and specify the following information:
— Name: Enter the name of a remote name server to which you want the local server to redirect queries for
zone data. This is a name server that is authoritative for the delegated zone.
— Address: Enter the IP address of the delegated server.
For information about delegation name server group, see Using Delegation Name Server Groups on page 859.
6. Save the configuration and click Restart if it appears at the top of the screen, or click Next to define extensible
attributes as described in Using Extensible Attributes on page 427.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Configuring a Delegation for a Reverse-Mapping Zone

To create a delegation for a reverse-mapping zone:
1. From the Data Management tab, select the DNS tab -> Zones tab.
2. Click the parent zone to open it.
Grid Manager displays the Records and Subzones tabs of the zone.
3. From the Subzones tab, click the Add icon -> Zone -> Add Delegation.
4. In the Add Delegation wizard, specify the following:
— IPv4 Network: This field displays if you are creating a delegation zone for an IPv4 reverse-mapping zone.
Enter the IPv4 address for the address space for which you want to define the reverse-mapping zone and
select a netmask from the Netmask drop-down list. Alternatively, you can specify the address in CIDR
format, such as 192/8.
To use an RFC 2317 prefix, select a netmask value that is between 25 to 31, inclusive. Grid Manager
displays the following fields:
RFC 2317 Prefix: Enter a prefix in this field. Prefixes can include alphanumeric characters.
Allow manual creation of PTR records in parent zone: Select this check box to allow users to create labels
that correspond to IP addresses in the delegated address space in the parent zone.
For information about RFC 2317, see Specifying an RFC 2317 Prefix on page 830.
— IPv6 Network Prefix: This field displays if you are creating a delegation zone for an IPv6 reverse-mapping
zone. Enter the IPv6 prefix for the address space for which you want to define the reverse-mapping zone
and select the prefix length from the drop-down list.
— Name: This field displays a dot followed by the domain name of the current zone. Enter one or more labels
before the dot to specify the domain name of the subzone.
— DNS View: This field displays only when there is more than one DNS view in the network view. Select a DNS
view from the drop-down list.
— Comment: Optionally, enter additional text about the zone.
— Disable: Select this option to temporarily disable this zone.
— Lock: Select this option to lock the zone so that you can make changes to it and prevent others from making
conflicting changes.
5. Click Next to assign a delegation name server group or define the name servers for the zone. Select one of the
following:
— Use this name server group: Select this to assign a delegation name server group for the delegated zone.
You can select the delegation name server group from the drop-down list.
— Use this set of name servers: Select this to define name servers for the delegated zone. In the Name
Servers panel, click the Add icon and specify the following information:
— Name: Enter the name of a remote name server to which you want the local server to redirect queries for
zone data. This is a name server that is authoritative for the delegated zone.

858 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Delegated, Forward, and Stub Zones

— Address: Enter the IP address of the delegated server.

For information about delegation name server group, see Using Delegation Name Server Groups on page 859.
6. Save the configuration and click Restart if it appears at the top of the screen, or click Next to define extensible
attributes as described in Using Extensible Attributes on page 427.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Using Delegation Name Server Groups

Delegation NS (Name Server) group is a collection of external name servers for delegated zones. Adding a set of
external name servers to a single delegation NS group can significantly reduce configuration efforts. While
configuring delegated zones, you can specify a single delegation NS group instead of configuring multiple name
servers individually. After you create a delegation NS group, you can then assign it to serve only delegated zones.
When you assign a delegation NS group to a delegated zone, Grid Manager automatically generates an NS record, a
glue A or AAAA record, and a PTR record for each name server available in the delegation NS group. But if the zone is
disabled, Grid Manager does not generate these records.
Note the following while adding a delegation NS group:
• You cannot add a delegation NS group if a NS group with the same name already exists and vice versa.
• If a Grid has any Microsoft servers configured, delegation NS groups are not allowed and vice versa.
• You cannot delete a delegation NS group if it is assigned to a zone.

Adding Delegation Name Server Groups

To add a delegation name server group:
1. From the Data Management -> DNS tab, do one of the following:
— Click the Name Server Groups tab -> Add icon -> Delegation Name Server Group.
— From the Toolbar, click the Add icon -> Group -> Delegation Name Server Group.
2. In the Delegation Name Server Group wizard, complete the following:
— Name: Enter the name of the delegation NS group.
— Comment: Optionally, enter additional information about the delegation NS group.
3. Click Next to define the external name servers for the delegation NS group.
4. In the Name Server panel, click the Add icon and specify the following for every server that you are adding to the
delegation NS group:
— Name: Enter the name of the delegated name server.
— Address: Enter the IP address of the delegated name server.
5. Save the configuration and click Restart if it appears at the top of the screen, or click Next to define extensible
attributes. For information, see Using Extensible Attributes on page 427.
A newly created delegation NS group appears in the Name Server Groups tab. For information about viewing the name
server groups, see Viewing Name Server Groups on page 848. You can then associate it with delegated zones.

Applying Delegation Name Server Groups

You can assign a delegation NS group to a delegated zone when you first create it using the Add Delegation wizard
and when you edit an existing delegated zone using the Delegation Zone editor. For information about creating a
delegated zone using the wizard, see Configuring a Delegation on page 857.
Complete the following to assign a delegation NS group to a delegation zone:
1. From the Data Management tab -> DNS tab -> Zones tab -> delegation zone check box, and then click the Edit icon.
2. In the Delegation Zone editor, click Delegated Name Servers.
3. Select Use this name server group, and then select the name server group from the drop-down list.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 859

Configuring DNS Zones

Configuring a Forward Zone

When you want to forward queries for data in a particular zone, define the zone as a forward zone and specify one or
more name servers that can resolve queries for the zone. For example, define a forward zone so that the NIOS
appliance forwards queries about a partner’s internal site to a name server, which the partner hosts, configured just
for other partners to access.
You can override the default forwarders for a forward-mapping zone at a Grid member level and configure custom
forwarders. In other words, each Grid member can have its own forwarders for the forward zone. For example: a
forward-mapping zone foo.com served by two Grid members M1 and M2 with M1 forwarding queries to 10.1.0.1 and
10.1.0.2 and M2 forwarding queries to 90.3.3.3 and 90.4.4.1. Note that the Grid member uses the default forwarders
unless you override them at any level. For more information about domains and zones, see Configuring Authoritative
Zone Properties on page 834.

Note: The use of a forward zone is different from that of a forwarder. (A forwarder is a name server that performs
recursive lookups on behalf of the name servers that forward queries to it. For more information, see Using
Forwarders on page 767.) A NIOS appliance forwards queries to the name server of a forward zone because
the name server can resolve queries for the zone. A NIOS appliance forwards queries to a forwarder regardless
of zones.

Note that a name server can have only one definition for a zone in any given DNS view; a forward zone cannot be
configured on a member that already has a zone with the same domain name configured on it in the same DNS view.
To configure a forward-mapping zone:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Zone -> Add Forward
Zone.
2. In the Add Forward Zone wizard, click Add a forward forward-mapping zone and click Next.
3. Enter the following information, and then click Next:
— Name: Enter the domain name of the zone for which you want the NIOS appliance to forward queries.
— DNS View: This field displays only when there is more than one DNS view in the current network view. Select
the DNS view of the forward zone.
— Comment: Enter a descriptive comment.
— Disable: Click this check box to temporarily disable this zone.
— Lock: Click this check box to lock the zone so that you can make changes to it and prevent others from
making conflicting changes.
4. In the Default Zone Forwarders section, click the Add icon and specify the default servers to which the NIOS
appliance forwards queries for the zone:
— Name: Enter a domain name for the server to which you want the NIOS appliance to forward queries for the
specified domain name.
— Address: Enter the IP address of the server to which you want the NIOS appliance to forward queries.
— Select Use Forwarders Only if you want the NIOS appliance to query forwarders only (not root servers) to
resolve domain names in the zone.
5. In the Members section, you can select a Grid member or multiple members to serve the forward-mapping zone
and use the default forwarders or you can override default forwarders and configure custom forwarders for the
Grid members.
— Add: Click the Add icon to select the NIOS appliance on which the forward zone is configured. For an
independent deployment, select the local appliance (it is the only choice). If there are multiple Grid
members, the Member Selector dialog box is displayed. Select the required member from the list and click
OK.
— Name: Displays the name of the Grid member.
— IPv4 Address: Displays the IPv4 address of the Grid member.
— IPv6 Address: Displays the IPv6 address of the Grid member.

860 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Delegated, Forward, and Stub Zones

— Override Default Forwarders: Displays Yes when you override default forwarders. Otherwise, this field
displays No.
— Custom Forwarders: Displays the IP address of the custom forwarders. Otherwise, this field is blank.

Note: Skip the following two steps if you want to use the default forwarders.

6. Select a member and click the Edit icon.

7. In the Edit Per-Member Forwarders editor, select the Override Default Forwarders check box to override the
default forwarders. The Default Zone Forwarders table becomes available only after you select the Override
Default Forwarders check box. Click the Add icon to specify the servers to which the NIOS appliance forwards
queries for the zone:
— Name: Enter a domain name for the server to which you want the NIOS appliance to forward queries for the
specified domain name.
— Address: Enter the IP address of the server to which you want the NIOS appliance to forward queries.
— Select Use Forwarders Only if you want the NIOS appliance to query forwarders only (not root servers) to
resolve domain names in the zone.
— Save the configuration. After successfully saving the configuration, the Override Default Forwarders column
displays Yes and the Custom Forwarders column displays the IP address of the forwarders.
To configure forwarders for multiple members, repeat the steps for each Grid member.
8. Save the configuration, or click Next to continue to the next step where you define extensible attributes as
described in Using Extensible Attributes on page 427, and then optionally proceed to the next step where you
define admin permissions as defined in About Administrative Permissions on page 195.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.
9. Click Restart if it appears at the top of the screen.
To configure a forward IPv4 reverse-mapping zone:
1. From the Data Management tab, select the Zones tab, expand the Toolbar and click Add -> Zone -> Add Forward
Zone.
2. In the Add Forward Zone wizard, click Add a forward IPv4 reverse-mapping zone and click Next.
3. Enter the following information, and then click Next:
— IPv4 Network: Enter the IPv4 address for the address space for which you want to define the
reverse-mapping zone and select a netmask from the Netmask drop-down list. Alternatively, you can
specify the address in CIDR format, such as 192/8.
To use an RFC 2317 prefix, select a netmask value that is between 25 to 31, inclusive. Grid Manager
displays the RFC 2317 Prefix field. Enter a prefix in the text field. Prefixes can be alphanumeric characters.
For information, see Specifying an RFC 2317 Prefix on page 830.
or
Name: Enter the domain name of the reverse-mapping zone.
— DNS View: This field displays only when there is more than one DNS view in the network view. Select a DNS
view from the drop-down list.
— Comment: Optionally, enter additional information about the zone.
— Disable: Click this check box to temporarily disable this zone.
— Lock: Click this check box to lock the zone so that you can make changes to it, and also prevent others from
making conflicting changes.
4. In the Default Zone Forwarders section, click the Add icon and specify the servers to which the NIOS appliance
forwards queries for the zone:
— Name: Enter a domain name for the server to which you want the NIOS appliance to forward queries for the
specified domain name.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 861

Configuring DNS Zones

— Address: Enter the IP address of the server to which you want the NIOS appliance to forward queries.
— Select Use Forwarders Only if you want the NIOS appliance to query forwarders only (not root servers) to
resolve domain names in the zone.
5. In the Members section, you can select a Grid member or multiple members to serve the forward-mapping zone
and use the default forwarders or you can override default forwarders and configure custom forwarders for the
Grid members.
— Add: Click the Add icon to select the NIOS appliance on which the forward zone is configured. For an
independent deployment, select the local appliance (it is the only choice). If there are multiple Grid
members, the Member Selector dialog box is displayed. Select the required member from the list and click
OK.
— Name: Displays the name of the Grid member.
— IPv4 Address: Displays the IPv4 address of the Grid member.
— IPv6 Address: Displays the IPv6 address of the Grid member.
— Override Default Forwarders: Displays Yes when you override default forwarders. Otherwise, this field
displays No.
— Custom Forwarders: Displays the IP address of the custom forwarders. Otherwise, this field is blank.

Note: Skip the following two steps if you want to use the default forwarders.

6. Select a member and click the Edit icon.

7. In the Edit Per-Member Forwarders editor, select the Override Default Forwarders check box to override the
default forwarders. The Default Zone Forwarders table becomes available only after you select the Override
Default Forwarders check box. Click the Add icon to specify the servers to which the NIOS appliance forwards
queries for the zone:
— Name: Enter a domain name for the server to which you want the NIOS appliance to forward queries for the
specified domain name.
— Address: Enter the IP address of the server to which you want the NIOS appliance to forward queries.
— Select Use Forwarders Only if you want the NIOS appliance to query forwarders only (not root servers) to
resolve domain names in the zone.
— Save the configuration. After successfully saving the configuration, the Override Default Forwarders column
displays Yes and the Custom Forwarders column displays the IP address of the forwarders.
To configure forwarders for multiple members, repeat the steps for each Grid member.
8. Save the configuration, or click Next to continue to the next step where you define extensible attributes as
described in Using Extensible Attributes on page 427.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.
9. Click Restart if it appears at the top of the screen.
To configure a forward IPv6 reverse-mapping zone:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Zone -> Add Forward
Zone.
2. In the Add Forward Zone wizard, click Add a forward IPv6 reverse-mapping zone and click Next.
3. Enter the following zone information:
— IPv6 Network Address: Enter the 128-bit IPv6 address for the address space for which you want to define
the reverse-mapping zone. When you enter an IPv6 address, you can use double colons to compress a
contiguous sequence of zeros. You can also omit any leading zeros in a four-hexadecimal group. For
example, the complete IPv6 address 2006:0000:0000:0123:4567:89ab:0000:cdef can be shortened to

862 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Delegated, Forward, and Stub Zones

2006::123:4567:89ab:0:cdef. Note that if there are multiple noncontiguous groups of zeros, the double
colon can only be used for one group to avoid ambiguity. The NIOS appliance displays an IPv6 address in its
shortened form, regardless of its form when it was entered. Choose the network prefix that defines the IPv6
network address space.
or
Name: Enter the domain name of the reverse-mapping zone.
— DNS View: This field displays only when there is more than one DNS view in the network view. Select a DNS
view from the drop-down list.
— Comment: Enter a descriptive comment about the zone.
— Disable: Click this check box to temporarily disable this zone.
— Lock: Click this check box to lock the zone so that you can make changes to it, and also prevent others
making conflicting changes.
4. In the Default Zone Forwarders section, click the Add icon and specify the servers to which the NIOS appliance
forwards queries for the zone:
— Name: Enter a domain name for the server to which you want the NIOS appliance to forward queries for the
specified domain name.
— Address: Enter the IP address of the server to which you want the NIOS appliance to forward queries.
— Select Use Forwarders Only if you want the NIOS appliance to query forwarders only (not root servers) to
resolve domain names in the zone.
5. In the Members section, you can select a Grid member or multiple members to serve the forward-mapping zone
and use the default forwarders or you can override default forwarders and configure custom forwarders for the
Grid members.
— Add: Click the Add icon to select the NIOS appliance on which the forward zone is configured. For an
independent deployment, select the local appliance (it is the only choice). If there are multiple Grid
members, the Member Selector dialog box is displayed. Select the required member from the list and click
OK.
— Name: Displays the name of the Grid member.
— IPv4 Address: Displays the IPv4 address of the Grid member.
— IPv6 Address: Displays the IPv6 address of the Grid member.
— Override Default Forwarders: Displays Yes when you override default forwarders. Otherwise, this field
displays No.
— Custom Forwarders: Displays the IP address of the custom forwarders. Otherwise, this field is blank.

Note: Skip the following two steps if you want to use the default forwarders.

6. Select a member and click the Edit icon.

7. In the Edit Per-Member Forwarders editor, select the Override Default Forwarders check box to override the
default forwarders. The Default Zone Forwarders table becomes available only after you select the Override
Default Forwarders check box. Click the Add icon to specify the servers to which the NIOS appliance forwards
queries for the zone:
— Name: Enter a domain name for the server to which you want the NIOS appliance to forward queries for the
specified domain name.
— Address: Enter the IP address of the server to which you want the NIOS appliance to forward queries.
— Select Use Forwarders Only if you want the NIOS appliance to query forwarders only (not root servers) to
resolve domain names in the zone.
— Save the configuration. After successfully saving the configuration, the Override Default Forwarders column
displays Yes and the Custom Forwarders column displays the IP address of the forwarders.
To configure forwarders for multiple members, repeat the steps for each Grid member.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 863

Configuring DNS Zones

8. Click Next to continue to the next step where you define extensible attributes as described in Using Extensible
Attributes on page 427 or save the configuration and click Restart if it appears at the top of the screen.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Configuring Stub Zones

A stub zone contains records that identify the authoritative name servers in the zone. It does not contain resource
records for resolving IP addresses to hosts in the zone. Instead, it contains the following records:
• SOA (Start of Authority) record of the zone
• NS (name server) records at the apex of the stub zone
• A (Address) records that map the name servers to their IP addresses
Stub zones, like secondary zones, obtain their records from other name servers. Their records are read only;
therefore, administrators do not manually add, remove, or modify the records.
Stub zone records are also periodically refreshed, just like secondary zone records. However, secondary name
servers contain a complete copy of the zone data on the primary server. Therefore, zone transfers from a primary
server to a secondary server, or between secondary servers, can increase CPU usage and consume excessive
bandwidth. A name server hosting a stub zone maintains a much smaller set of records; therefore, updates are less
CPU intensive and consume less bandwidth.
When a name server hosting a stub zone receives a query for a domain name that it determines is in the stub zone,
the name server uses the records in the stub zone to locate the correct name server to query, eliminating the need to
query the root server.
Figure 19.8 and Figure 19.9 illustrate how the NIOS appliance resolves a query for a domain name for which it is not
authoritative. Figure 19.8 illustrates how the appliance resolves a query when it does not have a stub zone.
Figure 19.9 illustrates how the appliance resolves the query with a stub zone.
In Figure 19.8, a client sends a query for ftp.sales.corp200.com to the NIOS appliance. When the appliance receives
the request from the client, it checks if it has the data to resolve the query. If the appliance does not have the data,
it tries to locate the authoritative name server for the requested domain name. It sends nonrecursive queries to a root
name server and to the closest known name servers until it learns the correct authoritative name server to query.

864 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Delegated, Forward, and Stub Zones

Figure 19.8 Processing a Query without a Stub Zone

“ . “ (root)
Client sends a query  The appliance The appliance sends a
1 for ftp.sales.corp200
2 3 query to a root server.
determines it
.com to the NIOS does not have 
appliance. the record to
...which responds with a referral
resolve the
to the .com servers.
Client query.
.com

4 The appliance sends a query to

a .com server...

...which responds with a referral

to the corp200.com servers.

7 The appliance corp200.com

responds to the
client with the NIOS Appliance The appliance sends a query 
requested data
5
to a corp200.com server...

...which responds with a

referral to the
sales.corp200.com servers. sales.corp200.com

6 The appliance sends a query to

a sales.corp200.com server.

The sales.corp200.com server

checks its resource records
and responds with the Resource
requested data. Records

NIOS 7.3 NIOS Administrator Guide (Rev. A) 865

Configuring DNS Zones

In Figure 19.9, when the NIOS appliance receives the request for the domain name in corp200.com, it determines it
does not have the resource records to resolve the query. It does, however, have a list of the authoritative name
servers in the stub zone, corp200.com. The appliance then sends a query directly to the name server in corp200.com.

Figure 19.9 Processing a Query with a Stub Zone

“ . “ (root)
1 Client sends query for
ftp.sales.corp200.com
2 The appliance
has a
to the NIOS appliance. corp200.com
stub zone.

Client
.com
Stub Zone
Configuration

5 The appliance corp200.com

responds to the
client with the NIOS Appliance 3 The appliance send a query
requested data. directly to a corp200.com server...

... which respond with a referral to

the sales.corp200.com servers.
sales.corp200.com
4 The appliance send a query to a
sales.corp200.com server.

The sales.corp200.com
server checks its resource
records and responds with
Resource
the requested data.
Records

Stub zones facilitate name resolution and alleviate name server traffic in your network. For example, the client in the
previous examples is in corp100.com. The corp100.com and corp200.com zones are partners, and send all their
communications through a VPN tunnel, as shown in Figure 19.10 on page 867. The firewall protecting corp100.com
is configured to send all messages for the 10.2.2.0/24 network through the VPN tunnel. Infoblox_A hosts the stub
zone for corp200.com. Therefore, when the host in corp100.com sends a query for ftp.sales.corp200.com, Infoblox_A
obtains the IP address of Infoblox_B (10.2.2.7) from its stub zone records and sends the query to the firewall
protecting corp100.com.
Because the destination of the query is in the 10.2.2.0/24 network, the firewall (configured to encrypt all traffic to
the network) sends the request through a VPN tunnel to Infoblox_B. Infoblox_B resolves the query and sends back
the response through the VPN tunnel. All name server traffic went through the VPN tunnel to the internal servers,
bypassing the root servers and external name servers.

866 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Delegated, Forward, and Stub Zones

Figure 19.10 Stub Zone Configuration

corp100.com corp200.com

Host Infoblox_A Infoblox_B

10.1.1.3 10.2.2.7 sales.corp200.com

In parent-child zone configurations, using stub zones also eases the administration of name servers in both zones.
For example, as shown in Figure 19.10, sales.corp200.com is a child zone of corp200.com. On the corp200.com
name servers, you can create either a delegated zone or a stub zone for sales.corp200.com.
When you create a delegated zone, you must first specify the name servers in the delegated zone and manually
maintain information about these name servers. For example, if the administrator in sales.corp200.com changes the
IP address of a name server or adds a new name server, the sales.corp100.com administrator must inform the
corp200.com administrator to make the corresponding changes in the delegated zone records.
If, instead, you create a stub zone for sales.corp200.com, you set up the stub zone records once, and updates are
then done automatically. The name servers in corp200.com that are hosting a stub zone for sales.corp200.com
automatically obtain updates of the authoritative name servers in the child zone.
In addition, a name server that hosts a stub zone can cache the responses it receives. Therefore, when it receives a
request for the same resource record, it can respond without querying another name server.

Creating Stub Zones

When you create a stub zone on the NIOS appliance, you specify the following:
• The Grid member that is hosting the stub zone
You can specify multiple appliances if you want the stub zones on multiple name servers. If you do, the
appliances store identical records about the stub zone.
• The IP address of the primary server(s) that the NIOS appliance can query in the stub zone
The primary server can be a Grid member or an external primary server. If you specify multiple primary servers,
the appliance queries the primary servers, starting with the first server on the list.
The primary server and the name server hosting the stub zone can belong to the same Grid, as long as the
authoritative zone and the stub zone are in different DNS views. You cannot configure one zone as both authoritative
and stub in the same view.
After you create a stub zone, the NIOS appliance does the following:
1. It sends a query to the primary server for the SOA (Start of Authority) record of the stub zone.
The primary server returns the SOA record.
2. Then, it sends a query for the NS (name server) records in the zone.
The primary server returns the NS records and the A (address) records of the name servers. (These A records are
also called glue records.)
If the primary server is a NIOS appliance, you might have to manually create the A record and add it to the stub
zone. A NIOS appliance that is the primary server for a zone always creates an NS record, but does not always
create an A record.
— The appliance automatically creates an A record when its host name belongs to the name space of the
zone. For example, if the zone is corp100.com and the primary server host name is server1.corp100.com,
the appliance automatically creates the NS and A records and sends these records when it is queried by the
stub zone name server.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 867

Configuring DNS Zones

— The appliance does not automatically create an A record when its host name is in a name space that is
different from the zone. For example, if the zone is corp200.com and the primary server host name is
server1.corp100.com, then the appliance creates the NS record only and sends it when it is queried by the
stub zone name server. In this case, you must manually create the A record.

Maintaining Stub Zones

The NIOS appliance maintains the stub zone records and updates them based on the values in the SOA record as
follows:
• The refresh interval indicates when the appliance sends a discrete query to the primary name server for the stub
zone. The appliance learns about any changes in the stub zone and updates the NS and A records in the stub
zone accordingly.
• If the update fails, the retry interval indicates when the appliance resends a discrete query.
• If the query continues to fail, the expiry value indicates when the appliance stops using the zone data.

Adding Stub Zones

To add a stub zone, you must identify the Infoblox appliance that hosts the stub zone, and provide the IP address of
the primary server.
You can also add stub zones for Microsoft servers that are managed by Grid members. For information, see Managing
Microsoft Windows Servers on page 1251.
You can configure a stub zone for forward mapping or reverse mapping zones.
To add a forward-mapping stub zone:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Zone -> Add Stub Zone.
2. In the Add Stub Zone wizard, click Add a stub forward-mapping zone and click Next.
3. Specify the following, and then click Next:
— Name: Enter the name for the stub zone.
— Comment: Enter a useful comment, such as the admin to contact for the stub zone.
— Disable: Click this check box to temporarily disable this zone.
— Lock: Click this check box to lock the zone so that you can make changes to it, and also prevent others from
making conflicting changes.
4. In the Master Name Servers panel, click the Add icon and enter the Name and IP Address of the primary server
in the stub zone, and then click Next.
If the primary server is a Grid member, you must enter the host name and IP address of the Grid member. The
NIOS appliance does not validate these entries. Therefore, if you change the IP address of a Grid member listed
here, you must update the Grid member information in this list as well.
You can specify multiple primary servers for redundancy. If the primary server is a NIOS appliance, the appliance
must have the Minimal Response feature disabled so it can propagate the data to the stub server. For
information about the Minimal Response feature, see Specifying Minimal Responses on page 763.
— Optionally, click the Don’t use forwarders to resolve queries in subzones check box to indicate that the
name servers hosting the stub zone must not use forwarders to resolve queries for domain names in the
stub zone or in its subzones.
5. In the Name Servers panel, click the Add icon and select one of the following:
— Add Infoblox Member: Select this and select the Grid member that hosts the stub zone.
— Add Microsoft Server: Select this and select the Microsoft server that hosts the stub zone.
6. Click Next to continue to the next step where you define extensible attributes as described in Using Extensible
Attributes on page 427.
7. Save the configuration and click Restart if it appears at the top of the screen
or

868 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Delegated, Forward, and Stub Zones

Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.
You can define two types of reverse-mapping stub zones, one for IPv4 addresses and one for IPv6 addresses.
To configure an IPv4 reverse-mapping stub zone:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Zone -> Add Stub Zone.
2. In the Add Stub Zone wizard, click Add a stub IPv4 reverse-mapping zone and click Next.
3. Specify the following:
— IPv4 Network: Enter the IPv4 address for the address space for which you want to define the
reverse-mapping zone and select a netmask from the Netmask drop-down list. Alternatively, you can
specify the address in CIDR format, such as 192/8.
To use an RFC 2317 prefix, select a netmask value that is between 25 to 31, inclusive. Grid Manager
displays the RFC 2317 Prefix field. Enter a prefix in the text field. Prefixes can be alphanumeric characters.
For information, see Specifying an RFC 2317 Prefix on page 830.
or
Name: Enter the domain name of the reverse-mapping zone.
— DNS View: This field displays only when there is more than one DNS view in the network view. Select a DNS
view from the drop-down list.
— Comment: Optionally, enter additional information about the zone.
— Disable: Click this check box to temporarily disable this zone.
— Lock: Click this check box to lock the zone so that you can make changes to it, and also prevent others from
making conflicting changes.
4. In the Master Name Servers panel, click the Add icon and enter the Name and IP Address of the primary server
in the stub zone, and then click Next.
If the primary server is a Grid member, you must enter the host name and IP address of the Grid member. The
NIOS appliance does not validate these entries. Therefore, if you change the IP address of a Grid member listed
here, you must update the Grid member information in this list as well.
You can specify multiple primary servers for redundancy. If the primary server is a NIOS appliance, the appliance
must have the Minimal Response feature disabled so it can propagate the data to the stub server. For
information about the Minimal Response feature, see Specifying Minimal Responses on page 763.
— Optionally, click the Don’t use forwarders to resolve queries in subzones check box to indicate that the
name servers hosting the stub zone should not forward queries that end with the domain name of the stub
zone to any configured forwarders.
5. In the Name Servers panel, click the Add icon and select one of the following:
— Add Infoblox Member: Select this and select the Grid member that hosts the stub zone.
— Add Microsoft Server: Select this and select the Microsoft server that hosts the stub zone.
6. Click Next to continue to the next step where you define extensible attributes as described in Using Extensible
Attributes on page 427.
7. Save the configuration and click Restart if it appears at the top of the screen
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.
To configure an IPv6 reverse-mapping stub zone:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Zone -> Add Stub Zone.
2. In the Add Stub Zone wizard, click Add a stub IPv6 reverse-mapping zone and click Next.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 869

Configuring DNS Zones

3. Specify the following:

— IPv6 Network Prefix and Prefix Length: Enter the 128-bit IPv6 address for the address space for which you
want to define the reverse-mapping zone. When you enter an IPv6 address, you can use double colons to
compress a contiguous sequence of zeros. You can also omit any leading zeros in a four-hexadecimal
group. For example, the complete IPv6 address 2006:0000:0000:0123:4567:89ab:0000:cdef can be
shortened to 2006::123:4567:89ab:0:cdef. Note that if there are multiple noncontiguous groups of zeros,
the double colon can only be used for one group to avoid ambiguity. The NIOS appliance displays an IPv6
address in its shortened form, regardless of its form when it was entered. You can enter a slash and prefix
length in the IPv6 Network Prefix field or you can choose a value from the Prefix Length drop-down list.
or
— Name: Enter the domain name of the reverse-mapping zone.
— DNS View: This field displays only when there is more than one DNS view in the current network view. Select
a DNS view from the drop-down list.
— Comment: Enter a descriptive comment about the zone.
— Disable: Click this check box to temporarily disable this zone.
— Lock: Click this check box to lock the zone so that you can make changes to it and prevent others from
making conflicting changes.
4. In the Master Name Servers panel, click the Add icon and enter the Name and IP Address of the primary server
in the stub zone, and then click Next.
If the primary server is a Grid member, you must enter the host name and IP address of the Grid member. The
NIOS appliance does not validate these entries. Therefore, if you change the IP address of a Grid member listed
here, you must update the Grid member information in this list as well.
You can specify multiple primary servers for redundancy. If the primary server is a NIOS appliance, the appliance
must have the Minimal Response feature disabled so it can propagate the data to the stub server. For
information about the Minimal Response feature, see Specifying Minimal Responses on page 763.
— Optionally, click the Don’t use forwarders to resolve queries in subzones check box to indicate that the
name servers hosting the stub zone should not forward queries that end with the domain name of the stub
zone to any configured forwarders.
5. In the Name Servers panel, click the Add icon and select one of the following:
— Add Infoblox Member: Select this and select the Grid member that hosts the stub zone.
— Add Microsoft Server: Select this and select the Microsoft server that hosts the stub zone.
6. Click Next to continue to the next step where you define extensible attributes as described in Using Extensible
Attributes on page 427.
7. Save the configuration and click Restart if it appears at the top of the screen
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Viewing and Modifying SOA Records

The timer values in the SOA record determine when the zone data is updated. The MNAME field and the RNAME field
of the SOA record display the FQDN of the primary server and the administrative email address respectively. You can
view these default values and override them when necessary. For a zone that has multiple primary servers, Grid
Manager displays all configured primaries for the zone. You can click Override to override the Grid-level settings. If
the primary server is a Microsoft server however, the Override option does not appear. You can only change certain
values in the SOA record.
To view and modify zone SOA record values:
1. From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and then click the Edit icon.
2. In the Authoritative Zone or Stub Zone editor, click the Settings tab to view the following values. You can also click
Override to modify some of the values.

870 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Delegated, Forward, and Stub Zones

— Serial number: The current serial number for the primary server. This number is automatically increased
when changes are made to the zone or its record. The serial number plays a key role in determining when
and whether zone data is updated. You can change the serial number only if the primary server of the zone
is a Grid member. When the zone has multiple primary servers, each primary can have its own serial
number. In this case, the serial number displayed here is always that of the Grid Master, which will also
appear in the primary name server list if it is one of the primaries for the zone.

Note: If you change the serial number of the Grid Master, serial numbers for all primaries will be changed to the
same number. A warning is displayed when you try to decrement the serial number.

— Refresh: This interval tells secondary servers how often to send a message to the primary server for a zone
to check that their data is current, and retrieve fresh data if it is not. The default is three hours.
— Retry: This interval tells the secondary server how long to wait before attempting to recontact the primary
server after a connection failure between the two occurs. The default is one hour.
— Expire: If the secondary fails to contact the primary for the specified interval, the secondary stops giving out
answers about the zone because the zone data is too old to be useful. The default is 30 days.
— Default TTL: Specifies how long name servers can cache the data. The default is eight hours.
— Negative-caching TTL (Time to Live): Specifies how long name servers can cache negative responses. The
default is 15 minutes.
— Primary name server (for SOA MNAME field): If the primary name server of a zone is a Grid member, the
MNAME is inherited from its corresponding member, and you can change the name of the primary name
server that is published in the MNAME field of the SOA record. This field accepts names in native character
sets. If the zone has multiple primary name servers, a list of all primaries is displayed in this section. Each
primary has its own serial number and the number can be different among them. Note that the serial
numbers for these primaries are read-only and you cannot modify them. If you change the serial number of
the Grid Master, serial numbers for all primaries will be changed to the same number.
— Email Address (for SOA RNAME field): If the primary name server of a zone is a Grid member, you can enter
an administrator email address to the SOA record to help people determine who to contact about this zone.
The appliance supports IDN for the host name of the Email address. For example, you can create
admin@инфоблокс.рф but not админ@инфоблокс.рф.com.
— Don’t use forwarders to resolve queries in subzones: Select this option to disable the use of forwarders to
resolve queries for data in subzones.
3. Save the configuration and click Restart if it appears at the top of the screen.
To schedule this task, click the Schedule icon at the top of the wizard. In the Schedule Change panel, click Later, and
then specify a date, time, and time zone. The Schedule icon is green when there is a pending scheduled task. You
can reschedule the task if you have the applicable permissions.

Configuration Example: Configuring a Stub Zone in a Grid

This example illustrates how to configure a stub zone and assign it to a Grid member. You configure a Grid, Corp100,
with a single Grid Master and Grid member. The Grid member, member1.corp100.com, is the primary name server for
the corp100.com zone in the internal view. The Grid Master, gm-corp100.com, hosts the stub zone for corp100.com
in the external view. Thus, when the Grid Master receives a query for the corp100.com zone, it sends it directly to
member1.corp100.com, the primary name server for the zone.
In this example, you configure the following:
1. Turn off minimal responses on member1.corp100.com, the primary name server for the corp100.com zone. See
Disable Minimal Responses.
2. Create the internal and external views. See Create the Views.
3. Create the corp100.com authoritative zone and stub zone. See Create the Zones.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 871

Configuring DNS Zones

Disable Minimal Responses

After you create the Grid, turn off minimal responses for member1.corp100.com. Disabling minimal responses
ensures that member1.corp100.com propagates the required data to the server hosting the stub zone.
1. From the Data Management tab, select the DNS tab, click Members -> member1.corp100.com check box -> Edit
icon.
2. In the Member DNS Configuration editor, click the General -> Basic tab.
3. Clear the Return minimal responses check box.
4. Save the configuration and click Restart if it appears at the top of the screen.

Create the Views

Create the internal and external views. To create each view:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add DNS View.
2. In the Add DNS View wizard, enter the name of the view. In this example, enter either External or Internal.
3. Click Save & New and create the other DNS view.

Create the Zones

Create the corp100.com zone in the internal view and assign member1.corp100.com as the Grid primary server:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Zone -> Add Auth Zone.
2. In the Forward Authoritative Zone wizard, do the following:
— Select Add an authoritative forward-mapping zone and click Next.
— Enter the zone name, corp100.com and select the Internal DNS view. Click Next.
— Select Use this set of name servers and select member1.corp100.com as the Grid primary server.
3. Save the configuration and click Restart if it appears at the top of the screen.
After you create the zone, you can view the NS and A records which were automatically created.
Create the stub zone, corp100.com, in the external view, assign gm-corp100.com as the stub member and
member1.corp100.com as the stub primary server.
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Zone -> Add Stub Zone.
2. In the Stub Zone wizard, do the following:
— Select Add a stub forward-mapping zone and click Next.
— Enter the name of the stub zone, corp100.com and select the External DNS view. Click Next.
— In the Master Name Servers panel, click the Add icon and enter the following for the primary name server,
and then click Next:
Name: member1.corp100.com
Address: 10.35.0.222
— In the Name Servers panel, click the Add icon and select gm-corp100.com .
3. Save the configuration and click Restart if it appears at the top of the screen.
After you create the stub zone, the server hosting the stub zone, gm-corp100.com, sends queries to the primary
server, member1.corp100.com, for the SOA and NS records. member1.corp100.com then returns its NS records and
A (address) records.

872 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Zones

Viewing Zones
To list zones, navigate to the Data Management tab -> DNS tab -> Zones panel. If there is more than one DNS view in
the Grid, this panel lists the DNS views. Select a DNS view to list its zones. (For information, see Listing DNS Views
on page 821.)
• Click Toggle flat view to display a flat list of all the zones in the view.
• Click Toggle hierarchical view to display only the apex zones.
In the hierarchical view, you can see one entry for the host that represents the entire host object. In a host record,
there can be multiple DNS resource records (A, PTR, CNAME) and some DHCP data (fixed addresses) as well. In the
flat view, each of the DNS resource records in the host are listed separately.
For example, the host called server1.infoblox.com contains 2 A records and an ALIAS (which is a host naming
convention for CNAME records). If you view the infoblox.com zone using the hierarchical view option, you will see one
entry host for server1.infoblox.com. In the flat view, you will see three records (one for each IP address/A record, and
one host Alias for the CNAME). In the flat view, you cannot delete one piece of the host record. You can edit the host
record and you can remove information. Deleting host records deletes the entire host record only.
This panel displays the following information for each zone, by default:
• Name: The domain name of the zone.
• MS Sync Server: When a zone is served by multiple Microsoft servers, this column shows which Microsoft
server is actually performing the synchronization of that zone with the Grid.
• MS Zone Sync: Displays Yes if you have enabled zone synchronization, and displays No when the zone
synchronization is disabled. This column appears only when you have the Microsoft license installed.
• Grid Primary Server: The primary name server configured for an authoritative zone in the DNS view.
• Type: The zone type. Possible values are Authoritative, Forward, Stub and Delegation.
• Multi-master Zone: Indicates whether this zone has multiple primary name servers.
• Comment: Comments that were entered for the zone.
• Site: Values that were entered for this pre-defined attribute.
You can also display the following columns:
• Locked: Displays Yes when a zone is locked by an admin, and displays No when the zone is unlocked.
• Function: Indicates whether the zone is a forward-mapping, or an IPv4 or IPv6 reverse-mapping zone.
• ZSK rollover date: Displays the date when the ZSK is due for next rollover. The appliance performs a rollover
automatically at this time.
• KSK rollover date: Displays the date when the KSK is due for next rollover. The appliance performs a rollover
automatically at this time if you have enabled automatic KSK rollover. For more information, see Configuring
Automatic KSK Rollovers and Notifications on page 984. You must perform the rollover manually, if you have
disabled this option.
• Disabled: This field displays Yes if the zone is disabled. Otherwise, this field displays No.
• Signed: This field displays Yes if the zone is a DNSSEC-signed zone. Otherwise, this field displays No.
You can do the following:
• List the resource records and subzones of a DNS zone.
— Click a DNS zone name.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Edit the properties of a DNS zone.
— Click the check box beside a DNS zone, and then click the Edit icon.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 873

Configuring DNS Zones

• Delete a DNS zone.

— Click the check box beside a DNS zone, and then click the Delete icon.
• Export the list of DNS zones to a .csv file.
— Click the Export icon.
• Print the list of DNS zones.
— Click the Print icon.

874 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 20 DNS Resource Records
This chapter provides general information about Infoblox host records and DNS resource records. The topics in this
chapter include:
• About Bulk Hosts on page 876
— Specifying Bulk Host Name Formats on page 876
— Before Defining Bulk Host Name Formats on page 876
— Adding Bulk Hosts on page 879
• Managing Resource Records on page 880
— Managing A Records on page 880
— Managing NS Records on page 882
— Managing AAAA Records on page 883
— Managing PTR Records on page 884
— Managing MX Records on page 885
— Managing SRV Records on page 886
— Managing TXT Records on page 888
— Managing CNAME Records on page 889
— Managing DNAME Records
— Managing NAPTR Records on page 896
— Managing LBDN Records on page 898
— Modifying, Disabling, and Deleting Host and Resource Records on page 899
• About Shared Record Groups on page 900
— Shared Records Guidelines on page 901
— Configuring Shared Record Groups on page 901
— Managing Shared Resource Records on page 903
— Managing Associated Zones on page 906
— Configuration Example: Configuring Shared Records on page 907

NIOS 7.3 NIOS Administrator Guide (Rev. A) 875

DNS Resource Records

About Bulk Hosts

If you need to add a large number of A and PTR records, you can have the NIOS appliance add them as a group and
automatically assign host names based on a range of IP addresses and the host name format you specify. Such a
group of records is called a bulk host, which the appliance manages and displays as a single bulk host record.

Specifying Bulk Host Name Formats

Bulk host name formats provide a flexible way to define bulk host names. You create multiple bulk host formats at
the Grid level. Either select from the default bulk host formats or create your own. You can specify a different format
for each bulk host. When you assign a bulk host name format to a bulk host in a zone, the system applies the zone’s
host name policy to it.
A bulk host name consists of a prefix, a suffix, and the name of the domain to which the host belongs. The prefix can
contain any printable character that complies with the zone host name policy. It can also be blank. The suffix is
derived from an IP address in the bulk host IP address range. The appliance also supports IDNs for bulk host names.
You can use IDNs or their punycode representations while creating bulk hosts.
The following table summarizes how the appliance displays bulk host names that contain IDNs:

NIOS DNS Domain (Punycode

Input NIOS Displays... in the GUI) Conversion Guidelines

hello hello hello No conversion

прывітанне прывітанне xn--80adk5aaihr3f9e IDN to punycode
xn--80adk5aaihr3f9e xn--80adk5aaihr3f9e xn--80adk5aaihr3f9e No conversion
\xyz format \xyz format \xyz format No conversion

The suffix format is a string of ASCII characters that uses $ (unpadded) or # (zero-padded) followed by 1,2,3,4 to refer
to the first, second, third, or fourth IP address octet; it uses $1,$2,$3,$4 or #1,#2,#3,#4. $2 refers to the second
unpadded octet and #4 refers to the fourth zero-padded octet. For example:
The prefix of a bulk host = info
IP address = 10.19.32.133
Domain name = infoblox.com.
If you specify the default four-octet format -$1-$2-$3-$4, the bulk host name is
info-10-19-23-133.infoblox.com.
If you specify a custom name format such as *#1*#2*#3*#4, the bulk host name is
info*010*019*023*133.infoblox.com.

Before Defining Bulk Host Name Formats

Before you specify a bulk host name format, ensure that it complies with the following rules:
• The NIOS appliance uses <prefix>-xx-xx-xx-xx for bulk hosts. Ensure that the bulk host name does not conflict
with CNAMEs, DNAMEs, or host name aliases.
• When you add a bulk host, if you enable the Automatically add reverse mapping option and there is a CNAME
record in the corresponding reverse zone that conflicts with a PTR record generated by the bulk host, the bulk
host insertion fails and an error message appears. For example, if there is a CNAME with the alias 15 in a
reverse zone 1.168.192.in-addr.arpa and if you add a bulk host foo/192.168.1.10/192.168.1.20 with the
Automatically add reverse mapping option selected, the insertion fails and an error message appears because
both the bulk host and the CNAME generate a record 15.1.168.192.in-addr.arpa in the reverse zone.

876 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Bulk Hosts

• You cannot create or change a bulk host if a zone is locked by another user. If you select a different template for
the Grid, it changes each record associated with the bulk host.
• You can define bulk host name formats only at the Grid level and override them at the bulk host level; not at the
zone or bulk host object level.
• When you upgrade to NIOS 4.3r3 or earlier releases, the system migrates existing bulk hosts as follows:
— If you did not customize the bulk host IP format, there is no action required. All migrated bulk hosts
continue to use the Grid-level default four-octet format -$1-$2-$3-$4. See Specifying Bulk Host Name
Formats on page 876.
— If you customized the bulk host IP format, the system creates a new template called Migrated Default
template. All migrated bulk hosts override the Grid default template and use the Migrated Default template.

Note: The NIOS appliance considers two bulk hosts that have the same prefix, start address, and end address as
duplicate hosts; even if they use different bulk host formats.

Bulk Host Name Format Rules

Table 20.1 describes the rules that you should follow when you create bulk host name formats. It also provides
examples of valid and invalid formats for each rule.
Table 20.1 Bulk Host Name Format Rules and Examples

Rule Example
The suffix format cannot have more -$4-$5 is invalid.
than four octets.
The octets must be in order. -$2-$3-$4 is valid but -$3-$2-$4 is invalid.
Do not skip octets. -$2-$3-$4 is valid but -$2-$4 is invalid.
Do not use a combination of both the -$2-#3-$4 is invalid.
$ and # symbols together as octet
references; use only one of them.

The suffix format must contain at least -$4 is valid but -$3 is invalid.
the fourth octet. You must define at
least one -$4 or -#4.
If the suffix format uses $ references, -$2-$3-$4
it cannot be preceded by a digit. You
must add a non-digit prefix to each $
or # reference.
The \ character is the designated For the IP address 10.19.32.133, the format \#-#1-#2-#3-#4 expands
escape character for the $, # and \ to #-010-019-032-133.
characters.
You cannot use the $ or # symbols as
separators unless you prefix them
with an escape character \.
The bulk host name format must You cannot insert a bulk host name format -?-$4 in a zone that uses
comply with its zone host name policy. Allow Underscore as host name policy because the policy does not
allow you to use the ? character in the host name.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 877

DNS Resource Records

Table 20.1 Bulk Host Name Format Rules and Examples

Rule Example
The bulk host name must comply with The sum of the bulk host name prefix and suffix cannot be greater
the maximum label length. than 63 characters. When you enter a suffix format, the NIOS
appliance determines the length of the longest bulk host defined, and
checks that the sum of the bulk host prefix and suffix length does not
exceed 63 characters; if it does, an error message appears.
The bulk host name cannot result in
an FQDN with more than 255
characters.
The NIOS appliance computes the For the format string -$1-$2-$3-$4, the maximum length of the suffix
maximum length of the bulk host is -255-255-255-255; that is, 16 characters. Therefore, the maximum
suffix by expanding the bulk host IP length of the host prefix is 47 characters.
format using 255.255.255.255.
The bulk host name must not be the If there is a CNAME record with alias foo-003-015, you cannot insert a
same as a CNAME/DNAME. bulk host foo/1.2.3.10/1.2.3.20 using template -#3-#4 because
foo-003-015 is also one of the synthetic host names in the bulk host.
Each host name in the bulk host must You cannot insert a bulk host foo/1.2.3.10/1.2.4.20 using the
be unique. template -$4 because the system resolves the host name foo-10 to
both 1.2.3.10 and 1.2.4.10. To ensure that the bulk host name is
unique, use the template -$3-$4.
You cannot insert a bulk host that If there is a bulk host foo/1.2.3.10/1.2.4.20 using the template
violates the uniqueness of two bulk -$3-$4, you cannot insert another bulk host foo/1.3.4.10/1.3.5.20
hosts that have the same prefix and using the same template because the system resolves host name
use the same name format. foo-4-15 to both 1.2.4.15 and 1.3.4.15. Instead, use the template
-$2-$3-$4 to ensure that the two bulk hosts are unique.

The appliance provides four predefined formats. You can define additional formats or change the default format at
the Grid level only. To define new bulk host name formats:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
2. Select the Host Naming tab of the Grid DNS Properties editor.
The Bulk Host Name Formats table displays four predefined name suffix formats. The following examples show
the host name that each format generates for the zone test.com:
Four Octets: $1-$2-$3-$4 (Default)—Generates foo-192-168-1-15.test.com.
Three Octets: -$2-$3-$4—Generates foo-168-1-15.test.com
Two Octets: -$3-$4—Generates foo-1-15.test.com
One Octet: -$4—Generates foo-15.test.com
For the IP address 10.100.0.10, the format -$1-$2-$3-$4 generates the host name suffix -10-100-0-10. The
format #1-#2-#3-#4 generates the host name suffix -010-100-000-010.
3. Click Add to enter the name and format of a new bulk host name format.
4. Optionally, click the Default column of a format and select Default to make it the Grid default.
5. Save the configuration and click Restart if it appears at the top of the screen.

878 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Bulk Hosts

Adding Bulk Hosts

To add a bulk host:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Host -> Add Bulk Host.
2. In the Add Bulk Host wizard, complete the following fields:
• Prefix: If Grid Manager displays a zone name, enter a prefix (or series of characters) to insert at the beginning of
each host name. The displayed zone name can either be the last selected zone or the zone from which you are
adding the bulk host record. If no zone name is displayed or if you want to specify a different zone, click Select
Zone. When there are multiple zones, Grid Manager displays the Zone Selector dialog box. Click a zone name in
the dialog box, and enter a prefix for the bulk host record. You can enter any printable character that complies
with the zone host name policy or you can also leave this blank.
The sum of the bulk host prefix length and suffix length must not exceed 63 characters. When you enter a prefix,
the NIOS appliance computes the maximum length of the bulk host suffix to verify that the total prefix and suffix
length does not exceed 63 characters. If it does, the appliance displays an error message indicating the number
of characters that you must remove to make a valid prefix.
— DNS View: Displays the DNS view of the zone to which the bulk host records belong.
— Host Name Policy: Displays the host name policy of the selected DNS zone.
— Name Format: To override the default four-octet suffix format or the format set at the Grid level, and specify
a different format, click Override and select a host name format from the Name Formats drop-down menu.
The Name Formats drop-down menu lists the formats Four Octets, Three Octets, Two Octets, and One Octet
along with any other bulk host name formats that you have defined.
— Starting IP Address: Enter the first IP address in the range of addresses for the group.
— End IP Address: Enter the last IP address in the range of addresses for the group.
— Comment: Optionally, enter additional information for this record.
— Automatically Add Reverse Mapping: Click to have the appliance automatically create a PTR record for each
IP address within the bulk host range.
— Disable: Clear the check box to enable the record. Select the check box to disable it.
3. Click Next to define extensible attributes for the bulk host record. For information, see Using Extensible Attributes
on page 427.
4. Save the configuration and click Restart if it appears at the top of the screen
To modify or delete a bulk host, see Modifying, Disabling, and Deleting Host and Resource Records on page 899.

Example 1 - Responding to DNS AXFR Queries

This example shows the responses the bulk host foo/1.2.3.10/1.2.3.20 returns to DNS AXFR (Full Zone Transfers)
queries.
If the bulk host uses the template -$3-$4, the query returns:
foo-3-10.test.com
foo-3-11.test.com
......
foo-3-20.test.com
If the bulk host uses the template -#2-#3-#4, the query returns:
foo-002-003-010.test.com
foo-002-003-011.test.com
......
foo-002-003-020.test.com

NIOS 7.3 NIOS Administrator Guide (Rev. A) 879

DNS Resource Records

Example 2 - Importing Zones with Bulk Hosts

When you import zones with bulk hosts, the system selects the most specific match.
The following example can possibly match three octet, two octet, and one octet formats; however, the system selects
the most specific four octet default format.
The query:
foo-1-2-3-4 IN A 1.2.3.4
foo-1-2-3-5 IN A 1.2.3.5
Results in the match:
foo/1.2.3.4/1.2.3.5(Four Octets)
Not in any of the following:
foo-1/1.2.3.4/1.2.3.5(Three Octets)
foo-1-2/1.2.3.4/1.2.3.5(Two Octets)
foo-1-2-3/1.2.3.4/1.2.3.5(One Octet)

Managing Resource Records

DNS resource records provide information about objects and hosts. DNS servers use these records to respond to
queries for hosts and objects. The appliance supports IDNs for all DNS resource records. For information about IDNs,
see Support for Internationalized Domain Names on page 113. Note that the appliance does not decode the IDN of
a resource record to punycode. In other words, a record that contains a domain name in punycode is displayed in
punycode and a record that contains an IDN is displayed in its native characters.
You can manage the following types of DNS resource records:
• A (IPv4 Address)—For information, see Managing A Records on page 880.
• NS (Name server)—For information, see Managing NS Records on page 882.
• AAAA (IPv6 Address)—For information, see Managing AAAA Records on page 883.
• PTR (Pointer)—For information, see Managing PTR Records on page 884.
• MX (Mail exchanger)—For information, see Managing MX Records on page 885.
• SRV (Service location)—For information, see Managing SRV Records on page 886.
• TXT (Text)—For information, see Managing TXT Records on page 888.
• CNAME (Canonical name)—For information, see Managing CNAME Records on page 889.
• DNAME—For information, see Managing DNAME Records on page 891.

Managing A Records
An A (address) record is a DNS resource record that maps a domain name to an IPv4 address. To define a specific
name-to-address mapping, you can add an A record to a previously defined authoritative forward-mapping zone. If
the zone is associated with one or more networks, the IP address must belong to one of the associated networks. For
example, if the A record is in the corp100.com zone, which is associated with 10.1.0.0/16 network, then the IP
addresses of the A record must belong to the 10.1.0.0/16 network. For information about associating zones and
networks, see Associating Networks with Zones on page 1093.
The appliance also supports wildcard A records. For example, you can use a wildcard A record in the corp100.com
domain to map queries for names such as www1.corp100.com, ftp.corp100.com, main.corp100.com, and so on to
the IP address of a public-facing web server. Note that wildcard names only apply when the domain name being
queried does not match any resource record.

880 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

NIOS allows superusers to add A records with a blank name. Limited-access users must have read/write permission
to Adding a blank A/AAAA record to add A records with a blank name. You can assign global permission for specific
admin groups and roles to allow limited-access users to add blank A records. For more information, see
Administrative Permissions for Adding Blank A or AAAA Records on page 245.

Note: If an A record with the domain name in its native characters is added to the Infoblox Grid through DDNS
updates, the Name field displays the record name in UTF-8 encoded format. For example, an A record with the
domain name 工作站 .test.com added through DDNS updates displays
\229\183\165\228\189\156\231\171\153.test.com in the Name field.

Adding A Records
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Record -> Add A Record.
2. In the Add A Record wizard, do the following:
— Name: If Grid Manager displays a zone name, enter the hostname that you want to map to an IP address.
The displayed zone name can either be the last selected zone or the zone from which you are adding the
host record. If no zone name is displayed or if you want to specify a different zone, click Select Zone. When
there are multiple zones, Grid Manager displays the Zone Selector dialog box. Click a zone name in the
dialog box and then enter the hostname. The name you enter is prefixed to the DNS zone name that is
displayed, and the complete name becomes the FQDN (fully qualified domain name) of the host. For
example, if the zone name displayed is corp100.com and you enter admin, then the FQDN becomes
admin.corp100.com. Ensure that the domain name you enter complies with the hostname restriction policy
defined for the zone. To create a wildcard A record, enter an asterisk (*) in this field.
— DNS View: This field displays the DNS view to which the DNS zone belongs.
— Shared Record Group: This field appears only when you are creating a shared record. Click Select Shared
Record Group. If you have only one shared record group, the appliance displays the name of the shared
record group here. If you have multiple shared record groups, select the shared record group in the Shared
Record Group Selector dialog box. You can use filters or the Go to function to narrow down the list.
— Hostname Policy: Displays the hostname policy of the zone.
— In the IP Addresses section, click the Add icon and do one of the following:
— Select Add Address to enter the IPv4 address to which you want the domain name to map.
or
— Select Next Available IPv4 to retrieve the next available IP address in a network.
If the A record is in zone that has associated networks, the Network Selector dialog box lists the
associated networks. If the zone has no network associations, the Network Selector dialog box lists the
available networks. When you select a network, Grid Manager retrieves the next available IP address in
that network.
— Comment: Optionally, enter additional information about the A record.
— Create associated PTR record: Select this option to automatically generate a PTR record that maps the
specified IP address to the hostname. To create the PTR record, the reverse-mapping zone must be in the
database.
— Disable: Select this check box to disable the record. Clear the check box to enable it.
3. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
4. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 881

DNS Resource Records

Modifying A Records
When you modify an A record, you can do the following:
• In the General tab, you can change the information you previously entered through the wizard, as described in
Adding A Records on page 881.
• The Discovered Data tab displays discovered data, if any, for the record. For information, see Viewing
Discovered Data on page 642.
You can also enter or edit information in the TTL, Extensible Attributes and Permissions tabs. For information on
modifying and deleting resource records, see Modifying, Disabling, and Deleting Host and Resource Records on page
899.

Managing NS Records
An NS record identifies an authoritative DNS server for a domain. Each authoritative DNS server must have an NS
record. Grid Manager automatically creates NS records when you assign a Grid member as the primary server for a
zone or when you assign an NS group to a zone. Grid Manager generates two NS records; an authoritative NS record
for the current zone; and a delegation NS record for the parent zone for each name server available in the NS group.
You cannot edit an automatically generated NS record. Note that when you delete a name server from an NS group,
the NS record associated with the name server is deleted. For information about using NS Groups, see Using Name
Server Groups on page 847. You can manually create NS records for other zones. NS records associated with one or
more IP addresses are used for related A record and PTR record generation. You can configure an NS record for anycast
IP addresses on the appliance. For more information about anycast, see About Anycast Addressing for DNS on page
1035.

Adding NS Records
To add an NS record:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Record -> Add NS Record.
2. In the Add NS Record wizard, complete the following fields:
— Zone: The displayed zone name can either be the last selected zone or the zone from which you are adding
the NS record. If no zone name is displayed or if you want to specify a different zone, click Select Zone.
When there are multiple zones, Grid Manager displays the Zone Selector dialog box.
— DNS View: Displays the DNS view to which the selected zone belongs.
— Hostname Policy: Displays the hostname policy of the selected zone.
— Name Server: Enter the host name that you want to configure as the name server for the zone . IDN is not
supported in this field. You can use the punycode representation of an IDN in this field.
3. Click Next to enter IP addresses for the name server.
4. In the Name Server Addresses panel, click the Add icon and complete the following fields:
— Address: Enter the IP address of the name server.
— Add PTR Record: This field displays Yes by default, enabling the automatic generation of a PTR record for the
IP address. You can select No to disable the generation of the PTR record.
5. Click Next to define extensible attributes, or save the configuration and click Restart if it appears at the top of the
screen.

882 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

Modifying and Deleting NS Records

When you modify an NS record, you can change the following information:
• In the General tab, you can change the name server name.
• In the Addresses tab, you can do the following:
— Delete an address by selecting it and clicking the Delete icon.
— Add an address by clicking the Add icon, and then entering the IP address and completing the Add PTR
Record field.

Managing AAAA Records

An AAAA (quad A address) record maps a domain name to an IPv6 address. To define a specific name-to-address
mapping, add an AAAA record to a previously defined authoritative forward-mapping zone. If the zone is associated
with one or more networks, the IP address must belong to one of the associated networks. For example, if the AAAA
record is in the corp100.com zone, which is associated with the 1111:0001/32 network, then the IP addresses of the
A record must belong to that network. For information about associating zones and networks, see Associating
Networks with Zones on page 1093.

Note: If an AAAA record with the domain name in its native characters is added to the Infoblox Grid through DDNS
updates, the Name field displays the record name in UTF-8 encoded format. For example, an AAAA record with
the domain name 工作站 .test.com added through DDNS updates displays
\229\183\165\228\189\156\231\171\153.test.com in the Name field.

NIOS allows superusers to add AAAA records with a blank name. Limited-access users must have read/write
permission to Adding a blank A/AAAA record to add AAAA records with a blank name. You can assign global
permission for specific admin groups and roles to allow limited-access users to add blank AAAA records. For more
information, see Administrative Permissions for Adding Blank A or AAAA Records on page 245.

Adding AAAA Records

To create an AAAA record:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Record -> Add AAAA
Record.
2. In the Add AAAA Record wizard, complete the following:
— Name: If Grid Manager displays a zone name, enter the hostname that you want to map to an IP address.
The displayed zone name can either be the last selected zone or the zone from which you are adding the
AAAA record. If no zone name is displayed or if you want to specify a different zone, click Select Zone. When
there are multiple zones, Grid Manager displays the Zone Selector dialog box. Click a zone name in the
dialog box, and then enter the hostname. The name you enter is prefixed to the DNS zone name that is
displayed, and the complete name becomes the FQDN (fully qualified domain name) of the host. For
example, if the zone name displayed is corp100.com and you enter admin, then the FQDN becomes
admin.corp100.com.
— DNS View: Displays the DNS view to which the selected DNS zone belongs.
— Shared Record Group: This field appears only when you are creating a shared record. Click Select Shared
Record Group. If you have only one shared record group, the appliance displays the name of the shared
record group here. If you have multiple shared record groups, select the shared record group in the Shared
Record Group Selector dialog box. You can use filters or the Go to function to narrow down the list.
— Hostname Policy: Displays the hostname policy of the zone.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 883

DNS Resource Records

— IP Address: Enter the IPv6 address to which you want the domain name to map. When you enter an IPv6
address, you can use double colons to compress a contiguous sequence of zeros. You can also omit any
leading zeros in a four-hexadecimal group. For example, the complete IPv6 address
2006:0000:0000:0123:4567:89ab:0000:cdef can be shortened to 2006::123:4567:89ab:0:cdef. Note
that if there are multiple noncontiguous groups of zeros, the double colon can only be used for one group to
avoid ambiguity. The NIOS appliance displays an IPv6 address in its shortened form, regardless of its form
when it was entered.
— Comment: Optionally, enter additional information about this record.
— Create associated PTR record: Select this option to automatically generate a PTR record that maps the
specified IP address to the hostname. To create the PTR record, the reverse-mapping zone must be in the
database.
— Disable: Clear the check box to enable the record. Select the check box to disable it.
3. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
4. Save the configuration and click Restart if it appears at the top of the screen.

Modifying AAAA Records

When you modify an AAAA record, you can do the following:
• In the General tab, you can change the information you previously entered through the wizard.
• In the Discovered Data tab, you can view discovered data, if any, for the record. For information, see Viewing
Discovered Data on page 642.
You can also enter or edit information in the TTL, Extensible Attributes and Permissions tabs. For information on
modifying and deleting resource records, see Modifying, Disabling, and Deleting Host and Resource Records on page
899.

Managing PTR Records

In a reverse-mapping zone, a PTR (pointer) record maps an IP address to a hostname. Before adding a PTR record to
a reverse-mapping zone, you must first create the zone. You can also add PTR records to forward-mapping zones to
support zeroconf (zero configuration networking), such as wide-area Bonjour. For information about the Bonjour
protocol, refer to http://www.apple.com/support/bonjour. Though adding PTR records to forward-mapping zones
supports some of the use cases in RFC 1101, it does not support the network name mapping use case described in
the RFC. For more information, refer to http://tools.ietf.org/html/rfc1101.

Note: If a PTR record with the domain name in its native characters is added to the Infoblox Grid through DDNS
updates, the Name and Domain Name fields display the record name in UTF-8 encoded format. For example,
a PTR record with the domain name 工作站 .test.com added through DDNS updates displays
\229\183\165\228\189\156\231\171\153.test.com in the Name and Domain Name fields.

Adding PTR Records

To add a PTR record:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Record -> Add PTR
Record.
2. In the Add PTR Record wizard, do the following:
— Name or IP Address: From the drop-down list, select Name or IP Address. When you select Name, click
Select Zone to select a zone, and then enter the host name for the PTR record. Note that when you launch
this wizard from the IPAM tab, you can only select a reverse-mapping zone. When you launch this from a
reverse-mapping zone, the IP address field is populated with the prefix that corresponds to the selected
zone. When you launch this from a forward-mapping zone, you can only specify the host name, not an IP
address.
When you select IP Address, enter the IPv4 or IPv6 address that you want to map to the domain name.

884 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

— DNS View: If you entered an IP address, you must select the DNS view of the PTR record. If you entered a
name, this field displays the DNS view of the selected zone.
— Domain Name: Enter the domain name to which you want the PTR record to point. For example, you can
enter corp100.com.
— Comment: Optionally, enter information about the PTR record.
— Disable: Select this check box to disable the record. Clear the check box to enable it.
3. Save the configuration, or click Next to define extensible attributes. For information, see Using Extensible
Attributes on page 427.
4. Click Restart if it appears at the top of the screen.
To schedule this task, click the Schedule icon at the top of the wizard. In the Schedule Change panel, click Later, and
then specify a date, time, and time zone.

Note: When you add a PTR record to a forward-mapping zone, a message may appear on the top of the wizard if a
Grid member is configured to ignore DNS queries for PTR records in forward-mapping zones. Contact Infoblox
Technical Support for more information about this message.

Modifying PTR Records

Do the following to modify a PTR record:
• In the General tab, you can change the information you previously entered through the wizard. Note that you
cannot change an IPv4 address to an IPv6 address or move a PTR record from a forward-mapping zone to a
reverse-mapping zone and vice versa. When you modify a PTR record that belongs to a forward-mapping zone,
you can only modify the name since there is no IP address for such record. For information, see Adding PTR
Records on page 884.
• In the Discovered Data tab, you can view discovered data, if any, for the record. For information, see Viewing
Discovered Data on page 642.
You can also enter or edit information in the TTL, Extensible Attributes and Permissions tabs. For information on
modifying and deleting resource records, see Modifying, Disabling, and Deleting Host and Resource Records on page
899.

Managing MX Records
An MX (mail exchanger) record maps a domain name to a mail exchanger. A mail exchanger is a server that either
delivers or forwards mail. You can specify one or more mail exchangers for a zone, as well as the preference for using
each mail exchanger. A standard MX record applies to a particular domain or subdomain.
You can use a wildcard MX record to forward mail to one mail exchanger. For example, you can use a wildcard MX
record in the corp100.com domain to forward mail for eng.corp100.com and sales.corp100.com to the same mail
exchange, as long as the domain names do not have any matching resource record. Wildcards only apply when the
domain name being queried does not match any record.

Note: If an MX record with the domain name in its native characters is added to the Infoblox Grid through DDNS
updates, the Mail Destination and Mail Exchanger fields display the record name in UTF-8 encoded format. For
example, an MX record with the domain name 工作站 .test.com added through DDNS updates displays
\229\183\165\228\189\156\231\171\153.test.com in the Mail Destination and Mail Exchanger fields.

See Figure 20.1.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 885

DNS Resource Records

Figure 20.1 MX Records

The following MX records … … direct queries for one or more domains … … to the same mail exchanger:

An MX record for the mail exchanger that answers queries for

just the corp100.com domain (and its corresponding A
record): Domain
corp100.com Mail Exchanger
corp100.com IN MX 0 mail1.corp100.com mail1.corp100.com
mail1.corp100.com IN A 10.2.2.10 10.2.2.10

An MX record for just site1.corp100.com, a subdomain of

Subdomain
corp100.com:
site1.corp100.com
site1.corp100.com IN MX 0
mail1.corp100.com

A wildcard MX record for the corp100.com domain:

*.corp100.com IN MX 0 mail1.corp100.com

Note: You must also create an A record for the host defined as a mail exchanger in an MX record.

Adding MX Records
To add an MX record from the Tasks Dashboard, see Add MX Record on page 128. You can also add MX records from
the Data Management tab -> DNS tab by clicking Add -> Record -> Add MX Record from the Toolbar.

Modifying and Deleting MX Records

When you modify an MX record, you can change the information you previously entered in the General tab. You can
also enter or edit information in the TTL, Extensible Attributes and Permissions tabs. For information on modifying
and deleting resource records, see Modifying, Disabling, and Deleting Host and Resource Records on page 899.

Managing SRV Records

An SRV (service location) record directs queries to hosts that provide specific services. For example, if you have an
FTP server, then you might create an SRV record that specifies the host which provides the service. You can specify
more than one SRV record for a host. For more information about SRV records, see RFC 2052, A DNS RR for specifying
the location of services (DNS SRV) .

Note: If an SRV record with the domain name in its native characters is added to the Infoblox Grid through DDNS
updates, the Name and SRV Target fields display the domain name in UTF-8 encoded format. For example, an
SRV record with the domain name 电脑 .test.com added through DDNS updates displays
\231\148\181\232\132\145.test.com in the Name and SRV Target fields.

Adding SRV Records

1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Record -> Add SRV
Record.
2. In the Add SRV Record wizard, complete the following fields:
— Display input as: Select the format in which you want the SRV record to be displayed. When you select RFC
2782 format, the appliance follows the _service._protocol.name format as defined in RFC 2782. When you
select Free format, enter the entire name in the Domain field.

886 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

— Service: Specify the service that the host provides. You can either select a service from the list or type in a
service, if it is not on the list. For example, if you are creating a record for a host that provides FTP service,
select _ftp. To distinguish the service name labels from the domain name, the service name is prefixed with
an underscore. If the name of the service is defined at
http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml, use
that name. Otherwise, you can use a locally-defined name.
— Protocol: Specify the protocol that the host uses. You can either select a protocol from the list or type in a
protocol, if it is not on the list. For example, if it uses TCP, select _tcp. To distinguish the protocol name
labels from the domain name, the protocol name is prefixed with an underscore.
— Domain: If Grid Manager displays a zone name, enter the name here to define an SRV record for a host or
subdomain. The displayed zone name can either be the last selected zone or the zone from which you are
adding the SRV record. If no zone name is displayed or if you want to specify a different zone, click Select
Zone. When there are multiple zones, Grid Manager displays the Zone Selector dialog box. Click a zone
name in the dialog box, and then enter the name to define the SRV record. The NIOS appliance prefixes the
name you enter to the domain name of the selected zone. For example, if you want to create an SRV record
for a web server whose host name is www2.corp100.com and you define the SRV record in the
corp100.com zone, enter www2 in this field. To define an SRV record for a domain whose name matches the
selected zone, leave this field blank. The NIOS appliance automatically adds the domain name (the same
as the zone name) to the SRV record. For example, if you want to create an SRV record for the corp100.com
domain and you selected the corp100.com zone, leave this field blank.
— Preview: After you have entered all the information, this field displays the FQDN, which is the concatenation
of the Service, Protocol, and Domain fields.
— Shared Record Group: This field appears only when you are creating a shared record. Click Select Shared
Record Group. If you have only one shared record group, the appliance displays the name of the shared
record group here. If you have multiple shared record groups, select the shared record group in the Shared
Record Group Selector dialog box. You can use filters or the Go to function to narrow down the list.
— Priority: Select or enter an integer from 0 to 65535. The priority determines the order in which a client
attempts to contact the target host; the domain name host with the lowest number has the highest priority
and is queried first. Target hosts with the same priority are attempted in the order defined in the Weight
field.
— Weight: Select or enter an integer from 0 to 65535. The weight allows you to distribute the load between
target hosts. The higher the number, the more that host handles the load (compared to other target hosts).
Larger weights give a target host a proportionately higher probability of being selected.
— Port: Specify the appropriate port number for the service running on the target host. You can use standard
or nonstandard port numbers, depending on the requirements of your network. You can select a port
number from the list or enter an integer from 0 to 65535.
— Target: Enter the canonical domain name of the host (not an alias); for example, www2.corp100.com

Note: In addition, you need to define an A record mapping the canonical name of the host to its IP address.

— Comment: Enter a descriptive comment for the record.

— Disable: Clear the check box to enable the record. Select the check box to disable it.
3. Save the configuration, or click Next to define extensible attributes. For information, see Using Extensible
Attributes on page 427.
4. Click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 887

DNS Resource Records

Modifying and Deleting SRV Records

Do the following to modify an SRV record:
• In the General tab, the Display input as field displays the format in which the SRV record was configured. For
RFC 2782 format, the appliance matches the _service._protocol.name format and displays the corresponding
information in the Service and Protocol fields. If the appliance cannot match the service and protocol, it
displays the entire name in the Domain field. For Free format, the entire name is displayed in the Domain field.
For more information about the other fields, see Adding SRV Records on page 886.

Note: The appliance does not match the service and protocol names to exactly how they appear in the drop-down
lists. It only checks whether the first two parts of the names start with an underscore. If the first two parts do
not start with an underscore, the appliance assumes it is a free format. For example, _abc._xyz.name is
considered as RFC 2782 format even though _abc is not in the Service drop-down list, and _xyz is not in the
Protocol drop-down list. Grid Manger displays _abc in the Service field and _xyz in the Protocol field. On the
other hand, “abc.xyz.name” is considered as a free format because the first two parts do not start with
underscores, and Grid Manager displays this in its entirety in the Domain field.

You can also enter or edit information in the TTL, Extensible Attributes and Permissions tabs. For information on
modifying and deleting resource records, see Modifying, Disabling, and Deleting Host and Resource Records on page
899.

Managing TXT Records

A TXT (text record) record contains supplemental information for a host. For example, if you have a sales server that
serves only North America, you can create a text record stating this fact. You can create more than one text record for
a domain name.

Note: If a TXT record with the domain name in its native characters is added to the Infoblox Grid through DDNS
updates, the Name field displays the domain name in UTF-8 encoded format. For example, a TXT record with
the domain name 电脑 .test.com added through DDNS updates displays
\231\148\181\232\132\145.test.com in the Name field.

Using TXT Records for SPF

SPF (Sender Policy Framework) is an anti-forgery mechanism designed to identify spam e-mail. SPF fights e-mail
address forgery and makes it easier to identify spam, worms, and viruses. Domain owners identify sending mail
servers in DNS. SMTP receivers verify the envelope sender address against this information, and can distinguish
legitimate mail from spam before any message data is transmitted.
SPF makes it easy for a domain to say, “I only send mail from these machines. If any other machine claims that I'm
sending mail from there, they're not valid.” For example, when an AOL user sends mail to you, an email server that
belongs to AOL connects to an email server that belongs to you. AOL uses SPF to publish the addresses of its email
servers. When the message comes in, your email servers can tell if the server that sent the email belongs to AOL or
not.
You can use TXT records to store SPF data that identifies what machines send mail from a domain. You can think of
these specialized TXT records as reverse MX records that e-mail servers can use to verify if a machine is a legitimate
sender of an e-mail.

SPF Record Examples

corp100.com. IN TXT “v=spf1 mx –all”
corp100.net. IN TXT “v=spf1 a:mail.corp100.com –all”
corp100.net. IN TXT “v=spf1 include:corp100.com -all”
corp100.net. IN TXT “v=spf1 mx -all exp=getlost.corp100.com”
corp100.com. IN TXT “v=spf1 include:corp200.com -all”

888 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

Adding TXT Records

To add an TXT record from the Tasks Dashboard, see Add TXT Record on page 127. You can also add TXT records from
the Data Management tab -> DNS tab by clicking Add -> Record -> Add TXT Record from the Toolbar.

Modifying and Deleting TXT Records

When you modify a TXT record, you can change the information you previously entered in the General tab. You can
also enter or edit information in the TTL, Extensible Attributes and Permissions tabs. For information on modifying
and deleting resource records, see Modifying, Disabling, and Deleting Host and Resource Records on page 899.

Managing CNAME Records

A CNAME record maps an alias to a canonical name. You can use CNAME records in both forward- and IPv4
reverse-mapping zones to serve two different purposes. (At this time, you cannot use CNAME records with IPv6
reverse-mapping zones.)

Note: If a CNAME record with the domain name in its native characters is added to the Infoblox Grid through DDNS
updates, the Alias and Canonical Name fields display the domain name in UTF-8 encoded format. For example,
a CNAME record with the domain name 电脑 .test.com added through DDNS updates displays
\231\148\181\232\132\145.test.com in the Canonical Name and Alias fields.

CNAME Records in Forward-Mapping Zones

In a forward-mapping zone, a CNAME record maps an alias to a canonical (or official) name. CNAME records are often
more convenient to use than canonical names because they can be shorter or more descriptive. For example, you can
add a CNAME record that maps the alias qa.engr to the canonical name qa.engr.corp100.com.

Note: A CNAME record does not have to be in the same zone as the canonical name to which it maps. In addition, a
CNAME record cannot have the same name as any other record in that zone.

To add a CNAME record to a forward-mapping zone from the Tasks Dashboard, see Add CNAME Record on page 126.
You can also add CNAME records from the Data Management tab -> DNS tab by clicking Add -> Record -> Add CNAME
Record from the Toolbar.

CNAME Records in IPv4 Reverse-Mapping Zones

You can add CNAME records to an IPv4 reverse-mapping zone to create aliases to addresses maintained by a different
name server when the reverse-mapping zone on the server is a delegated child zone with fewer than 256 addresses.
This technique allows you to delegate responsibility for a reverse-mapping zone with an address space of fewer than
256 addresses to another authoritative name server. See Figure 20.2 and RFC 2317, Classless IN-ADDR.ARPA
delegation .

NIOS 7.3 NIOS Administrator Guide (Rev. A) 889

DNS Resource Records

Figure 20.2 CNAME Records in a Reverse-Mapping Zone

Local DNS Server

Customer1 Customer2
DNS Server DNS Server

Parent Zone
“10.1.1.0/24”
Delegated Child Zone Delegated Child Zone
“10.1.1.0/25” “10.1.1.128/25”

CNAME
PTR PTR
CNAME

All the PTR records for CNAME Records for Customer1 The PTR records for
Customer1 use the Customer2 also use the
addresses defined as ALIAS CANONICAL NAME addresses defined as
canonical names in the 1.1.1.10.in-addr.arpa 1.0/127.1.1.10.in-addr.arpa canonical names in the
CNAME records on the CNAME records on the
local DNS server. 2.1.1.10.in-addr.arpa 2.0/127.1.1.10.in-addr.arpa local DNS server.
Sample PTR records: ... ...
IP Address: 126.1.1.10.in-addr.arpa 126.0/127.1.1.10.in-addr.arpa
1.0/127.1.1.10.in-addr.arpa
Host Name: CNAME Records for Customer2
host1.customer1.com
ALIAS CANONICAL NAME
IP Address:
2.0/127.1.1.10.in-addr.arpa 129.1.1.10.in-addr.arpa 129.128/255.1.1.10.in-addr.arpa
Host Name: 130.1.1.10.in-addr.arpa 130.128/255.1.1.10.in-addr.arpa
host2.customer1.com
... ...
...
254.1.1.10.in-addr.arpa 254.128/255.1.1.10.in-addr.arpa

You add CNAME records in the parent zone on your name server. The aliases defined in those CNAME records point
to the addresses in PTR records in the child zone delegated to the other server.
When you define a reverse-mapping zone that has a netmask from /25 (255.255.255.128) to /31
(255.255.255.254), you must include an RFC 2317 prefix. This prefix can be anything, from the address range
(examples: 0-127, 0/127) to descriptions (examples: first-network, customer1). On a NIOS appliance, creating such
a reverse-mapping zone automatically generates all the necessary CNAME records. However, if you need to add them
manually to a parent zone that has a child zone with fewer than 255 addresses.

Adding CNAME Records

To add a CNAME record to a forward-mapping or reverse-mapping zone from the Tasks Dashboard, see Add CNAME
Record on page 126. You can also add CNAME records from the Data Management tab -> DNS tab by clicking Add ->
Record -> Add CNAME Record from the Toolbar.

Modifying and Deleting CNAME Records

When you modify a CNAME record, you can change the information you previously entered in the General tab. You can
also enter or edit information in the TTL, Extensible Attributes and Permissions tabs. For information on modifying
and deleting resource records, see Modifying, Disabling, and Deleting Host and Resource Records on page 899.

890 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

Managing DNAME Records

A DNAME record maps all the names in one domain to those in another domain, essentially substituting one domain
name suffix with the other (see RFC 2672, Non-Terminal DNS Name Redirection). For example, adding a DNAME record
to the corp100.com domain mapping “corp100.com” to “corp200.com” maps name-x.corp100.com to
name-x.corp200.com:

Domain Name Target Domain Name

server1.corp100.com —> server1.corp200.com
server2.corp100.com —> server2.corp200.com
server3.corp100.com —> server3.corp200.com
. . . .corp100.com —> . . . .corp200.com

Note: If a DNAME record with the domain name in its native characters is added to the Infoblox Grid through DDNS
updates, the Alias and Target fields display the domain name in UTF-8 encoded format. For example, a DNAME
record with the domain name 电脑 .test.com added through DDNS updates displays
\231\148\181\232\132\145.test.com in the Alias and Target fields.

When a request arrives for a domain name to which a DNAME record applies, the NIOS appliance responds with a
CNAME record that it dynamically creates based on the DNAME definition. For example, if there is a DNAME record
corp100.com. DNAME corp200.com.
and a request arrives for server1.corp100.com, the NIOS appliance responds with the following CNAME record:
server1.corp100.com. CNAME server1.corp200.com.
If responding to a name server running BIND 9.0.0 or later, the NIOS appliance also includes the DNAME record in its
response, so that name server can also create its own CNAME records based on the cached DNAME definition.
The following are two common scenarios for using DNAME records:
• One company buys another and wants people using both the old and new name spaces to reach the same
hosts.
• A virtual Web hosting operation offers different “vanity” domain names that point to the same server or servers.
There are some restrictions that apply to the use of DNAME records:
• You cannot have a CNAME record and a DNAME record for the same subdomain.
• You cannot use a DNAME record for a domain or subdomain that contains any subdomains. You can only map
the lowest level subdomains (those that do not have any subdomains below them). For an example of using
DNAME records in a multi-tiered domain structure, see Figure 20.3 on page 892.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 891

DNS Resource Records

Figure 20.3 Adding DNAME Records for the Lowest Level Subdomains
Corp200 buys Corp100 and wants to redirect queries for
corp100.com to corp200.com; however, the multitiered corp200.com
structure of corp100.com prohibits a complete mapping
of all its subdomains. In such a case, DNAME records
provide only a partial solution.
corp100.com

dev.corp100.com mktg.corp100.com dev100.corp200.com

DNAME Record art.mktg.corp100.com art.mktg100.corp200.com

Domain Name:
dev.corp100.com
Target Domain:
dev100.corp200.com

DNAME Record
Domain Name:
art.mktg.corp100.com
Target Domain:
art.mktg100.corp200.com

In the case of a domain structure consisting of a single domain (no subdomains), adding a DNAME record redirects
queries for every name in the domain to the target domain, as shown in Figure 20.4.

Figure 20.4 Adding a DNAME Record for a Single Domain

Corp200 buys Corp100 and wants to redirect

all queries for corp100.com to corp200.com. corp200.com
To accomplish this, you add a single DNAME
record to corp100.com.

corp100.com corp100.corp200.com

www1.corp100.com mail1.corp100.com www1.corp100.corp200.com mail1.corp100.corp200.com

www2.corp100.com ftp1.corp100.com www2.corp100.corp200.com ftp1.corp100.corp200.com
DNAME Record
Domain Name:
corp100.com
Target Domain:
corp100.corp200.com

When using a DNAME record, you must copy the resource records for the source domain to the zone containing the
target domain, so that the DNS server providing service for the target domain can respond to the redirected queries.
For the example in Figure 20.4, copy these records:

Copy from corp100.com to corp100.corp200.com

www1 IN A 10.1.1.10 www1 IN A 10.1.1.10
www2 IN A 10.1.1.11 www2 IN A 10.1.1.11
ftp1 IN A 10.1.1.20 ftp1 IN A 10.1.1.20
mail1 IN A 10.1.1.30 mail1 IN A 10.1.1.30

After copying these records to the zone containing the corp100.corp200.com domain, delete them from the zone
containing the corp100.com domain.

892 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

If DNS service for the source and target domain names is on different name servers, you can import the zone data
from the NIOS appliance hosting the source domain to the appliance hosting the target domain. For information
about this procedure, see Importing Zone Data on page 849.
If DNS service for the source and target domain names is on the same name server and the parent for the target
domain is on a different server, you can delegate DNS services for the target domain name to the name server that
provided—and continues to provide—DNS service for the source domain name (see Figure 20.5 on page 893). By
doing this, you can continue to maintain resource records on the same server, potentially simplifying the
continuation of DNS administration.

Figure 20.5 Making the Target Zone a Delegated Zone

On the primary name server for corp200.com

(ns1.corp200.com), specify “corp100.corp200.com” as a
delegated zone and specify “ns1.corp100.com” as the
name server for that zone.
ns1.corp100.com
Primary name server for corp100.com
and authoritative name server for ns1.corp200.com corp200.com
corp100.corp200.com Primary name server
for corp200.com

corp100.com corp100.corp200.com

www1.corp100.corp200.com mail1.corp100.corp200.com
www2.corp100.corp200.com ftp1.corp100.corp200.com
Resource Records Resource Records
corp100.com IN SOA ns1.corp100.com corp100.corp200.com IN SOA ns1.corp200.com
IN NS ns1.corp100.com IN NS ns1.corp200.com
IN NS ns2.corp100.com IN NS ns2.corp200.com
corp100.com IN DNAME corp100.corp200.com www1 IN A 10.1.1.10
www2 IN A 10.1.1.11
ftp1 IN A 10.1.1.20
mail1 IN A 10.1.1.30

Note: This is a conceptual representation of domain name mapping and

depicts the resulting hierarchical relationship of corp200.com as the parent
zone for corp100.corp200.com. The hosts are not physically relocated.

The following tasks walk you through configuring the two appliances in Figure 20.5 to redirect queries for
corp100.com to corp100.corp200.com using a DNAME record:
On the ns1.corp100.com name server, do the following:
1. Create a new forward-mapping zone called corp100.corp200.com. See Creating an Authoritative
Forward-Mapping Zone on page 830.
2. Copy all the resource records for the domain or subdomain to which the DNAME record is going to apply from
corp100.com to corp100.corp200.com.

Note: Because you can only specify the records by type, not individually, you might have to copy some records
that you do not want and then delete them from the corp100.corp200.com zone.

3. In the corp100.com zone, delete all the resource records for the domain or subdomain to which the DNAME
record is going to apply.
4. Add a DNAME record to the corp100.com zone specifying “corp100.com” as the domain and
“corp100.corp200.com” as the target domain. Adding a DNAME record is explained in the next section.
5. On the ns1.corp200.com name server, add corp100.corp200.com as a delegated zone and specify
ns1.corp100.com as the name server for it. See Configuring a Delegation on page 857.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 893

DNS Resource Records

DNAME Records for Forward-Mapping Zones

To add a DNAME record to a forward-mapping zone:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Record -> Add DNAME
Record.
2. In the Add DNAME Record wizard, complete the following fields:

Note: If you specify a subdomain in the Domain Name field when configuring a DNAME record and the
subdomain is also a subzone, the DNAME record appears in the list view for the subzone, not in the list
view for the parent zone selected in the process of adding the record.

— Alias: If Grid Manager displays a zone name, enter the name of a subdomain here. If you are adding a
DNAME record for the entire zone, leave this field empty. This field is for adding a DNAME record for a
subdomain within the selected zone. The displayed zone name can either be the last selected zone or the
zone from which you are adding the CNAME record. If no zone name is displayed or if you want to specify a
different zone, click Select Zone. When there are multiple zones, Grid Manager displays the Zone Selector
dialog box. Click a zone name in the dialog box, and then enter the name of a subdomain.
— Target: Enter the domain name to which you want to map all the domain names specified in the Alias field.
— Comment: Enter identifying text for this record, such as a meaningful note or reminder.
— Disable: Clear the check box to enable the record. Select the check box to disable it.
3. Save the configuration, or click Next to define extensible attributes. For information, see Using Extensible
Attributes on page 427.
4. Click Restart if it appears at the top of the screen.

DNAME Records for Reverse-Mapping Zones

You can use DNAME records to redirect reverse lookups from one reverse-mapping zone to another. You can use
DNAME records for reverse-mapping zones to simplify the management of subzones for classless address spaces
larger than a class C subnet (a subnet with a 24-bit netmask).
RFC 2672, Non-Terminal DNS Name Redirection, includes an example showing the delegation of a subzone for an
address space with a 22-bit netmask inside a zone for a larger space with a 16-bit netmask:
$ORIGIN 0.192.in-addr.arpa.
8/22 NS ns.slash-22-holder.example.
8 DNAME 8.8/22
9 DNAME 9.8/22
10 DNAME 10.8/22
11 DNAME 11.8/22
The reverse-mapping zone 0.192.in-addr.arpa. applies to the address space 192.0.0.0/16. Within this zone is a
subzone and subdomain with the abbreviated name 8/22. (Its full name is 8/22.0.192.in-addr.arpa.) This
subdomain contains its own subdomains corresponding to the 1024 addresses in the 192.0.8.0/22 subnet:
• Subdomain 8/22 (8/22.0.192.in-addr.arpa)
— Subdomain 8.8/22 for addresses 192.0.8.0 – 192.0.8.255 (or 192.0.8.0/24)
— Subdomain 9.8/22 for addresses 192.0.9.0 – 192.0.9.255 (or 192.0.9.0/24)
— Subdomain 10.8/22 for addresses 192.0.10.0 – 192.0.10.255 (or 192.0.10.0/24)
— Subdomain 11.8/22 for addresses 192.0.11.0 – 192.0.11.255 (or 192.0.11.0/24)
The NS record delegates authority for the reverse-mapping subzone 8/22 to the DNS server
ns.slash-22-holder.example.
Finally, the DNAME records provide aliases mapping domain names that correspond to the 192.0.8.0/24,
192.0.9.0/24, 192.0.10.0/24, and 192.0.11.0/24 subnets to the respective subdomains 8.8/22, 9.8/22, 10.8/22,
and 11.8/22 in the 8/22.0.192.in-addr.arpa subzone.

894 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

Note: NIOS appliances support DNAME records in reverse-mapping zones that map addresses to target zones with
a classless address space larger than a class C subnet. However, NIOS appliances do not support such target
zones.

You might also use DNAME records if you have a number of multihomed appliances whose IP addresses must be
mapped to a single set of domain names. An example of this is shown in Figure 20.6.

Figure 20.6 DNAME Records to Simplify DNS for Multihomed Appliances

Instead of maintaining a PTR record for the IP address of All PTR records
each interface on every multihomed appliance, you can are here.
store all the PTR records in one reverse-mapping zone
and use DNAME records in the other zones to point
Resource Records
reverse lookups to the one set of PTR records. 3.1.10.in-addr.arpa IN NS ns1.corp100.com
3.1.10.in-addr.arpa IN NS ns2.corp100.com
1 IN PTR www1.corp100.com
Resource Records 2 IN PTR www2.corp100.com
1.1.10.in-addr.arpa IN NS ns1.corp100.com 3 IN PTR ftp1.corp100.com
1.1.10.in-addr.arpa IN NS ns2.corp100.com Multihomed 4 IN PTR stor1.corp100.com
1.1.10.in-addr.arpa IN DNAME 3.1.10.in-addr.arpa Appliances

1
1.1.10.in-addr.arpa. 3.1.10.in-addr.arpa.

2
All DNAME
Reverse-Mapping Reverse-Mapping
records are
Zones Zones
here.
3
2.1.10.in-addr.arpa. 4.1.10.in-addr.arpa.

Resource Records . Resource Records

2.1.10.in-addr.arpa
2.1.10.in-addr.arpa
IN
IN
NS
NS
ns1.corp100.com
ns2.corp100.com . 4.1.1.10.in-addr.arpa
4.1.1.10.in-addr.arpa
IN NS
IN NS
ns1.corp100.com
ns2.corp100.com
2.1.10.in-addr.arpa IN DNAME 3.1.10.in-addr.arpa . 4.1.10.in-addr.arpa IN DNAME 3.1.10.in-addr.arpa

Note: If you specify a subdomain in the Domain Name field when configuring a DNAME record, and the subdomain
is also a subzone, the DNAME record appears in the list view for the subzone, not in the list view for the parent
zone that was selected when adding it.

To add a DNAME record to a reverse-mapping zone:

1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Record -> Add DNAME
Record.
2. In the Add DNAME Record wizard, complete the following fields:

Note: If you specify a subdomain in the Domain Name field when configuring a DNAME record and the
subdomain is also a subzone, the DNAME record appears in the list view for the subzone, not in the list
view for the parent zone selected in the process of adding the record.

— Alias: If Grid Manager displays a zone name, enter the name of a subdomain here. If you are adding a
DNAME record for the entire zone, leave this field empty. This field is for adding a DNAME record for a
subdomain within the selected zone. The displayed zone name can either be the last selected zone or the
zone from which you are adding the CNAME record. If no zone name is displayed or if you want to specify a
different zone, click Select Zone. When there are multiple zones, Grid Manager displays the Zone Selector
dialog box. Click a zone name in the dialog box, and then enter the name of a subdomain.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 895

DNS Resource Records

— Target: Type the name of the reverse-mapping zone to which you want to map all the addresses specified in
the Domain Name field.
— Comments: Enter identifying text for this record, such as a meaningful note or reminder.
— Disable: Clear the check box to enable the record. Select the check box to disable it.
3. Save the configuration, or click Next to define extensible attributes. For information, see Using Extensible
Attributes on page 427.
4. Click Restart if it appears at the top of the screen.

Modifying and Deleting DNAME Records

When you modify a CNAME record, you can change the information you previously entered in the General tab. You can
also enter or edit information in the TTL, Extensible Attributes and Permissions tabs. For information on modifying
and deleting resource records, see Modifying, Disabling, and Deleting Host and Resource Records on page 899.

Managing NAPTR Records

A NAPTR (Name Authority Pointer) record specifies a rule that uses a substitution expression to rewrite a string into a
domain name or URI (Uniform Resource Identifier). A URI is either a URL (Uniform Resource Locator) or URN (Uniform
Resource Name) that identifies a resource on the Internet.
NAPTR records are usually used to map E.164 numbers to URIs or IP addresses. An E.164 number is a telephone
number, 1-555-123- 4567 for example, in a format that begins with a country code, followed by a national
destination code and a subscriber number. (E.164 is an international telephone numbering system recommended by
the International Telecommunication Union.) Thus, NAPTR records allow us to use telephone numbers to reach
devices, such as fax machines and VoIP phones, on the Internet.
To map an E.164 to a URI, the E.164 number must first be transformed into a domain name. ENUM (E.164 Number
Mapping) specifies a method for converting E.164 numbers to domain names. For example, using the method
specified by ENUM, the telephone number 1-555-123-4567 becomes the domain name
7.6.5.4.3.2.1.5.5.5.1.e164.arpa. For details about ENUM, refer to RFC 3761, The E.164 to Uniform Resource
Identifiers (URI) Dynamic Delegation Discovery System (DDDS) Application (ENUM).
After the E.164 number is converted to a domain name, a DNS client can then perform a DNS lookup for the NAPTR
records of the domain name. The following example illustrates how a DNS client processes NAPTR records.
In this example, the telephone number 1-555-123-4567 is converted to the domain name
7.6.5.4.3.2.1.5.5.5.1.e164.arpa. The DNS client then sends a query to the Infoblox DNS server for the NAPTR records
associated with 7.6.5.4.3.2.1.5.5.5.1.e164.arpa. The Infoblox DNS server returns the following NAPTR record:
$ORIGIN 7.6.5.4.3.2.1.5.5.5.1.e164.arpa
IN NAPTR 10 100 "U" "sip + E2U" "!^.*$!sip:[email protected]!" .

Order
Preference
Flag Service Regular Expression Replacement

The DNS client then examines the fields in the NAPTR record as follows:
• If a DNS client receives multiple NAPTR records for a domain name, the value in the Order field determines
which record is processed first. It processes the record with the lowest value first.
• The DNS client uses the Preference value when the Order values are the same. Similar to the Preference field in
MX records, this value indicates which NAPTR record the DNS client should process first when the records have
the same Order value. It processes the record with the lowest value first.
In the example, the DNS client ignores the Order and Preference values because it received only one NAPTR
record.

896 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

• The Flag field indicates whether the current lookup is terminal; that is, the current NAPTR record is the last
NAPTR record for the lookup. It also provides information about the next step in the lookup process. The flags
that are currently used are:
U: Indicates that the output maps to a URI (Uniform Record Identifier).
S: Indicates that the output is a domain name that has at least one SRV record. The DNS client must then
send a query for the SRV record of the resulting domain name.
A: Indicates that the output is a domain name that has at least one A or AAAA record. The DNS client must
then send a query for the A or AAAA record of the resulting domain name.
P: Indicates that the protocol specified in the Service field defines the next step or phase.
If the Flag field is blank, this indicates that the client must use the resulting domain name to look up other
NAPTR records.
• The Service field specifies the service and protocol that are used to communicate with the host at the domain
name. In the example, the service field specifies that SIP (Session Initiation Protocol) is used to contact the
telephone service.
• The regular expression specifies the substitution expression that is applied to the original string of the client. In
the example, the regular expression !^.*$!sip:[email protected]! specifies that the domain name
7.6.5.4.3.2.1.5.5.5.1.e164.arpa is replaced with sip:[email protected].
The regular expression in a NAPTR record is always applied to the original string of the client. It must not be
applied to a domain name that resulted from a previous NAPTR rewrite.
• The Replacement field specifies the FQDN for the next lookup, if it was not specified in the regular expression.

Note: If a NAPTR record with the domain name in its native characters is added to the Infoblox Grid through DDNS
updates, the Domain and Replacement fields display the domain name in UTF-8 encoded format. For example,
a NAPTR record with the domain name 电脑 .test.com added through DDNS updates displays
\231\148\181\232\132\145.test.com in the Domain and Replacement fields.

Adding a NAPTR Record

To add a NAPTR record:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Add -> Record -> Add NAPTR
Record.
2. In the Add NAPTR Record wizard, complete the following fields:
— Domain: If Grid Manager displays a zone name, enter the domain name to which this resource record refers.
The displayed zone name can either be the last selected zone or the zone from which you are adding the
NAPTR record. If no zone name is displayed or if you want to specify a different zone, click Select Zone.
When there are multiple zones, Grid Manager displays the Zone Selector dialog box. Click a zone name in
the dialog box, and then enter a domain name for the record. The name you enter is prefixed to the DNS
zone name that is displayed, and the complete name becomes the FQDN (fully qualified domain name) of
the record. For example, if the zone name displayed is corp100.com and you enter admin, then the FQDN
becomes admin.corp100.com. This field is not displayed when you configure a NAPTR record for a DTC
server.
— DNS View: Displays the DNS view of the selected zone.
— Service: Specifies the service and protocol used to reach the domain name that results from applying the
regular expression or replacement. You can enter a service or select a service from the list.
— Flags: The flag indicates whether the resulting domain name is the endpoint URI or if it points to another
record. Select one of the following:
U: Indicates that the output maps to a URI.
S: Indicates that the resulting domain name has at least one SRV record.
A: Indicates that the resulting domain name has at least one A or AAAA record.
P: Indicates that this record contains information specific to another application.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 897

DNS Resource Records

Leave this blank to indicate that the DNS client must use the resulting domain name to look up other NAPTR
records. You can use the NAPTR records as a series of rules that are used to construct a URI or domain
name.
— Order: Select an Integer from 10 to 100, or enter a value from 0 to 65535. This value indicates the order in
which the NAPTR records must be processed. The record with the lowest value is processed first.
— Preference: Select an Integer from 10 to 100, or enter a value from 0 to 65535. Similar to the Preference
field in MX records, this value indicates which NAPTR record should be processed first when the records
have the same Order value. The record with the lowest value is processed first.
— REGEX: The regular expression that is used to rewrite the original string from the client into a domain name.
RFC 2915 specifies the syntax of the regular expression. Note that the appliance validates the regular
expression syntax between the first and second delimiter against the Python re module, which is not 100%
compatible with POSIX Extended Regular Expression as specified in the RFC. For information about the
Python re module, refer to http://docs.python.org/release/2.5.1/lib/module-re.html.
— Replacement: This specifies the domain name for the next lookup. The default is a dot (.), which indicates
that the regular expression in the REGEX field provides the replacement value. Alternatively, you can enter
the replacement value in FQDN format.
— Comment: Optionally, enter a descriptive comment for this record.
— Disable: Clear the check box to enable the record. Select the check box to disable it.
3. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427. This is
not applicable when you configure a NAPTR record for a DTC server.
4. Save the configuration and click Restart if it appears at the top of the screen.

Managing LBDN Records

When your Grid is integrated with GLBs (Global Load Balancers), you can add LBDNs (Load Balanced Domain Name)
record to authoritative or delegated zones. The Infoblox name server does not actually serve these LBDNs, but they
can be managed by the load balancer devices listed at the zone level. Note that you cannot add an LBDN if the zone
is DNSSEC signed.For information about how to add and modify LBDN records, see Managing F5 LBDNs on GLBs on
page 1549.

Viewing Resource Records

You can view the configured resource records by navigating to the Data Management tab -> DNS tab -> Zones tab ->
zone -> Records tab. Grid Manager displays the following information for each resource record in the zone:
• Name: The name of the record, if applicable. For host records, this field displays the canonical name of the host.
For PTR record, this displays the PTR record name without the zone name.
• Type: The resource record type.
• Data: Data that the record contains. For host records, this field displays the IP address of the host. For PTR
records, this displays the domain names.
• Active Users: The number of active users for the selected resource record.
• Comment: Comments that were entered for the resource record.
• Site: Values that were entered for this pre-defined attribute.
You can also display the following columns:
• MS Delegation Addresses: This column appears only if the primary server of the zone is a Microsoft server. It
displays the IP addresses that are associated with an NS record.
• TTL: The TTL (time-to-live) value of the record.
• Address: The IPv4 or IPv6 address associated with the owner domain name in a reverse-mapping zone.
• Shared: Displays true for shared resource records. Otherwise, displays false.
• Shared Record Group: Displays the shared record group name of a shared record.
• Disabled: Indicates if the record is disabled.

898 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Resource Records

You can do the following:

• Modify some of the data in the table. Double click a row, and either modify the data in the field or select an item
from a drop-down list. Click Save to save the changes. Note that some fields are read only.
• View Traffic Management Structure for an LBDN.
— Select the LBDN record, and then click the Open Topology icon. This is valid for DNS Traffic Control and F5
LBDN records. For more information, see Viewing Traffic Management Structures on page 1027 andViewing
Traffic Management Structures for GLB Objects on page 1545 respectively.
• Click the Action icon and select Show Active Users to view all the users who are currently using the selected
record. For information, see Viewing Active Network Users on page 615.
• Edit the properties of a resource record.
— Select the resource record, and then click the Edit icon.
• Delete a resource record.
— Select the resource record, and then click the Delete icon.
• Export the list of resource records to a .csv file.
— Click the Export icon.
• Print the list of resource records.
— Click the Print icon.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria:
1. In the filter section, click Show Filter and define filter criteria for the quick filter.
2. Click Save and complete the configuration In the Save Quick Filter dialog box.
The appliance adds the quick filter to the quick filter drop-down list in the panel. Note that global filters are
prefixed with [G], local filters with [L], and system filters with [S].

Modifying, Disabling, and Deleting Host and Resource Records

You can modify, disable, or delete an existing host or DNS resource record. When physical repair or relocation of a
network device occurs, you can disable a record instead of deleting it. When you disable a record, the NIOS appliance
does not answer queries for it, nor does it include disabled records in zone transfers and zone imports. This avoids
having to delete and then add the record again. When the changes to the physical device are complete, you can
simply enable the host or resource record.
To modify or disable a host or resource record:
1. Use one of the following methods to retrieve the host or resource record:
— Perform a global search.
— Select it from a Smart Folder.
— From the Data Management tab, select the DNS tab - > Zones tab -> dns_view -> zone -> host_record or
resource_record.
2. Select the record you want to modify and click the Modify icon.
3. In the host or resource record editor, you can do the following:
— In the General tab, you can change most of the information, except for the read-only fields, such as the DNS
View and Host Name Policy. You can select the Disable check box to disable the record.
— In the TTL tab, you can modify the TTL setting. The NIOS appliance also allows you to specify TTL settings for
each record. If you do not specify a TTL for a record, the appliance applies the default TTL value of the zone
to each record. For information, see About Time To Live Settings on page 753.
— In the Extensible Attributes tab, you can modify the attributes. For information, see Using Extensible
Attributes on page 427.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 899

DNS Resource Records

— The Permissions tab displays if you logged in as a superuser. For information, see About Administrative
Permissions on page 195.
4. Save the configuration and click Restart if it appears at the top of the screen.
When you delete host and resource records, Grid Manager moves them to the Recycle Bin. You can use the Recycle
Bin to store deleted DNS configuration objects and selectively restore objects to the active configuration at a later
time. You can also permanently remove the objects from the Recycle Bin.

Note: You cannot delete automatically-generated records, such as NS records and SOA records.

To delete host and resource record:

1. Perform a global search to retrieve the record you want to delete.
or
From the Data Management tab, select the DNS tab, click the Zones tab-> dns_view -> zone -> host_record or
resource_record.
2. Select the record and click the Delete icon.
3. In the Delete Confirmation dialog box displays, select Yes to delete or No to cancel.
4. Optionally, if the Enable PTR record removal for A/AAAA records option is selected and if you try to delete an A or
AAAA record, the appliance displays the Delete Confirmation (A or AAAA Record) dialog box to confirm whether
you want to remove the corresponding PTR record that was automatically generated while creating the A or AAAA
record. In the Delete Confirmation dialog box, select the Remove associated PTR resource record(s) check box
and click Yes to delete the associated PTR record or click No to cancel. For information about enabling this option,
see Deleting PTR Records associated with A or AAAA Records on page 762.
or
You can also schedule the deletion for a later time. Click Schedule Deletion and in the Schedule Change panel,
enter a date, time, and time zone. For information, see Scheduling Deletions on page 90.

About Shared Record Groups

A shared record group is a set of resource records that you can add to multiple zones. You can create resource records
in a group and share the group among multiple zones. The zones handle the shared resource records as any other
resource record. You can include the following types of DNS resource records in a shared record group: A, SRV, MX,
AAAA, CNAME, and TXT.
Using shared record groups simplifies and expedites the administration of resource records. When you create or
update a shared record, the appliance automatically updates it in all associated zones. In addition, shared resource
records reduce the object count in the NIOS database; instead of the creating the same record in multiple zones, you
can use only one shared record. For example, for 10 zones and 500 records per zone, the object count decreases from
5278 objects to 781 objects.
Figure 20.7 shows an example of how to create and use shared records.

900 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Shared Record Groups

In this example, there are two shared record groups. One group—group1— contains the A records ftp and printer1
and the MX record mx1, and the other group—group2—contains the A record web and the MX record mx2. The
resource records in group1 are shared with the internal view zones sales.corp100.com and finance.corp100.com and
the external view zone sales.corp100.com. The resource records in group2 are shared with the internal view zone
marketing.corp100.com and the external view zones sales.corp100.com and marketing.corp100.com.

Figure 20.7 Creating Shared Records

group1
sales.corp100.com
sales.corp100.com Internal
Each record is view
shared by printer1
several zones, mx1 finance.corp100.com
but stored as a
single database
ftp
object. External
sales.corp100.com view

group2
Internal
mx2 marketing.corp100.com view

web
External
marketing.corp100.com view

Shared Records Guidelines

The following are guidelines for using shared records:
• You can include multiple shared A, AAAA, CNAME, SRV, MX and TXT resource records in a group. You cannot
include NS, DNAME, PTR, host and bulk host records.
• You can add shared records to authoritative zones only. You cannot add shared records to forward zones, stub
zones, or reverse mapping zones.
• Zones that contain shared records can also contain regular DNS records (not shared).
• When you change or delete a shared resource record, it changes the canonical source of the shared record and
impacts all the zones that contain the record.
• You cannot copy shared records from a zone.
• You do not need to restart the appliance when you create, delete, or modify shared records.

Configuring Shared Record Groups

Before you can create shared resource records, you must first create the group to which they belong. The shared
record group serves as a container for the shared resource records. The following are the tasks to configure a shared
record group:
1. Create a shared record group and associate it with the appropriate zones. See Creating a Shared Record Group
on page 902.
2. Create shared A, CNAME, SRV, MX, AAAA, and TXT resource records, and add them into the shared record group.
See Managing Shared Resource Records on page 903.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 901

DNS Resource Records

Creating a Shared Record Group

When you create a shared record group, the only requirement is that you give it a name. You can associate it with one
or multiple zones when you first create the group or at a later time, by editing the shared record group. You can
associate a shared record group with authoritative zones only. Associating the shared record group with a zone adds
the shared records to the zone. The zone handles the shared records like any other resource records.
To create a shared record group:
1. From the Data Management tab, select the DNS tab -> Shared Record Groups tab, and then click the Add icon.
2. In the Shared Record Group wizard, specify the following:
— Name: Enter the name of the shared record group. It can be up to 64 characters long and can contain any
combination of printable characters. You can change the shared record group name even after you create
the group. It does not impact the shared records in the group.
— Hostname Policy: Click Override to supersede the hostname restriction policy set at the zone level or click
Inherit to use the zone policy. This sets the hostname policy for the shared records in the group. See
Specifying Hostname Policies on page 795.
— Comment: Optionally, enter additional information about the shared record group.
3. Click Next to associate the shared record group with at least one zone.
4. Click the Add icon in the Associated Zones panel.
5. In the Zone Selector dialog box, select a zone by clicking the zone name. You can add multiple zones.
6. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
7. Save the configuration.

Viewing Shared Record Groups

You can view the configured shared record groups by navigating to the Data Management tab -> DNS tab -> Shared
Record Groups tab. Grid Manager displays the following information about each shared record group:
• Name: The shared record group name.
• Comment: Comments that were entered for the shared record group.
• Site: Values that were entered for this pre-defined attribute.
You can do the following:
• List the shared resource records and associated zones in a shared record group.
— Click a shared record group name.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Edit the properties of a shared record group.
— Click the check box beside a shared record group, and then click the Edit icon.
• Delete a shared record group.
— Click the check box beside a shared record group, and then click the Delete icon. Note that you must
remove the zone associations in a shared record group before you delete it.
• Export the list of shared record groups to a .csv file.
— Click the Export icon.
• Print the list of shared record groups.
— Click the Print icon.

902 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Shared Record Groups

Modifying a Shared Record Group

When you edit a shared record group, you can do the following:
1. Perform a global search to retrieve the shared record group you want to modify.
or
From the Data Management tab, select the DNS tab -> Shared Record Groups tab -> shared_record _group check
box, and then click the Edit icon.
2. The Shared Record Group editor contains the following tabs from which you can modify information:
— General: You can change any of the information you entered when you created it, including its name.
Changing the shared record group name does not impact the shared resource records in it.
— Extensible Attributes: You can modify the attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab is displayed if you logged in as a superuser. For information, see About
Administrative Permissions on page 195.
3. Save the configuration and click Restart if it appears at the top of the screen.

Deleting Shared Record Groups

Before you delete a shared record group, you must remove the zone associations in the group; otherwise, an error
message appears when you delete. For information, see Deleting Associated Zones on page 906.
To delete a shared record group:
1. Perform a global search to retrieve the shared record group you want to modify.
or
From the Data Management tab, select the DNS tab -> Shared Record Groups tab -> shared_record _group check
box, and then click the Delete icon.
2. In the Delete Confirmation dialog box, click Yes.
Grid Manager moves the shared record group to the Recycle Bin, if enabled. Use the Recycle Bin feature to recover a
deleted shared record group and retrieve the deleted zones. For information, see Using the Recycle Bin on page 73.

Managing Shared Resource Records

You can create shared A, AAAA, CNAME, MX, SRV and TXT records. These resource records are similar to the
non-shared resource records. The DNS server uses them to respond to queries in the same way as any other resource
record. A shared resource record can belong to only one shared record group. This section describes how to add
shared resource records to a group and how to modify and delete them. It includes the following sections:
• Creating Shared Records
• Viewing Shared Records on page 904
• Modifying Shared Records on page 905
• Deleting Shared Records on page 905
NIOS allows superusers to add shared A and AAAA records with a blank name. Limited-access users must have
read/write permission to Adding a blank A/AAAA record to add shared A and AAAA records with a blank name. You
can assign global permission for specific admin groups and roles to allow limited-access users to add shared A and
AAAA records with a blank name. For more information, see Administrative Permissions for Adding Blank A or AAAA
Records on page 245.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 903

DNS Resource Records

Creating Shared Records

After you create a shared record group, you can create its resource records.
To create a shared A, AAAA, CNAME, MX, SRV or TXT record and add it to a group:
1. From the Data Management tab, select the DNS tab. Expand the Toolbar and click Add -> Shared Record.
or
From the Data Management tab, select the DNS tab -> Shared Record Groups tab -> shared_record _group .
Expand the Shared Records tab and click the Add icon.
2. Select one of the following:
— Shared A Record
— Shared AAAA Record
— Shared CNAME Record
— Shared MX Record
— Shared SRV Record
— Shared TXT Record
3. Enter information in the Shared Record wizard. See the online Help or the following for information about each
resource record:
— For information about A records, see Managing A Records on page 880.
— For information about AAAA records, see Managing AAAA Records on page 883.
— For information about CNAME records, see Managing CNAME Records on page 889.
— For information about MX records, see Managing MX Records on page 885.
— For information about SRV records, see Managing SRV Records on page 886.
— For information about TXT records, see Managing TXT Records on page 888.
4. Save the configuration, or click Next to define extensible attributes for the shared record. For information, see
Using Extensible Attributes on page 427.
5. Click Restart if it appears at the top of the screen.

Viewing Shared Records

You can view the shared records in a group and in a zone. To edit the shared record properties, click the shared record
name and select the Edit icon.
To view the shared records in a group:
• From the Data Management tab, select the DNS tab -> Shared Record Groups tab -> shared_record _group ->
Shared Records tab.
To view the shared records in a zone:
• From the Data Management tab, select the DNS tab -> Zones tab and select a zone.
Grid Manager lists the following information about each shared record by default:
• Name: The shared record name.
• Type: Indicates the type of resource record, such as A, AAAA, CNAME, MX, SRV or TXT records. Shared records
are identified as (Shared).
• Data: The data the shared resource record provides.
• Comment: Comments that were entered in the resource record.
• Site: Displays values that were entered for this pre-defined attribute.
You can display the following additional columns:
• TTL: The TTL value of the shared resource record.
• Disabled: Indicates whether the record is disabled.
You can do the following:

904 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Shared Record Groups

• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Edit the properties of a shared resource record.
— Select the shared resource record, and then click the Edit icon.
• Delete a shared resource record.
— Select the shared resource record, and then click the Delete icon.
• Export the list of shared resource records to a .csv file.
— Click the Export icon.
• Print the list of shared resource records.
— Click the Print icon.

Modifying Shared Records

You can modify, disable, or delete any shared record. When physical repair or relocation of a network device occurs,
you can disable a record instead of deleting it. This alleviates having to delete, and then add the shared record again.
When the changes to the physical device are complete, you can simply enable the shared record.
To modify or disable a shared record:
1. Perform a global search to retrieve the host or resource record you want to modify.
or
From the Data Management tab, select the DNS tab -> Shared Record Groups tab -> shared_record_group ->
Shared Records tab.
2. Select the shared record you want to modify and click the Edit icon.
3. The Shared Records editor contains the following tabs from which you can modify information:
— General: You can change most of the information, except for the read-only fields, such as the Host Name
Policy. You can also select the Disable check box to disable the record.
— TTL: You can modify the TTL setting. For information, see About Time To Live Settings on page 753.
— Extensible Attributes: You can modify the attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab displays if you logged in as a superuser. For information, see About Administrative
Permissions on page 195.
4. Save the configuration and click Restart if it appears at the top of the screen.

Deleting Shared Records

To delete shared resource records:
1. Perform a global search to retrieve the record you want to delete.
or
From the Data Management tab, select the DNS tab -> Shared Record Groups tab -> shared_record_group ->
Shared Records tab.
2. Select the shared record you want to delete and click the Delete icon.
3. When the confirmation dialog box displays, select Yes.
Grid Manager moves the shared records to the Recycle Bin, from which you can restore or permanently delete
the records.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 905

DNS Resource Records

Managing Associated Zones

Typically, you associate a zone with a shared record group when you create the group. You can also add an associated
zone to a shared record group after you create the group.

Creating Associated Zones

To associate a zone with a share record group:
1. From the Data Management tab, select the DNS tab -> Shared Record Groups tab -> shared_record _group ->
Associated Zones tab, and then click the Add icon.
2. In the Zone Selector dialog box, select a zone by clicking the zone name.
The appliance adds the zone to the Associated Zones tab.

Viewing Associated Zones

To view the associated zones in a shared record group:
• From the Data Management tab, select the DNS tab -> Shared Record Groups tab -> shared_record _group ->
Associated Zones tab.
Grid Manager lists the following information about each associated zone by default:
• Zone: The zone associated with the shared record group.
• DNS View: The DNS view to which the zones belong.
• Network View: The network view associated with the DNS view.
• Comment: Comments that were entered for the shared record group.
You can do the following:
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Associate another zone with the shared record group.
— Click the Add icon and select a zone.
• Delete an associated zone.
— Select the zone, and then click the Delete icon.
• Export the list of associated zones to a .csv file.
— Click the Export icon.
• Print the list of shared associated zones.
— Click the Print icon.

Deleting Associated Zones

To delete an associated zone:
1. From the Data Management tab, select the DNS tab -> Shared Record Groups tab -> shared_record_group ->
Associated Zones tab.
2. Select the associated zone and click the Delete icon.
3. When the confirmation dialog box displays, select Yes.
Grid Manager removes the zone from the shared record group.

906 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Shared Record Groups

Configuration Example: Configuring Shared Records

The following example shows you how to configure shared records. In this example, you do the following:
• Create a shared record group: group1.
• Associate it with three zones: eng.com, sales.com, and marketing.com.
• Create an A record www and an MX record mx1.
1. Create a shared record group called group1 and associate it with eng.com, sales.com, and marketing.com.
a. From the Data Management tab, select the DNS tab -> Shared Record Groups tab, and then click the Add
icon.
b. In the first step of the Shared Record Group wizard, specify the following
Name: Enter group1.
c. Click Next.
d. Click the Add icon in the Associated Zones panel.
e. Select eng.com from the list of zones and click the select icon. Do the same for the sales.com, and
marketing.com zones.
f. Save the configuration and click Restart if it appears at the top of the screen.
2. Add an A record www to group1.
a. Expand the Toolbar and click Add -> Shared Record > Shared A Record.
b. In the Shared A Record wizard, specify the following:
Name: Enter www.
Shared Record Group: Select group1 from the drop-down list.
IP Address: Enter the IP address 10.9.1.1.
c. Save the configuration and click Restart if it appears at the top of the screen.
3. Add an MX record mx1 into group1.
a. Expand the Toolbar and click Add -> Shared Record > Shared MX Record.
b. In the Shared MX Record wizard, specify the following:
Mail Destination: Enter mx1.
Shared Record Group: Select group1 from the drop-down list.
Mail Exchanger: Enter www.infoblox.com.
Preference: Enter 10.
Comment: Enter mail exchanger record for shared record group1.
c. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 907

DNS Resource Records

908 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 21 Configuring DDNS Updates
DDNS (Dynamic DNS) is a method to update DNS data (A, TXT, and PTR records) from sources such as DHCP servers
and other systems that support DDNS updates, such as Microsoft Windows servers 2000, 2003, 2008, 2008 R2,
2012, and 2012 R2. This chapter provides conceptual information about DDNS and explains how to configure NIOS
appliances running DHCP, DHCPv6 and DNS to support DDNS updates. It contains the following main sections:
• Understanding DDNS Updates from DHCP on page 911
• Configuring DHCP for DDNS on page 915
— Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915
— Sending Updates to DNS Servers on page 916
• Configuring DDNS Features on page 919
— Resending DDNS Updates on page 919
— Generating Host Names for DDNS Updates on page 919
— Configuring DDNS Features on page 920
— Replacing Host Names for DDNS Updates on page 920
• About the Client FQDN Option on page 923
— Enabling FQDN Option Support on page 924
— Sending Updates for DHCP Clients Using the FQDN Option on page 924
• Configuring DDNS Update Verification on page 925
• Configuring DNS Servers for DDNS on page 927
— Enabling DNS Servers to Accept DDNS Updates on page 928
— Forwarding Updates on page 929
• Supporting Active Directory on page 930
— Sending DDNS Updates to a DNS Server on page 931
• About GSS-TSIG on page 931
— Sending Secure DDNS Updates to a DNS Server in the Same Domain on page 933
— Configuring DHCP to Send GSS-TSIG Updates in the Same Domain on page 934
— Sending Secure DDNS Updates to a DNS Server in Another Domain on page 941
— Configuring DHCP to Send GSS-TSIG Updates to Another Domain on page 942
— Sending GSS-TSIG Updates to a DNS Server in Another Forest on page 943
• Configuring GSS-TSIG keys on page 944
— Limitations when Using Multiple GSS-TSIG keys on page 945
— Scheduled Upgrade on page 945
— Admin Permissions for Configuring GSS-TSIG keys on page 945

NIOS 7.3 NIOS Administrator Guide (Rev. A) 909

Configuring DDNS Updates

— Enabling GSS-TSIG Authentication for DHCP on page 945

— Deleting GSS-TSIG keys associated with DHCP Objects on page 946
— Enabling GSS-TSIG Authentication for DNS on page 947
— Deleting GSS-TSIG keys associated with the DNS Objects on page 948
— Logging Messages on page 948
— Managing GSS-TSIG keys on page 948
— Selecting Keys in the GSS-TSIG Key Selector on page 949
• Accepting DDNS Updates from DHCP Clients on page 949
— Supporting Active Directory and Unauthenticated DDNS Updates on page 950
• Accepting GSS-TSIG-Authenticated Updates on page 951
— Configuring DNS to Receive GSS-TSIG Updates on page 953
• Secure Dynamic Updates on page 959
— Restricting Updates to Static Records on page 959
— Restricting Updates to Protected Records on page 960
— Restricting Updates Based on GSS-TSIG Principal Authentication on page 960
— Restricting Updates Based on FQDN Patterns on page 962

910 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Understanding DDNS Updates from DHCP

Understanding DDNS Updates from DHCP

DHCP supports several DNS-related options (such as options 12, 15, and 81 for IPv4, and options 23, 24, and 39 for
IPv6). With DDNS (Dynamic DNS) updates, a DHCP server or client can use the information in these options to inform
a DNS server of dynamic domain name-to-IP address assignments.

Note: DDNS updates is not supported by IPv6-only appliances.

To set up one or more NIOS appliances for DDNS updates originating from DHCP, you must configure at least one
DHCP server and one DNS server. These servers might be on the same appliance or on separate appliances. Three
possible arrangements for a DHCP server to update a DNS server are shown in Figure 21.1.

Figure 21.1 Relationship of DHCP and DNS Servers for DDNS Updates

DDNS when the DHCP server and primary DNS server

are on the same NIOS appliance.

DDNS Update
1

Router
DHCP Server and Secondary DNS
Primary DNS Server Server

2 Zone Transfer

DDNS when the DHCP server and primary DNS server are on the different
NIOS appliances and the DHCP server updates the primary DNS server.

DDNS Update

Router Router
DHCP Secondary DNS Primary DNS
Server Server Server
Zone Transfer 2

DDNS when the DHCP server and primary DNS server are on the different
appliances and the DHCP server updates a secondary DNS server.

DDNS Update Forwarded DDNS Update

1 2

Router Router
DHCP Secondary DNS Primary DNS
Server Server Server
Zone Transfer 3

NIOS 7.3 NIOS Administrator Guide (Rev. A) 911

Configuring DDNS Updates

Here is a closer look at one setup for performing DDNS updates from a DHCP server (the steps relate to Figure 21.2).
1. When an IPv4 DHCP client requests an IP address, the client sends its host name (DHCP option 12). The client
also includes its MAC address in the ethernet frame header.
2. a. When the DHCP server responds with an IP address, it usually provides a domain name (DHCP option 15). The
combined host name (from the client) and domain name (from the server) form an FQDN (fully qualified domain
name), which the NIOS appliance associates with the IP address in the DHCP lease.
b. The DHCP server sends the A, TXT, and PTR records of the DHCP client to the primary DNS server to update its
resource records with the dynamically associated FQDN + IP address.
3. The primary DNS server notifies its secondary servers of a change. The secondary servers confirm the need for a
zone transfer, and the primary server sends the updated zone data to the secondary server, completing the
update.

Note: For information about zone transfers, see Enabling Zone Transfers on page 788.

Figure 21.2 DDNS Update from a DHCP Server

Update for forward-mapping zone corp100.com

A record: jsmith-xp 10.1.2.90
Ethernet Source MAC TXT record: jsmith-xp
Frame 11:11:11:11:11:11 “31995a5ea0681ee5d2f6e06ad0d0477e84”
Destination MAC
ff:ff:ff:ff:ff:ff (broadcast)
Update for
Update for reverse-mapping
reverse-mapping zonezone
DHCP REQUEST 2.1.10.in-addr.arpa
2.1.10-in-addr.arpa
Option:12, host name = jsmith-xp PTR record:
PTR record: 90 90 –- jsmith-xp.corp100.com

1 2b

Switch Router Router

DHCP DHCP Primary DNS Secondary DNS
Client Server Server Server
ns1.corp100.com ns2.corp100.com
2a 3
DHCP ACK
When the update reaches the
IP Address: 10.1.2.90
primary server, it updates its
Option: 15, domain name: corp100.com zone data, increases the
corp100.com zone serial
number, and sends a NOTIFY
DHCP Range to ns2.
10.1.2.10 - Network When the secondary server
10.1.2.100 10.1.2.0/24 receives the NOTIFY, it checks
if ns1 has a higher serial
number for corp100.com.
Note: The DHCP server asynchronously updates DNS for a Because the corp100.com serial
particular lease and sends the DHCP ACK to the client number on ns1 is higher, ns2
requesting the lease. If the DNS update is unsuccessful, requests an incremental zone
the DHCP client still gets its lease. The DHCP server then transfer (IXFR).
continues its DNS update attempts at predefined or ns1 sends the changed
user-defined intervals. zone data to ns2.

912 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Understanding DDNS Updates from DHCP

To enable a DHCP server to send DDNS updates to a DNS server, you must configure both servers to support the
updates. First, configure the DHCP server to do the following:
• Provide what is needed to create an FQDN: add a server-generated host name to a server-provided domain
name, add a server-provided domain name to a client-supplied host name, or permit the client to provide its
own FQDN
• Send updates to a DNS server
Then, configure the following on the DNS server:
• Accept updates from the DHCP server, a secondary DNS server, or a DHCP client
• If the DHCP server sends updates to a secondary DNS server, configure the secondary server to forward updates
to the primary DNS server
When setting up DDNS, you can determine the amount of information that DHCP clients provide to a DHCP server—
and vice versa—and where the DDNS updates originate. A summary of these options for IPv4 is shown in Figure 21.3.
It is similar for IPv6, except that the DHCP client and server exchange Request and Reply messages, AAAA records are
updated instead of A records, and the FQDN option is option 39.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 913

Configuring DDNS Updates

Figure 21.3 DHCP Clients and Server Providing DNS Information and Updates

DHCP Client DHCP Server DNS Server

DHCPDISCOVER For DHCP to update DNS dynamically, a

DHCP client must have an FQDN. The
DHCPOFFER with an IP address and DHCP server can assign one or work
configuration parameters, and a domain with the client to create one, or the client
name (option 15) to combine with a DHCP can provide an FQDN itself.
server-generated host name when the Because clients send a DHCP server
server sends a DNS update. varying amounts of DNS-related
OR information (nothing, a host name, or an
entire FQDN), you can configure the
server to provide whatever missing
DHCPDISCOVER with a host name information is necessary to construct an
(option 12) FQDN, depending on how much or how
little each client provides.
DHCPOFFER with an IP address and You can also configure the DHCP server
configuration parameters, and a domain to disregard DNS-related information
name (option 15) to combine with the from clients and apply its own settings.
client-provided host name when the server For example, you might want the DHCP
sends a DDNS update server to always assign the domain name
OR (even when a client provides its own
FQDN), or you might want only the
DHCPDISCOVER with an FQDN and DHCP server to update the DNS server
DDNS update instructions (option 81) (even when a client requests to make its
own updates).

DHCPOFFER with an IP address and

configuration parameters.
Setting the DHCP server to update all
resource records ensures that new A
records do not overwrite existing A records, DHCP server updates the DNS server with
which can happen if two hosts send the A, TXT, and PTR records.
same FQDN. OR
Optionally, you can set the DHCP server to
update PTR records and allow clients to DHCP server updates the DNS server with
update their own A records. a PTR record (option 81).

DHCP client updates the DNS server with its own A record (option 81).

You can configure the DHCP and DNS settings for DDNS at the Grid level, member level, and network and zone level.
By applying the inheritance model in the NIOS appliance, settings made at the Grid level apply to all members in the
Grid. Settings you make at the member level apply to all networks and zones configured on that member. Settings
made at the network and zone level apply specifically to just that network and zone. When configuring independent
appliances (that is, appliances that are not in a Grid), do not use the member-level settings. Instead, configure DDNS
updates at the Grid level to apply to all zones and, if necessary, override the Grid-level settings on a per zone basis.

914 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DHCP for DDNS

Configuring DHCP for DDNS

Before a DHCP server can update DNS, the DHCP server needs to have an FQDN-to-IP address mapping. When a DHCP
IPv4 client requests an IP address, it typically includes its host name in option 12 of the DHCPDISCOVER packet, and
an IPv6 client includes its hostname in the Request packet. You can configure the NIOS appliance to include a domain
name in option 15 of the IPv4 DHCPOFFER packet or in the IPv6 Reply packet. You specify this domain name in the
IPv4 DHCP Options -> Basic and IPv6 DHCP Options -> Basic tabs of the Grid DHCP Properties editor, Member DHCP
Configuration editor, and the Network editor. For IPv4 clients you can also specify a domain name in the DHCP Range
and Fixed Address editors.
Then, you can enable the DHCP server to send DDNS updates for IPv4 and IPv6 clients, as described in Enabling DDNS
for IPv4 and IPv6 DHCP Clients on page 915. After you enable the DHCP server to send DDNS updates, you can do
the following:
• Configure the DHCP server to send DDNS updates to DNS servers in the Grid. For information, see Sending
Updates to DNS Servers in the Grid on page 916.
• Configure the DHCP server to send DDNS updates to external DNS servers. For information, see Configuring
DDNS Features on page 919.
• Configure certain DDNS features. For information, see Configuring DDNS Features on page 920.
• Enable support for the FQDN option for IPv4 and IPv6 clients, and configure how the DHCP server updates DNS.
For information, see Enabling FQDN Option Support on page 924.

Note: Whether you deploy NIOS appliance in a Grid or independently, they send updates to UDP port 53. Grid
members do not send updates through a VPN tunnel; however, Grid members do authenticate updates
between each other using TSIG (transaction signatures) based on an internal TSIG key.

Enabling DDNS for IPv4 and IPv6 DHCP Clients

You can enable the DHCP server to send DDNS updates for IPv4 clients at the Grid, member, shared network, network,
address range, DHCP template, fixed address, and roaming host levels, and for IPv6 clients at the Grid, member,
network, shared network, network template and roaming host levels.
You can specify a different domain name that the appliance uses specifically for DDNS updates. The appliance
combines the hostname from the client and the domain name you specify to create the FQDN that it uses to update
DNS. For IPv4 clients, you can specify the DDNS domain name at the network, network template, range, and range
template levels. For IPv6 clients, you can specify the DDNS domain name at the Grid, member, network, shared
network, and network template levels. You can also use the name of a roaming host record as the name of the client
for DDNS updates, as described in Setting Properties for Roaming Hosts on page 1139.
To enable DDNS and specify a DDNS domain name:
1. Grid: From the Data Management tab, select the DHCP tab, expand the Toolbar and click Grid DHCP Properties.
Member: From the Data Management tab, select the DHCP tab and click the Members tab -> Members -> member
check box -> Edit icon.
Network: From the Data Management tab, select the DHCP tab and click the Networks tab -> Networks -> network
check box -> Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon.
Network Template: From the Data Management tab, select the DHCP tab and click the Templates tab ->
DHCP_template check box -> Edit icon.
Roaming Host: From the Data Management tab, select the DHCP tab and click the Networks tab -> Roaming
Hosts -> roaming_host -> Edit icon.
For IPv4 clients only:
IPv4 Address Range: From the Data Management tab, select the DHCP tab and click the Networks tab ->
Networks -> network -> addr_range check box -> Edit icon.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 915

Configuring DDNS Updates

IPv4 Fixed Address: From the Data Management tab, select the DHCP tab and click the Networks tab -> Networks
-> network -> ip_addr check box -> Edit icon.
IPv4 Address Range/Fixed Address Template: From the Data Management tab, select the DHCP tab and click the
Templates tab -> DHCP_template check box -> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the IPv4 DDNS -> Basic tab or the IPv6 DDNS -> Basic tab, complete the following:
— Enable DDNS Updates: Select this check box to enable DDNS updates. When setting properties for DHCP
objects other than the Grid, you must click Override and select Enable DDNS updates for the DDNS settings
to take effect.

Note: In a dual mode Grid, if IPv6 DDNS updates is enabled at the Grid level, then when you join an IPv6 Grid
member to the Grid, IPv6 DDNS updates is automatically disabled for the Grid member.

— DDNS domain name: Specify the domain name of the network that the appliance uses to update DNS. For
IPv4 clients, you can specify this at the network, network template, range, and range template levels. For
IPv6 clients, you can specify this at the Grid, member, network, shared network, and network template
levels.
— DDNS Update TTL: You can set the TTL used for A or AAAA and PTR records updated by the DHCP server. The
default is shown as zero. If you do not enter a value here, the appliance by default sets the TTL to half of the
DHCP lease time with a maximum of 3600 seconds. For example, a lease time of 1800 seconds results in a
TTL of 900 seconds, and a lease time of 86400 seconds results in a TTL of 3600 seconds. For information
about how to set the lease time, see Defining Lease Times on page 1072.
— Update DNS on DHCP Lease Renewal: Select this check box to enable the appliance to update DNS when a
DHCP lease is renewed.
3. Save the configuration and click Restart if it appears at the top of the screen.

Sending Updates to DNS Servers

The DHCP server can send DDNS updates to DNS servers in the same Grid and to external DNS servers. When you
enable the appliance to send updates to Grid members, you must specify the DNS view to be updated. If a network
view has multiple DNS views, you can select only one DNS view for DDNS updates. For information about DNS views,
see Using Infoblox DNS Views on page 812.
When you enable DDNS updates for a Grid, member, shared network, network, address range, DHCP template, fixed
address, or roaming host, the DHCP server sends updates to authoritative zones using the domain name (as DHCP
option 15) you define in the DHCP properties. You can also define forward-mapping zones that receive DDNS updates
for DHCP clients that use option 81 to define the domain name. For information, see About the Client FQDN Option
on page 923. To allow DDNS updates for clients using option 81, you must first enable the support for option 81. For
information, see Configuring DDNS Features on page 919.
For DNS zones that have multiple primary servers, you can define a primary name server to be used as the default
primary server when performing DDNS updates from the appliance. Note that you cannot configure an external
primary as the default primary. For more information, see Defining the Default Primary for DDNS Updates to Zones
with Multiple Primaries on page 918.

Sending Updates to DNS Servers in the Grid

You must specify the DNS view to be updated for each network view.
To configure the DHCP server to send updates to DNS servers in the same Grid:
1. If there are multiple network views in the Grid, select a network view.
2. From the Data Management tab, select the DHCP tab, and then click Configure DDNS from the Toolbar.
3. In the DDNS Properties editor, complete the following:

916 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DHCP for DDNS

— DNS View: If a network view has more than one DNS view, this field lists the associated DNS views. From the
drop-down list, select the DNS view to which the DHCP server sends DDNS updates. Otherwise, the
appliance uses the default DNS view.
4. Save the configuration and click Restart if it appears at the top of the screen.
The appliance sends DDNS updates to the appropriate zones in the selected DNS view. Note that you cannot
delete a DNS view that has been selected for DDNS updates. By default, the DHCP server sends DDNS updates
to zones using the domain name that you define for DHCP objects, such as networks and DHCP ranges.

Sending Updates for Zones on an External Name Server

The DHCP server can send dynamic updates to an external name server that you specify. For each network view, you
can specify the zone to be updated and the IP address of the primary name server for that zone. You can add
information for a forward and reverse zone. The DHCP server updates the A record in the forward zone and the PTR
record in the reverse zone.
You can also use TSIG (transaction signatures) or GSS-TSIG to secure communications between the servers. TSIG uses
the MD5 (Message Digest 5) algorithm and a shared secret key to create an HMAC (hashed message authentication
code)—sometimes called a digital fingerprint—of each update. Both the DHCP server sending the update and the DNS
server receiving it must share the same secret key. Also, it is important that the time stamps on the
TSIG-authenticated updates and update responses be synchronized, or the participants reject them. Therefore, use
an NTP server to set the time on all systems involved in TSIG authentication operations.
Note that only a superuser can configure DDNS. To configure DDNS, a limited-access admin must contact a superuser.
To send updates to a DNS server that is external to your Grid:
1. If there are multiple network views in the Grid, select a network view.
2. From the Data Management tab, select the DHCP tab, expand the Toolbar and click Configure DDNS.
3. In the DDNS Updates to External Zones section of the DDNS Properties editor, click the Add icon. Complete the
following fields in the Add External DDNS Zone panel, and then click Add:
— Zone Name: Enter the FQDN of a valid forward-mapping or reverse-mapping zone to which the DHCP server
sends the updates. Do not enter the zone name in CIDR format. To specify a zone name in IDN, manually
convert IDN to punycode and use the punycode representation.
— DNS Server Address: Enter the IP address of the primary name server for that zone.
— Security: Select one of the following security methods:
— None: Select this to use unsecured DDNS updates. This is the default.
— TSIG: Select this to use the standards-based TSIG key that uses the one-way hash function MD5 to
secure transfers between name servers. You can either specify an existing key or generate a new key.
To specify an existing key, complete the following:
Key Name: Enter the TSIG key name. The key name entered here must match the TSIG key name on the
external name server.
Key Algorithm: Select either HMAC-MD5 or HMAC-SHA256.
Key Data: To use an existing TSIG key, type or paste the key in the Key Data field. Alternatively, you can
select the key algorithm, select the key length from the Generate Key Data drop down list, and then click
Generate Key Data to create a new key.
— GSS-TSIG: For information about using GSS-TSIG, see About GSS-TSIG on page 931.
4. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 917

Configuring DDNS Updates

Defining the Default Primary for DDNS Updates to Zones with Multiple Primaries
If you have configured multiple primary servers for an authoritative zone, you can define the default primary that the
appliance uses to perform DDNS updates for the zone. Note that you can configure a Grid primary, but not an external
primary, as the default primary. If you do not configure a default primary, the Grid Master becomes the default primary
for the zones that it serves. Otherwise, the appliance selects a primary server that serves the zone as the default
primary. For external zones that have multiple primaries, the first external primary server becomes the default
primary.
Configuring a default primary for DDNS updates is useful when you have DHCP members that span across different
locations. Performing DDNS updates becomes more efficient when you configure a default primary that is close in
proximity to the DHCP member. For example, zone corp100.com has two primaries (usa.corp100.com and
japan.corp100.com) serving two locations (USA and Japan). Service performance is faster when you select
usa.corp100.com as the default primary for DDNS updates in the USA region and japan.corp100.com as the default
primary for the Japan region.
When you configure a preferred or default primary server for DDNS updates to a zone that has multiple primaries,
ensure that the following are in place:
• The zone that you select contains multiple primary servers.
• The primary server has DNS service enabled and is authoritative for the zone.
• The appliance has DHCP service enabled.

Note: You can define the default primary for the Grid and override the setting at the member level, and you must
restart service for the configuration to take effect. Primary selection is performed at service restart, not at
runtime.

To define the default primary:

1. Grid: From the Data Management tab, select the DHCP tab, expand the Toolbar and click Configure DDNS. In the
DDNS Properties editor, scroll down to the Master Preferences for DDNS Updates to Multi-master DNS Zones
section.
Member: From the Data Management tab, select the DHCP tab and click the Members tab -> member check box
-> Edit icon. In the Member DHCP Properties editor, select the DDNS tab.
2. In the Master Preferences for DDNS Updates to Multi-master DNS Zones section, click the Add icon and select
one of the following from the list:
— Grid Zone: In the Add Grid Zone panel, complete the following:
— Zone: Click Select Zone to select the zone that has multiple primaries. Note that when configuring for
the Grid, only zones that belong to the selected DNS view are displayed in the Zone Selector dialog box.
For a Grid member however, if it is associated with a network view or if you have defined a DNS view for
DDNS updates for that network view, only zones that belong to the DNS view configured for the
associated network view are displayed.
— DNS View: Displays the DNS view to which this zone belongs.
— DNS Primary: From the drop-down list, select the primary name server you want the appliance to use
when performing DDNS updates. Note that the list displays only primary servers that are defined for the
selected zone.
— Default Primary: In the Add Default Primary panel, complete the following:
— DNS Primary: Click Select to select a primary name server from the Member Selector dialog. When you
select a default primary, the appliance uses this name server for DDNS updates to all zones.
3. Click Add to add the zone and primary name server to the table, which displays the following information:
— DNS View: The DNS view to which the zone belongs.
— Zone: The selected zone that has multiple primaries.
— DNS Primary: The primary server to be used when performing DDNS updates from a NIOS DHCP server to
the selected zone.

918 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DDNS Features

Note: All zones added to the table belong to the same DNS view.

Concatenated with the following rules defined at the Grid level: This section appears only in the Member DHCP
Properties editor. This table displays rules that are defined for zones with multiple primaries at the Grid level. Rules
configured at the member level automatically override those configured for the Grid. Note that all rules configured for
both the Grid and the member apply.

Configuring DDNS Features

You can enable the DHCP server to support certain DDNS features for IPv4 and IPv6 clients. These features affect the
behavior of the DHCP server and how it handles DDNS updates. The following sections describe the different features
you can set.

Resending DDNS Updates

You can enable the DHCP server to make repeated attempts to send DDNS updates to a DNS server. The DHCP server
asynchronously updates DNS for a particular lease and sends the DHCP ACK to the client requesting the lease. If the
update fails, the DHCP server still provides the lease and sends the DHCP ACK to the client. The DHCP server then
continues to send the updates until it is successful or the lease of the client expires. You can change the default retry
interval, which is five minutes.
You can enable this feature for the Grid and for individual Grid members.

Generating Host Names for DDNS Updates

Some IPv4 and IPv6 clients do not send a host name with their DHCP requests. When the DHCP server receives such
a request, its default behavior is to provide a lease but not update DNS. You can configure the DHCP server to
generate a host name and update DNS with this host name when it receives a DHCP request that does not include a
host name. It generates a name in the following format: dhcp-ip_address, where ip_address is the IP address of the
lease. For example, if this feature is enabled and the DHCP server receives a DHCP REQUEST from an IPv4 DHCP client
with IP address 10.1.1.1 and no host name, the DHCP server generates the name dhcp-10-1-1-1 and appends the
domain name, if specified, for the DDNS update. Likewise, if an IPv6 client with IP address 2001:db8:a23:0:0:0:0:d
sends a request, the DHCP server generates the name dhcp-2001-db8-a23-0-0-0-0-d and appends the domain name,
if specified, for the DDNS update.

Updating DNS for IPv4 Clients with Fixed Addresses

By default, the DHCP server does not update DNS when it allocates an IPv4 or IPv6 fixed address to a client. You can
configure the DHCP server to update the A and PTR record of IPv4 clients with a fixed address. When you enable this
feature and the DHCP server adds A and PTR records for a fixed address, the DHCP server never discards the records.
When the lease of the client terminates, you must delete the records manually. Note that the DHCP server does not
send DDNS updates for IPv6 fixed addresses and hosts.
You can define fixed address settings for the Grid, Grid members, IPv4 networks, and IPv4 shared networks.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 919

Configuring DDNS Updates

Configuring DDNS Features

You can configure DDNS features for a Grid, its member, IPv4 and IPv6 networks and shared networks, and IPv4 DHCP
address ranges. You cannot set DDNS features for IPv6 DHCP ranges. To configure DDNS features:
1. Grid: From the Data Management tab, select the DHCP tab, expand the Toolbar and click Grid DHCP Properties.
Member: From the Data Management tab, select the DHCP tab and click the Members tab -> member check box
-> Edit icon.
Network: From the Data Management tab, select the DHCP tab and click the Networks tab -> Networks -> network
check box -> Edit icon.
Shared Network: From the Data Management tab, select the DHCP tab and click the Networks tab -> Shared
Networks -> shared_network check box -> Edit icon.
DHCP Range: From the Data Management tab, select the DHCP tab and click the Networks tab -> Networks ->
network -> addr_range check box -> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the DDNS -> Advanced tab for the Grid and member, or the DDNS -> Basic tab for the network, do the following:
— Update Retry: You can set this for a Grid and its members only.
— Retry Updates When Server Becomes Available: Select this check box.
— Retry interval (Minutes): You can optionally set the retry interval. The default is five minutes.
— Generate Hostname
— Generate Hostname if not Sent by Client: Select this check box to enable the DHCP server to generate a
hostname and update DNS with this hostname, when the DHCP request of a client does not include a
hostname.
— Fixed Address Updates: You can set this for IPv4 fixed addresses only. This option is available in the IPv4
DDNS Advanced tab of the Grid DHCP Properties and Member DHCP Properties editors, and in the IPv4
DDNS Basic tab of the IPv4 DHCP Network and Shared Network editors.
— Update Fixed Addresses: Select this check box to allow he DHCP server to send updates to DNS forIPv4
fixed addresses.
3. Save the configuration and click Restart if it appears at the top of the screen.
When a lease expires, the DHCP server removes the A, AAAA, and PTR records that it updated. It does not remove any
records that the client updated.

Replacing Host Names for DDNS Updates

In situations where you need to restrict the use of specific characters in a host name for DDNS updates, you can
configure a hostname rewrite policy. Such policy accepts certain characters and replaces others in host names
specified in IPv4 DHCP requests. When you create a hostname rewrite policy, you enter a list of valid characters that
the appliance accepts in the host name. You also specify a character that the appliance uses to replace invalid
characters. You can create multiple hostname rewrite policies on the appliance, but you can only enable one policy
at any given time. The appliance provides a default policy that includes a-z0-9_ as valid characters and dash (-) as
the replacement character. You cannot modify or delete the default policy.
When you enable a hostname rewrite policy, the appliance replaces host names with the newly translated host name
when it issues DHCP leases and sends DDNS updates for IPv4 DHCP clients. For information about how to add and
enable a hostname rewrite policy, see Adding and Enabling a Hostname Rewrite Policy on page 921.
Before you enable a hostname rewrite policy, consider the following:
• You must enable DDNS updates before the hostname rewrite policy can take effect.
• You can use a hostname rewrite policy only if MS code pages are disabled.
• The policy supports only IPv4 DHCP clients.
• If DHCP option 81 support is enabled and updating DDNS is in the request, the appliance sends updates for A
records directly to the DNS server and DHCP only updates the PTR record. When this happens, there can be a
mismatch in the host name between the A and PTR records.

920 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DDNS Features

• Changes made to a hostname rewrite policy apply only to subsequent DDNS updates.
When an IPv4 DHCP client requests an IP address, it includes its host name in DHCP option 12. If you enable a
hostname rewrite policy, the appliance uses the newly translated host name when it issues a lease to the client.
The client can also include a FQDN in option 81, in which it instructs the server whether to perform DDNS updates. If
the client sends a FQDN in option 81, the appliance replaces the entire FQDN based on the policy. For example, if the
FQDN in option 81 is dev.bldg12.corp100.com, the appliance replaces invalid characters in the entire FQDN even
though the host name can be dev or dev.bldg12. For example, if your hostname rewrite policy specifies valid
characters as a-z and the replacement character is -, the newly translated FQDN is dev.bldg--.corp---.com. For
information about client FQDN in option 81, see About the Client FQDN Option on page 923.
Note that when multiple IPv4 DHCP clients specify host names that map to the same translated host name, the
appliance allocates leases to all clients, but it only sends DDNS updates to the first client request. When it tries to
update DNS for subsequent clients, the updates fail.
You can add and enable a hostname rewrite policy for the entire Grid. You can also override the policy at a member
level, as described in Overriding a Grid Hostname Rewrite Policy on page 922.

Adding and Enabling a Hostname Rewrite Policy

To add and enable a hostname rewrite policy, complete the following:
1. From the Data Management tab, select the DHCP tab, expand the Toolbar and click Grid DHCP Properties.
2. In the Grid DHCP Properties editor, click Toggle Advanced Mode.
3. In the IPv4 DDNS -> Advanced tab, click the Add icon in the Hostname Rewrite Policy section:
— Policy Name: Enter the policy name. Each policy name must be unique.
— Valid Characters: Enter a list of valid characters you want to keep in the host name. Ensure that you consider
the following rules:
• You can include only printable ASCII characters and space.
• The appliance includes period (.) as a valid character by default. You do not need to specify it.
• You can also use shortcuts for a series or range of characters. For example, when you enter a-d, the
appliance includes the following: A, B, C, D, a, b, c, and d. When you enter 0-5, the appliance
includes the following: 0, 1, 2, 3, 4, and 5. In a character range, ensure that the start character is
less than the end character.
• If you want to use dash (-) as a character, ensure that you put it in front of the valid character
pattern. Otherwise, the appliance treats the string as a range of characters.
• You can build a POSIX regular expression based on the string you enter here, but you cannot enter
an empty string.
• You cannot use the meta character (^) as a start or end character in a range. For example, a-^ is
invalid. You also cannot use duplicate characters as character sets. For example, aa is invalid.
— Replace Invalid Characters with: Enter a character the appliance uses to replace invalid characters. Only
enter one printable ASCII character. You cannot enter multiple characters or use space as the replacement
character.
To test the hostname policy before adding it to the system, enter a sample hostname in the Sample Host Name
field, and then click Test. The appliance displays the translated hostname. You can change the policy and test it
again until you get the desired result.
Click the Add icon to add the new hostname rewrite policy to the table. The appliance comes with a default
policy that includes a-z0-9_ as valid characters and dash (-) as the replacement character. Grid Manager
displays the following for each policy:
— Policy Name: The name of the hostname rewrite policy.
— Valid Characters: Valid characters for the host name.
— Replace Invalid Characters with: The character used to replace invalid characters in the host name.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 921

Configuring DDNS Updates

You can also select a hostname policy and click the Edit icon to modify it, or click the Delete icon to delete it.
You cannot modify or delete the default policy. For information about how to modify a policy, see Modifying a
Hostname Rewrite Policy on page 922.
4. Complete the following to enable the hostname rewrite policy:
— Enable hostname rewrite policy: Select this check box to use a hostname rewrite policy for DHCP leases and
DDNS updates for IPv4 DHCP clients. From the drop-down list, select the hostname policy you want to use.
5. Save the configuration.

Modifying a Hostname Rewrite Policy

To modify a hostname rewrite policy, complete the following:
1. From the Data Management tab, select the DHCP tab, expand the Toolbar and click Grid DHCP Properties.
2. In the Grid DHCP Properties editor, click Toggle Advanced Mode.
3. In the IPv4 DDNS -> Advanced tab, do the following in the Hostname Rewrite Policy section:
— Select a policy from the table, and then click the Edit icon.
— In the Edit Hostname Rewrite Policy section, modify and test the policy as described in Adding and Enabling
a Hostname Rewrite Policy on page 921.

Note: If you enable the policy at the Grid level, you can modify all information, including the policy name. If you
enable the policy at the member level, you can modify any information, except for the policy name.

4. Click Save. The appliance updates the policy in the table.

5. Save the configuration.

Overriding a Grid Hostname Rewrite Policy

You can override a Grid hostname rewrite policy at the member level. To override a Grid policy, complete the following:
1. From the Data Management tab, select the DHCP tab and click the Members tab -> member check box -> Edit icon.
2. In the Member DHCP Properties editor, click Toggle Advanced Mode.
3. In the IPv4 DDNS -> Advanced tab, click Override in the Hostname Rewrite Policy section, and then complete the
following:
— Enable hostname rewrite policy: Select this check box to use a hostname rewrite policy, or deselect the
check box to disable the policy.
— When you enable this feature, select a policy that you want to use from the drop-down list. Grid Manager
displays all hostname rewrite policies that you have configured on the appliance in the drop-down list. After
you select a policy, Grid Manager displays the policy name, valid characters, and the replacement
character.
4. Save the configuration.

922 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About the Client FQDN Option

About the Client FQDN Option

When an IPv4 DHCP client sends DHCP DISCOVER and DHCP REQUEST messages, it can include option 81, the Client
FQDN option. An IPv6 DHCP client can include option 39, the Client FQDN option, when it sends Solicit and Request
messages.
The Client FQDN option contains the FQDN (fully qualified domain name) of the client and instructions on whether
the client or the server performs DDNS updates. You can configure the appliance to replace the FQDN in the option
by defining a hostname rewrite policy. For information about adding and enabling a hostname rewrite policy, see
Replacing Host Names for DDNS Updates on page 920.
The DHCP server can support option 81 for IPv4 and IPv6 clients, and use the host name or FQDN that the client
provides for the update. It can also allow or deny the client’s request to update DNS, according to the administrative
policies of your organization. The DHCP server indicates its response in the DHCP OFFER message it sends back to an
IPv4 client, and in the Reply message it sends back to an IPv6 client.

Sending Updates with the FQDN Option Enabled

When you enable the DHCP server to support the FQDN option, it uses the information provided by the IPv4 or IPv6
client to update DNS as follows:
• When an IPv4 or IPv6 DHCP client sends a DHCP request with the FQDN option, it can include either its FQDN or
only its host name.
— If the request includes the FQDN, the DHCP server uses this FQDN to update DNS. You can specify a list of
forward-mapping zones to be updated for IPv4 and IPv6 clients using the FQDN option. For information, see
Sending Updates for DHCP Clients Using the FQDN Option on page 924.
— If the request includes the host name, the DHCP server provides the domain name. It combines the host
name of the client and the domain name to create an FQDN for the client. It then updates DNS with the
FQDN it created. (You can enter the domain name in the General page of the DHCP Properties window. For
information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915.)
• When a DHCP client sends a DHCP request with its hostname, the DHCP server adds the domain name you
specified to create an FQDN for the client. It then updates DNS with the FQDN it created. For information about
entering the domain name, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915.
• When a DHCP client does not send a host name, the DHCP server provides a lease but does not update DNS.
You can configure the DHCP server to generate a host name and update DNS as described in Generating Host
Names for DDNS Updates on page 919.
• If multiple DHCP clients specify the same FQDN or host name, the DHCP server allocates leases to the clients,
but updates DNS only for the client that first sent the request. When it tries to update DNS for the succeeding
clients, the update fails.

Sending Updates from DHCP Clients or a DHCP Server

When you enable the DHCP server to support the FQDN option, you must decide if you want the DHCP server to allow
clients to update DNS. If you allow the client to update DNS, then the client updates its A or AAAA record only. The
DHCP server always updates the PTR records. You can configure the DHCP server as follows:
• The DHCP server can allow clients to update DNS when they send the request in the FQDN option. This is useful
for small sites where security is not an issue or in sites where clients move from one administrative domain to
another and want to maintain the same FQDN regardless of administrative domain.
If you configure the DHCP server to allow clients to perform DDNS updates, you must also configure the DNS
server to accept these updates from clients. Note that multiple clients can use the same name, resulting in
multiple PTR records for one client name.
When a lease expires, the DHCP server does not delete the A or AAAA record, if it was added by the client.
• The DHCP server can refuse the DHCP client’s request to update DNS and always perform the updates itself.
When the DHCP server updates DNS, it uses the FQDN provided by the DHCP client. Select this option if your
organization requires tighter control over your network and does not allow clients to update their own records.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 923

Configuring DDNS Updates

If you do not enable support for the FQDN option and a client includes it in a DHCP request with its FQDN, the DHCP
server does not use the FQDN of the client. Instead, it creates the FQDN by combining the host name from the client
with the domain name specified in the Grid or Member DHCP Configuration editor.
Do the following to configure support for the FQDN option for both IPv4and IPv6 clients:
• Enable support for the option and specify who performs the DDNS update. For more information, see Enabling
FQDN Option Support on page 924.
• Specify the DNS zones and DNS view for the updates. For more information, see Sending Updates for DHCP
Clients Using the FQDN Option on page 924.

Enabling FQDN Option Support

You can configure support for the FQDN option for IPv4 and IPv6 clients at the Grid, member, network and shared
network levels.
To configure support for the FQDN Option (option 81) for IPv4 and (Option 39) for IPv6:
1. Grid: From the Data Management tab, select the DHCP tab, expand the Toolbar and click Grid DHCP Properties.
Member: From the Data Management tab, select the DHCP tab and click the Members tab -> member check box
-> Edit icon.
Network: From the Data Management tab, select the DHCP tab and click the Networks tab -> Networks -> network
check box -> Edit icon.
Shared Network: From the Data Management tab, select the DHCP tab and click the Networks tab -> Shared
Networks -> shared_network check box -> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the IPv4 DDNS -> Advanced tab for the Grid and member, or the IPv4 DDNS -> Basic tab for the network, do the
following:
— Option 81 Support
— Enable Option 81 Support: Select this to enable the support for option 81.
— DHCP server always updates DNS: Select this to allow the DHCP server to update DNS, regardless of the
requests from DHCP clients.
— DHCP server updates DNS if requested by client: Select this to allow the DHCP server to update DNS
only when requested by DHCP clients.
3. In the IPv6 DDNS -> Advanced tab for the Grid and member, or the IPv6 DDNS -> Basic tab for the network, do the
following:
— FQDN Support: Select Enable FQDN Support and select one of the following to indicate whether the DHCP
server or the client performs the DDNS update.
— DHCP always updates DNS
— DHCP updates DNS if requested by client
4. Save the configuration and click Restart if it appears at the top of the screen.
When a lease expires, the DHCP server removes the A or AAAA records and PTR records that it updated. It does not
remove any records that the client updated.

Sending Updates for DHCP Clients Using the FQDN Option

You must specify the DNS view to be updated for each network view.
To send updates to zones for DHCP IPv4 and IPv6 clients using the FQDN option:
1. If there are multiple network views in the Grid, select a network view.
2. From the Data Management tab, select the DHCP tab, and then click Configure DDNS from the Toolbar.
3. In the DDNS Properties editor, complete the following:

924 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DDNS Update Verification

— DNS View: If a network view has more than one DNS view, this field lists the associated DNS views. From the
drop-down list, select the DNS view to which the DHCP server sends DDNS updates. Otherwise, the
appliance uses the default DNS view.
— Zones to Update for Hosts Using DHCP FQDN Option: In this section, you can define forward-mapping zones
to which the DHCP server sends DDNS updates for IPv4 and IPv6 DHCP clients that use the FQDN option.
You must first enable support for the FQDN option before the DHCP server can send DDNS updates to these
zones. By default, the DHCP server sends DDNS updates to zones using the domain name that you define
for DHCP objects, such as networks and DHCP ranges. For clients using this option, the DHCP server uses
the domain name defined in the option.
Click the Add icon to specify a forward-mapping zone. Note that the Forward-mapping Zone Selector dialog
box displays only the DNS zones that are associated with the selected DNS view. The zones you select here
are written to the dhcpd.conf file and the dhcpdv6.conf file as “zone” statements with the matching TSIG
key of the DNS view, so the updates are sent to the correct DNS view.
4. Save the configuration and click Restart if it appears at the top of the screen.

Configuring DDNS Update Verification

The DHCP server can handle DDNS updates differently, depending on how stringently you configure record handling.
You can configure the DHCP server to update records only after passing verification. You can adjust the way DHCP
handles updates so the DHCP server updates records after passing less stringent verification requirements, or
without any type of verification.
To provide a measure of protection against unintentional changes of DNS data, NIOS appliances support the
generation and use of TXT records, as described in IETF draft, draft-ietf-dhc-dhcp-dns-12.txt and by the ISC (Internet
Systems Consortium). When DHCP updates or deletes an A or AAAA record, the corresponding TXT record is checked
first to verify the authenticity of the update. The TXT record is based on a hash of the DHCID which is unique to each
client, usually based in part on the MAC address or the DUID. If the client requests an update to DNS, the DHCP server
first checks the TXT record to verify that it matches the client that originally inserted the record. This process provides
assurance that the updates are from the same client. These security checks are based upon inserting a cryptographic
hash of the DHCID (DHCP Client Identifier) into a DNS TXT RR and then verifying that value before updating. For
example, a sample client update adds the following records in DNS:

oxcart.lo0.net. 21600 IN A 172.31.1.20

oxcart.lo0.net. 21600 IN TXT "313ce164780d34b91486b7c489ed7467e6"
20.1.31.172.in-addr.arpa. 21600 IN PTR oxcart.lo0.net.

However, your DNS configuration might require that the NIOS appliance handle DNS record updates differently than
described in draft-ietf-dhc-dhcp-dns-12.txt. Your specific requirements might benefit from less-stringent verification
of the DHCID, or might require skipping verification entirely. Verification checks might cause complications in some
specific cases described below:
• Mobility: The TXT record is based on the DHCID unique to each client and is usually based on the MAC address
or DUID of the interface. Devices such as laptops that connect to both wired and wireless networks have
different MAC addresses or DUIDs and different DHCID values for each interface. In this scenario, after either
one of the network interfaces inserts a DNS record, updates are allowed from that interface only. This results in
a disruption of service for DDNS updates when roaming between wired and wireless networks.
• Migration: The second problem occurs during a migration from non-ISC based systems to ISC systems. For
example, if the user is migrating from a Microsoft-based system, the clients have A or AAAA and PTR records in
the DDNS updates but no TXT records. As a result, new DDNS updates fail after the migration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 925

Configuring DDNS Updates

• Mixed Environments: The final problem occurs in mixed ISC and non-ISC environments. For example, assume
that both Microsoft and ISC DHCP servers update DNS records on the appliance. Since the Microsoft DHCP
server does not insert the TXT records, updates from ISC-based systems fail while updates from the Microsoft
DHCP server are committed into the database.
The NIOS appliance offers four modes to handle DDNS updates as described in Figure 21.4 on page 926:

Figure 21.4 DDNS Update Verification Mode

If a Record at Lease Then TXT Record at

Mode Grant Lease Grant Lease Grant Action Lease Expire Action

Standard ISC Exists Must match Delete A or AAAA, Delete PTR

TXT if exists Delete A or AAAA,
Add A or AAAA TXT if TXT matches
Add PTR and no other A or
AAAA RRs
No A or AAAA record No check Add A or AAAA, TXT
Add PTR
Check TXT only Exists Must exist Delete A or AAAA, Delete PTR
TXT Delete A or AAAA if
Add A or AAAA, TXT TXT exists and no
Add PTR other A or AAAA RRs

No A or AAAA record No check Add A or AAAA, TXT

Add PTR
ISC Transitional Exists No check Delete A or AAAA, Delete PTR
TXT if exists Delete A or AAAA,
Add A or AAAA, TXT TXT if TXT matches
Add PTR and no other A or
AAAA RRs
No A or AAAA record No check Add A or AAAA, TXT
Add PTR
No TXT record Exists No check Delete A or AAAA Delete PTR, A or
Add A or AAAA AAAA
Add PTR
No A or AAAA record No check Add A or AAAA
Add PTR

Depending on your expected usage, you must carefully consider the various options for update verification. The
following section illustrates recommendations for each verification option:
• Standard ISC: This method is the most stringent option for verification of updates. This is the default.
• ISC Transitional: This method is useful during migrations from systems that do not support the TXT record to
systems that are ISC-based.
• Check TXT only: This method is useful for the roaming laptop scenario. The NIOS appliance checks that a TXT
record exists, but does not check the value of the TXT record.
• No TXT record: This method should be used with caution because anyone can send DDNS updates and
overwrite records. This method is useful when both ISC and non-ISC-based DHCP servers and clients are
updating the same zone. Infoblox recommends that you allocate a DNS zone for this authentication method, as
a precaution.

926 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Servers for DDNS

Note: In certain situations, when a DHCP lease expires, the DHCP server might remove the TXT record even if there is
no A or AAAA record.

You can enable this feature at the Grid level. To configure TXT record handling on the DHCP server:
1. From the Data Management tab, select the DHCP tab, expand the Toolbar and click Grid DHCP Properties.
2. In the IPv4 DDNS -> Advanced tab or the IPv6 DDNS -> Advanced tab, select one of the following from the TXT
(DHCID) Record Handling drop-down list:
— Check Only: Select this check box to enable minimal checking of DDNS updates. Specifically, A or AAAA
records are modified only if a TXT record exists. The NIOS appliance checks that a TXT record exists, but
does not check its value.
— ISC: Select this check box to enable standard ISC (Internet Systems Consortium) handling for DDNS
updates. Specifically, A or AAAA records are modified or deleted only if the TXT records match. This option is
the default setting on the appliance.
— ISC Transitional: Select this check box to enable less stringent handling of DDNS updates. Specifically, the
NIOS appliance enables you to add or modify A or AAAA records whether or not TXT records exist. It checks
whether a TXT record exists and then processes the update. If the appliance does not find a TXT record, it
adds the record.
— No TXT Record: Select this check box to disable TXT record checking. Specifically, A or AAAA records are
added, modified, or deleted whether or not the TXT records match. No TXT records are added, and existing
TXT records are ignored.
3. Save the configuration and click Restart if it appears at the top of the screen.

Configuring DNS Servers for DDNS

For security reasons, an Infoblox DNS server does not accept DDNS updates by default. You must specify the sources
from which you want to allow the DNS server to receive updates. You can configure the Infoblox DNS server to receive
updates from specified DHCP clients, as described in Enabling DNS Servers to Accept DDNS Updates, and to accept
forwarded updates from another DNS server, as described in Forwarding Updates on page 929.
For protection against spoofed IP addresses, you can use TSIG (transaction signatures) to authenticate and verify
updates.
TSIG uses the MD5 (Message Digest 5) algorithm and a shared secret key to create an HMAC (hashed message
authentication code)—sometimes called a digital fingerprint—of each update. Both the DHCP server sending the
update and the DNS server receiving it must share the same secret key. Also, it is important that the time stamps on
the TSIG-authenticated updates and update responses be synchronized, or the participants reject them. Therefore,
use an NTP server to set the time on all systems involved in TSIG authentication operations.
The TSIG key that you use can come from several places:
• You can use the key generation tool described in this section to create a new TSIG key to authenticate updates
from the DHCP server.
• You can enter (copy and paste) a TSIG key that you previously generated for another purpose, such as for zone
transfers.
• If the DHCP server is on a separate appliance and a TSIG key was previously generated on that appliance, you
can enter (copy and paste) that TSIG key onto the local DNS server.
The TSIG key name and value that the DHCP and DNS servers use must be the same.

Note: Whether you deploy NIOS appliances in a Grid or independently, they send updates to UDP port 53. Grid
members do not send updates through a VPN tunnel. Grid members do, however, authenticate updates
between them using TSIG (transaction signatures) based on an internal TSIG key.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 927

Configuring DDNS Updates

Enabling DNS Servers to Accept DDNS Updates

You can configure the Infoblox DNS server to receive updates from specified DHCP clients only. You can set this for
the Grid so that the Grid members receive DDNS updates only from the specified sources. Note that you specify the
IP addresses of the sources of the updates and not the actual IP addresses in the DNS records being updated.
To configure the DNS server to accept updates from the specified sources:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
Zones: From the Data Management tab, select the DNS tab and click the Zones tab-> dns_view -> zone check box
-> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the editor, click Toggle Advanced Mode, select the Updates tab.

Note: Ensure that you understand how the appliance handles match lists before you specify the list of IP sources
for DDNS updates, as described in Managing the Order of Match Lists on page 489.

3. In the Allow updates from section, select one of the following:

— None: Select this to deny DDNS updates from all DHCP clients. This is selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this option, the appliance receives DDNS
updates from the sources that have the Allow permission in the named ACL. You can click Clear to remove
the selected named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.
— IPv4 Address and IPv6 Address: Select this to add an IPv4 address or IPv6 address. Click the Value field
and enter the IP address. The Permission column displays Allow by default. You can change it to Deny
by clicking the field and selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.
— TSIG Key: In the Add TSIG Key panel, complete the following, and then click Add to add the TSIG key to
the list:
• Key name: Enter a meaningful name for the key, such as a zone name or the name of a remote
name server. This name must match the name of the same TSIG key on other name servers.
• Key Algorithm: Select either HMAC-MD5 or HMAC-SHA256.
• Key Data: To use an existing TSIG key, type or paste the key in the Key Data field. Alternatively, you
can select the key algorithm, select the key length from the Generate Key Data drop down list, and
then click Generate Key Data to create a new key.

Note: You must enable GSS-TSIG signed updates to receive DDNS updates from TSIG key based ACEs. For
information about how to enable this, see Accepting GSS-TSIG Updates on page 957.

928 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNS Servers for DDNS

— Any Address/Network: Select this to receive DDNS updates from any IP addresses.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
— Allow GSS-TSIG signed updates: This check box is selected only if you have enabled GSS-TSIG signed
updates.
4. Optionally, you can:
— Modify an item on the list by selecting it and clicking the Edit icon.
— Remove an item from the list by selecting it and clicking the Delete icon.
— Move an item up or down the list. Select it and drag it to its new position, or click the up or down arrow. The
appliance applies permissions to items in the order they are listed.
5. Save the configuration.

Forwarding Updates
When a secondary DNS server receives DDNS updates, it must forward the updates to the primary server because it
cannot update zone data itself. In such situations, you must enable the secondary server to receive updates from the
DHCP server, and then forward them to the primary DNS server.
To configure the secondary server to accept and forward updates for all zones:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
Zones: From the Data Management tab, select the DNS tab and click the Zones tab-> dns_view -> zone check box
-> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. In the editor, click Toggle Advanced Mode.
3. When the additional tabs appear, click the Advanced subtab of the Updates tab, and then complete the
following:
— Allow secondary name servers to forward updates: Select this check box.
— Forward updates from: This is available only for authoritative zones. Click Add. Depending on the item that
you select, Grid Manager either adds a row for the selected item or expands the panel so you can specify
additional information about the item you are adding, as follows:
— None: Select this to deny DDNS updates from any clients. This is selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL. Grid Manager displays the
Named ACLs Selector. Select the named ACL you want to use. If you have only one named ACL, Grid
Manager automatically displays the named ACL. When you select this option, the appliance receives DDNS
updates from the sources that have the Allow permission in the named ACL. You can click Clear to remove
the selected named ACL.
— Set of ACEs: Select this to configure individual ACEs. Click the Add icon and select one of the following from
the drop-down list. Depending on the item you select, Grid Manager either adds a row for the selected item
or expands the panel so you can specify additional information about the item you are adding, as follows.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 929

Configuring DDNS Updates

— IPv4 Address and IPv6 Address: Select this to add an IPv4 address or IPv6 address. Click the Value field
and enter the IP address. The Permission column displays Allow by default. You can change it to Deny
by clicking the field and selecting Deny from the drop-down list.
— IPv4 Network: In the Add IPv4 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv4 network address and either type a netmask or move the slider to the
desired netmask.
• Permission: Select Allow or Deny from the drop-down list.
— IPv6 Network: In the Add IPv6 Network panel, complete the following, and then click Add to add the
network to the list:
• Address: Enter an IPv6 network address and select the netmask from the drop-down list.
• Permission: Select Allow or Deny from the drop-down list.
— TSIG Key: In the Add TSIG Key panel, complete the following, and then click Add to add the TSIG key to
the list:
• Key name: Enter a meaningful name for the key, such as a zone name or the name of a remote
name server. This name must match the name of the same TSIG key on other name servers.
• Key Algorithm: Select either HMAC-MD5 or HMAC-SHA256.
• Key Data: To use an existing TSIG key, type or paste the key in the Key Data field. Alternatively, you
can select the key algorithm, select the key length from the Generate Key Data drop down list, and
then click Generate Key Data to create a new key.

Note: You must enable GSS-TSIG signed updates to receive DDNS updates from TSIG key based ACEs. For
information about how to enable this, see Accepting GSS-TSIG Updates on page 957.

— Any Address/Network: Select to allow or disallow the appliance to receive DDNS updates from any IP
address.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to consolidate and put into a new named ACL. Click the Create new
named ACL icon and enter a name in the Convert to Named ACL dialog box. The appliance creates a
new named ACL and adds it to the Named ACL panel. Note that the ACEs you configure for this
operation stay intact.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an ACE and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
4. Save the configuration and click Restart if it appears at the top of the screen.

Supporting Active Directory

Active Directory™ (AD) is a distributed directory service that authenticates network users and—by working with DHCP
and DNS—provides the location of and authorizes access to services running on devices in a Windows® network.
You can integrate a NIOS appliance providing DHCP and DNS services with servers running Windows 2000 Server,
Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server
2012 R2 with the Active Directory service installed. Assuming that you already have AD set up and it is currently in
use, you can migrate DHCP and DNS services away from internal operations on the AD domain controller or from other
third party DHCP and DNS systems to NIOS appliances that serve DHCP and DNS.
A NIOS appliance providing DHCP and DNS services to an AD environment can send and receive DDNS updates. In
addition, a NIOS appliance can use GSS-TSIG (Generic Security Service-Transaction Signatures) authentication for
DDNS updates. The basic DHCP, AD, and DNS services are shown in Figure 21.5.

930 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About GSS-TSIG

Figure 21.5 DHCP, Active Directory, and DNS

Infoblox
DHCP Server
TCP/IP Network Note: For clarity, the DHCP
Configuration Requests and DNS servers are shown
1 on separate appliances. A
single appliance can also
provide both services.

AD (Active Directory) Server and

Kerberos Server (for GSS-TSIG)

AD/Kerberos
Connections
Infoblox
DNS Server
Clients

3
DNS Queries
and
DDNS Updates

Sending DDNS Updates to a DNS Server

You can configure an Infoblox DHCP server to send unauthenticated or GSS-TSIG-authenticated DDNS updates to a
DNS server in an AD domain. There are no special configurations to consider when configuring a NIOS appliance to
send unauthenticated DDNS updates to the DNS server. (For information about configuring DHCP, see Chapter 26,
Configuring DHCP Properties, on page 1069; and for information on configuring the DHCP server to send DDNS
updates, see Configuring DHCP for DDNS on page 915.) For information about configuring a DHCP server to send
GSS-TSIG authenticated updates, see About GSS-TSIG on page 931.

About GSS-TSIG
GSS-TSIG (Generic Security Service Algorithm for Secret Key Transaction) is used to authenticate DDNS updates. It is
a modified form of TSIG authentication that uses the Kerberos v5 authentication system.
GSS-TSIG involves a set of client/server negotiations to establish a “security context.” It makes use of a Kerberos
server (running on the AD domain controller) that functions as the KDC (Kerberos Key Distribution Center) and
provides session tickets and temporary session keys to users and computers within an Active Directory domain. The
client and server collaboratively create and mutually verify transaction signatures on messages that they exchange.
Windows 2000 server, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server
2012, and Windows Server 2012 R2 all support DDNS updates using GSS-TSIG.
You can configure the appliance to accept GSS-TSIG signed DDNS updates from a single client or multiple clients that
belong to different AD domains in which each domain have a unique GSS-TSIG key. You can also configure the
appliance to support one or multiple GSS-TSIG keys for each Grid member. For information about how to configure
GSS-TSIG for DHCP and DNS, see Configuring GSS-TSIG keys on page 944. This feature also supports HA pairs and is
compatible with DNS zones that have multiple primary servers configured. For more information about HA pairs and
DNS zones with multiple primary servers, see About HA Pairs on page 282 and Assigning Zone Authority to Name
Servers on page 839 respectively.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 931

Configuring DDNS Updates

You can upload keytab files that contain one or multiple GSS-TSIG keys and manage the keys globally. NIOS supports
up to 256 GSS-TSIG keys for each member in the Grid. NIOS logs administrative changes to GSS-TSIG keys in the audit
log and failures in parsing or loading the keytab files in the syslog. Note that this feature is enabled only when you
have installed the DNS license.

Note: For information about GSS-TSIG, see RFC 3645, Generic Security Service Algorithm for Secret Key Transaction
Authentication for DNS (GSS-TSIG).

A NIOS appliance can use GSS-TSIG authentication for DDNS updates for either one of the following:
• A NIOS appliance serving DHCP can send GSS-TSIG authenticated DDNS updates to a DNS server in an AD
domain or multiple AD domains whose domain controller is running Windows Server 2003, Windows Server
2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2. The DNS server can be in
the same AD domain as the DHCP server or in a different domain.
— For information about sending secure DDNS updates to a DNS server in the same domain, see Sending
Secure DDNS Updates to a DNS Server in the Same Domain on page 933.
— For information about sending secure DDNS updates to a DNS server in a different domain, see Sending
Secure DDNS Updates to a DNS Server in Another Domain on page 941
• A NIOS appliance serving DNS can accept GSS-TSIG authenticated DDNS updates from DHCP clients and servers
in an AD domain or multiple AD domains whose domain controller is running Windows 2000 Server, Windows
Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012
R2.
— For information, see Accepting GSS-TSIG-Authenticated Updates on page 951.

Note: A NIOS appliance cannot support both of these features at the same time.

Kerberos Authentication for GSS-TSIG

A keytab file contains pairs of Kerberos principal names and their corresponding encryption keys. It can contain keys
for a single realm or multiple realms. It is possible to infer the KDC from the principal because Windows uses
uppercase AD domain names for Kerberos realm names. You must provide the principal name. The principal name
may contain Kerberos realm, and the DNS servers for the domain are available for DNS name resolution. Therefore,
resolving SRV _kerberos._tcp.REALM. will return the appropriate KDC. New TGTs cannot be acquired when the KDC
that issues the TGT fails. If the appliance has successfully authenticated before the KDC failure, the secure updates
will continue until the session key and TGT expire. The default expiration on Windows is 10 hours. If the appliance
restarts or reboots, secure updates are deferred until the KDC becomes available.
Infoblox recommends restarting the DHCP service on NIOS to avoid any update failures, if the encryption key type is
changed on the Microsoft server.
The following provides information about the traffic flow between the appliance and the KDC:
• Client uses keytab to get TGT for principal from KDC (AS-REQ/AS-REP).
• Client uses TGT to get session ticket from KDC (TGS-REQ/TGS-REP).
• Client uses session ticket to acquire TKEY from DNS server (TKEY/TKEY).
• Client uses TKEY to sign DNS updates (DNS-TSIG/DNS-TSIG).
The DNS server authenticates into the domain when the keytab file is generated on the KDC and its SPN (Service
Principal Name) is mapped to an account. The server’s private key is known to itself and to the KDC. The KDC
generates the ticket and the DNS server allows the update.
Note the following when you upload multiple keytab files on the appliance:
• NIOS displays an error message and discards the keytab file if the file does not have a recognizable key, SPN,
version or encryption type, and it saves the error message in the syslog.
• NIOS considers duplicate keys as invalid keys if the keys have the same SPN, version, and encryption type.
• If NIOS encounters an invalid key during an upload, it will not upload the other keys in the keytab and the
operation fails. NIOS saves the warning and error message in the syslog and in Grid Manager.

932 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About GSS-TSIG

Sending Secure DDNS Updates to a DNS Server in the Same Domain

An Infoblox DHCP server can send GSS-TSIG authenticated DDNS updates to a DNS server in an AD domain whose
domain controller is running Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows
Server 2012, or Windows Server 2012 R2. The DHCP server, DNS server, and domain controller are all in the same AD
domain. The process by which an Infoblox DHCP server dynamically updates resource records on a DNS server using
GSS-TSIG authentication is shown in Figure 21.6. In the illustration, the Kerberos Key Distribution Center (KDC) is
running on an AD domain controller, which also provides DNS service.

Figure 21.6 An Infoblox DHCP Server Sends GSS-TSIG Updates to a DNS Server

DHCP Client DHCP Server AD Domain Controller

AD Member Kerberos Server
DNS Server
Kerberos 1 a
b
c
d

2 a
TKEY Negotiations
(GSS Handshake) b

DHCP 3 a
b

DDNS 4 c1 c2
Update
c3

After you enable the NIOS appliance to send GSS-TSIG authenticated updates to a DNS server, the following process
occurs:
1. Kerberos – Login, and TGT and Service Ticket Assignments
a. The Infoblox appliance automatically logs in to the AD/Kerberos server.
b. The Kerberos server sends the appliance a TGT (ticket-granting ticket).
c. Using the TGT, the appliance requests a service ticket for the DNS server.
d. The Kerberos server replies with a service ticket for that server.
2. TKEY negotiations (GSS Handshake):
a. The appliance sends the DNS server a TKEY (transaction key) request. A Transaction Key record establishes
shared secret keys for use with the TSIG resource record. For more information, see RFC 2930, Secret Key
Establishment for DNS (TKEY RR).
The request includes the service ticket. The service ticket includes the appliance’s principal and proposed
TSIG (transaction signature) key, along with other items such as a ticket lifetime and a timestamp.
b. The DNS server responds with a DNS server-signed TSIG, which is a “meta-record” that is never cached and
never appears in zone data. A TSIG record is a signature of the update using an HMAC-MD5 hash that
provides transaction-level authentication. For more information, see RFC 2845, Secret Key Transaction
Authentication for DNS (TSIG).

NIOS 7.3 NIOS Administrator Guide (Rev. A) 933

Configuring DDNS Updates

The two participants have established a security context.

When a DHCP client sends a request for an IP address to the DHCP server, the following occurs:
3. DHCP – IP Address and Network Parameters Assignment
a. The DHCP client requests an IP address.
b. The DHCP server assigns an IP address, subnet mask, gateway address, DNS server address, and a domain
name.
After the appliance assigns an IP address to the DHCP client, it sends the DDNS update to the DNS server as
follows:
4. DDNS – Dynamic Update of the Client’s Resource Records
c. GSS-TSIG-Authenticated DDNS Update
1. The appliance sends an authenticated DDNS update, which may include the following resource
records:
• A or AAAA – Address record
or
PTR – Pointer record
• TKEY – Transaction Key record
• TSIG – TSIG record
2. The DNS server verifies the DDNS update and allows it to complete.
3. The DNS server sends a GSS-TSIG-authenticated response to the appliance, confirming the update.

Configuring DHCP to Send GSS-TSIG Updates in the Same Domain

Before configuring an Infoblox DHCP server to support GSS-TSIG, you must create a user account on the Kerberos
server for the appliance. Then you must export the corresponding keytab file from the Kerberos server and import it
onto the NIOS appliance. Figure 21.7 illustrates the initial configuration tasks.

Figure 21.7 Adding an Infoblox DHCP Server to an AD Environment with GSS-TSIG Support

1 Add a user account for the 2 Generate the keytab file for the
Keytab
Infoblox DHCP server. DHCP server account and export it
File
from the Kerberos server to a local
User Account directory on your management
system. Administrator’s
Management
System

AD (Active Directory)
Kerberos Server 3 Import the keytab file to
DNS Server the NIOS appliance.

4 Enable GSS-TSIG updates.

corp100.com

AD DNS
Zones

The DHCP server sends Infoblox

1.1.10.in-addr.arpa 6
GSS-TSIG dynamic DNS DHCP Server
updates to the DNS
server.
5 The DHCP server assigns
IP addresses to DHCP
clients that send requests
for IP addresses.

934 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About GSS-TSIG

The Infoblox DHCP server can send GSS-TSIG-signed DDNS updates to a DNS server for one domain only, though
multiple Infoblox DHCP servers can update that domain. If you want more than one Infoblox DHCP server to update a
DNS domain, you can either import the same keytab file to the other Infoblox DHCP servers or generate and import a
different keytab file. In a Grid, each member can update a different domain.

Note: For GSS-TSIG authentication to work properly, the system clock times of the Infoblox DHCP server, AD domain
controller and DNS server must be synchronized. One approach is to use NTP and synchronize all three devices
with the same NTP servers.

To use an AD domain controller as a Kerberos Key Distribution Center, complete the following tasks on an
AD/Kerberos server:
1. Add a user account for the NIOS appliance to the AD domain controller. For information, see Creating an AD User
Account on page 935.
2. Generate the keytab file for the NIOS appliance account and export it from the AD domain controller to a local
directory on your management system. For information, see Generating and Exporting the Keytab File on page
935.
To configure a NIOS appliance to support AD and send GSS-TSIG secure DDNS updates to a DNS server, complete the
following tasks on a NIOS appliance:
1. Import the keytab file from your management system to the appliance and enable GSS-TSIG dynamic updates at
the Grid or member level. For information, see Enabling GSS-TSIG Authentication for DHCP on page 945.
2. Configure the appliance to send GSS-TSIG dynamic updates to forward-mapping and optionally, reverse-mapping
zones on the DNS server. For information, see Managing GSS-TSIG keys on page 948.

Creating an AD User Account

Connect to the AD domain controller and create a user account for the NIOS appliance.

Note: The name that you enter in the User logon name is the name that you later use when exporting the keytab
file. This is also the principal name. The text in the First name, Initials, Last name, and Full name fields is
irrelevant to this task.

The AD domain controller automatically creates a Kerberos account for this user. Note the following:
• If you define an expiration date for the user account and you later create a new account when the first one
expires, the keytab for the corresponding Kerberos account changes. At that point, you must update the keytab
file on the NIOS appliance (see Generating and Exporting the Keytab File and Enabling GSS-TSIG Authentication
for DHCP on page 945). Optionally, if your security policy allows it, you can set the user account for the NIOS
appliance so that it never expires.
• If the AD domain controller is running Windows Server 2003, the user account must have the DES encryption
type enabled. You can enable this either in the Account tab of the AD domain controller when you create the
user account or by specifying +DesOnly when you use the Ktpass tool to generate the keytab file. For
instructions, see the next section, Generating and Exporting the Keytab File.

Generating and Exporting the Keytab File

You can use the Ktpass tool to generate and export the keytab file for the Kerberos account. Note that the version of
the Ktpass tool that you use must match the Windows version of the domain controller. For example, if you are using
a domain controller running Windows Server 2008 or Windows Server 2008 R2, Windows Server 2012, or Windows
Server 2012 R2, you must use the Ktpass tool for Windows Server 2008, Windows Server 2008 R2, Windows Server
2012, or Windows Server 2012 R2.
You enter different commands for generating and exporting the keytab file, depending on whether you are generating
the keytab file from a server running Microsoft Windows 2000, Windows Server 2003, Windows Server 2008,
Windows Server 2008 R2, Windows Server 2010, Windows Server 2012, or Windows Server 2012 R2.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 935

Configuring DDNS Updates

A Windows Server 2003 domain controller allows you to generate a keytab file with only one key for a principal. A
Windows Server 2008, Windows Server 2008 R2 domain controller, Windows Server 2012 or Windows Server 2012
R2 allows you to generate a keytab file with multiple keys for one principal. This is useful when the KDC has principals
with multiple encryption types. When the NIOS DHCP server uses a keytab with multiple keys, it negotiates a key
based on those in the configured keytab file.

Note: The keytab file contains highly sensitive data for the NIOS appliance account. Ensure that you store and
transport its contents securely.

Infoblox strongly recommends the following encryption types for compatibility purposes:

Microsoft Windows Server Export keytab

Microsoft Windows 2000 Specify /crypto DES-CBC-MD5 as the export keytab.
Microsoft Windows 2003 Specify /crypto RC4-HMAC-NT as the export keytab.
• You can also use AES, but RC4 is set by default for Windows
2003 servers.
• Infoblox recommends that you do not use DES, but it is
supported if you need it for compatibility with non-Windows
systems.
Microsoft Windows 2008 and higher Specify /crypto all as the export keytab.
• You can also use AES or RC4.
• Note that DES is not enabled by default on Windows Server
2008 and higher. You must enable DES in order to include it in
the crypto all keytab. Infoblox recommends that you
include DES for maximum compatibility, though you can still
select non-DES crypto.
• Infoblox recommends that you do not use only DES as the
export keytab.

Generating the Keytab on Windows 2000 Servers

To export the keytab file using a Microsoft Windows 2000 Resource Kit:
1. Start a command prompt.
2. Enter the following command to export the keytab file for the NIOS appliance user account:
C:> ktpass -princ service_name/FQDN_instance@REALM -mapuser AD_username -pass password -out
filename.keytab

Note: The values are case-sensitive.

where:
— service_name/instance: The AD user name for the NIOS appliance and a character string. The AD user
name must match the user logon name on the AD domain controller.
— REALM: The Kerberos realm in uppercase. It must match the realm (or domain name) specified in the 
–mapuser option.
For example:
C:> ktpass -princ DNS/[email protected] -mapuser [email protected] -pass 37Le37
-out ns1.keytab

936 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About GSS-TSIG

Generating the Keytab on Windows Servers 2003

The Ktpass tool is included in the Windows Server 2003 Support Tools. To export the keytab file using a Microsoft
Windows 2003 Resource Kit:
1. Start a command prompt.
2. Enter the following command to generate the keytab file for the NIOS appliance user account:
ktpass -princ service_name/FQDN_instance@REALM -mapuser AD_username@REALM -pass password -out
filename.ktb -ptype KRB5_NT_PRINCIPAL -crypto des-cbc-md5 +DesOnly

Note: The values are case-sensitive.

Example:
ktpass -princ DNS/[email protected] -mapuser [email protected] -pass 37Le37 -out
ns1.ktb -ptype KRB5_NT_PRINCIPAL -crypto des-cbc-md5 +DesOnly
where
-princ = Kerberos principal. Note that this parameter is case sensitive. Specifies the principal name for the host
or service in this format: DNS/[email protected]
— DNS = Service name in uppercase format.
— ns1.corp100.com = Instance in FQDN (fully-qualified domain name) format; this is the same as the DNS
name of the NIOS appliance.
— GSS.LOCAL = The Kerberos realm in uppercase format. This must be the same as the AD domain name.
-mapuser = Maps the Kerberos principal name to the AD user account. If you omit the account name, mapping is
deleted from the specified principal. You can use ksetup without any parameters or arguments to see the
current mapped settings and the default realm. Example: ksetup /mapuser <Principal> <Account>. To
create an AD user account, see Creating an AD User Account on page 935.
— jsmith = The AD user name for the NIOS appliance.
— GSS.LOCAL = The Kerberos realm in uppercase. The realm (or domain name) must be the same as that
specified in the -princ option.
-pass = The AD user account password. The Ktpass command changes the account password to the specified
value, thus incrementing the version number of the user account and the resulting keytab file.
— 37Le37 = The password of the user account for the NIOS appliance.
-out = The name of the keytab file that is generated.
— ns1.ktb = The name of the keytab file
-ptype = Sets the principal type. This must be krb5_nt_principal.
-crypto = Specifies the encryption type. This must be des-cbc-md5. DES-CBC-MD5 adheres to the MIT
implementation and is used for compatibility.
+DesOnly = Specifies DES encryption for the account. This is set by default on the Windows Server 2008.
Include this if you did not enable DES encryption for the account. Note that Windows 7 and Windows Server
2008 R2 do not support DES by default.

Note: Note that the Windows Server 2003 does not support AES encryption.

After you execute the command to generate the keytab file, the AD domain controller displays a series of messages
similar to the following to confirm that it successfully generated the keytab file:
Targeting domain controller: ibtest-xu5nxd56.corp100.local
Using legacy password setting method
Successfully mapped dns/anywhere to dns.
Key created.
Output keytab to dns.ktb:
Keytab version: 0x502
keysize 56 dns/[email protected] ptype 1 (KRB5_NT_PRINCIPAL) vno 5 etype
0x3 (DES-CBC-MD5) keylength 8 (0xbae610f11552c80b)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 937

Configuring DDNS Updates

Generating the Keytab on Windows Servers 2008 or Windows Servers 2008 R2

On a Windows Server 2008 or Windows Server 2008 R2 domain controller, the Ktpass tool supports generating a
keytab file with multiple keys for a single principal. Infoblox strongly recommends that one of the keys include the
encryption type DES-CBC-MD5 for compatibility purposes. Most principals use DES-CBC-MD5 and it is the most
compatible encryption type with other systems, such as MIT Kerberos. To generate the keytab file using the Ktpass
tool:
1. Start a command prompt.
2. Enter the following command to generate the keytab file for the NIOS appliance user account:
ktpass -princ username@REALM -mapuser logon_name@REALM -pass password -out my.tab -ptype
krb5_nt_principal -crypto encryption
Example:
ktpass -princ DNS/[email protected] -mapuser [email protected] -pass 37Le37 -out
ns1.keytab -ptype krb5_nt_principal -crypto RC4-HMAC-NT
where:
-princ = Kerberos principal. Note that this parameter is case sensitive. Specifies the principal name for the host
or service in this format: DNS/[email protected]
— DNS = Service name in uppercase format.
— ns1.corp100.com = Instance in FQDN (fully-qualified domain name) format; this is the same as the DNS
name of the NIOS appliance.
— GSS.LOCAL = The Kerberos realm in uppercase format. This must be the same as the AD domain name.
-mapuser = Maps the Kerberos principal name to the AD user account. If you omit the account name, mapping is
deleted from the specified principal. You can use ksetup without any parameters or arguments to see the
current mapped settings and the default realm. Example: ksetup /mapuser <Principal> <Account>. To
create an AD user account, see Creating an AD User Account on page 935.
— jsmith = The AD user name for the NIOS appliance.
— GSS.LOCAL = The Kerberos realm in uppercase. The realm (or domain name) must be the same as that
specified in the -princ option.
-pass = The AD user account password. The Ktpass command changes the account password to the specified
value, thus incrementing the version number of the user account and the resulting keytab file.
— 37Le37 = The password of the user account for the NIOS appliance.
-out = The name of the keytab file that is generated.
— ns1.ktb = The name of the keytab file
-ptype = Sets the principal type. This must be krb5_nt_principal.
-crypto = Specifies the encryption type. Note that the RC4-HMAC-NT encryption type is enabled by default. You
can also use the following:
-crypto: all or -crypto RC4-HMAC-NT
You can optionally specify the following:
+DesOnly = Specifies DES encryption for the account. You must use this only when you use DES-CBC-MD5 for
compatibility. Note that Windows 7 and Windows Server 2008 R2 do not support DES by default. However, you
can enable DES on the Windows 2008 server. Include this option if you did not enable DES encryption for the
account. For more information, refer to the information available in a third-party portal at:
http://weblogic-wonders.com/weblogic/2010/11/30/windows-7-des-encryption-support-for-kerberos-authen
tication/

Note: You must not use +Desonly with /crypto all or other non-DES encryption types.

+setpass = Sets a new AD user account password. This is required if the +DesOnly option is specified. When you
use this encryption type, you must change the user’s password. Otherwise, the ticket issued for the principal
becomes unusable.

938 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About GSS-TSIG

After you execute the command to generate the keytab file, the AD domain controller displays a series of messages
similar to the following to confirm that it successfully generated the keytab file:
Targeting domain controller: qacert.test.local
Using legacy password setting method
Successfully mapped DNS/ns1.corp100.com to ns1.
Key created.
Output keytab to ns1.ktb:
Keytab version: 0x502
keysize 80 DNS/[email protected] ptype 1 (KRB5_NT_PRINCIPAL) vno 3 etype 0x12
(AES256-SHA1)
keylength 32 (0xea8675d7abf13fd760a744088642fb917ceb6c9d267f5c54e595597846f06407)

Generating the Keytab on Windows Servers 2012 or Windows Server 2012 R2

On a Windows Server 2012 domain controller, the Ktpass tool supports generating a keytab file with multiple keys for
a single principal. Infoblox recommends that one of the keys include the encryption type DES-CBC-MD5 for
compatibility purposes. Note that you must enable DES and then export using the /crypto all keytab. Most
principals use DES-CBC-MD5 and it is the most compatible encryption type with other systems, such as MIT Kerberos.
To generate the keytab file using the Ktpass tool:
1. Start a command prompt.
2. Enter the following command to generate the keytab file for the NIOS appliance user account:
ktpass -princ username@REALM -mapuser logon_name@REALM -pass password -out my.tab -ptype
krb5_nt_principal -crypto encryption
Example:
ktpass -princ DNS/[email protected] -mapuser [email protected] -pass 37Le37 -out
ns1.keytab -ptype krb5_nt_principal -crypto all
where:
-princ = Kerberos principal. Note that this parameter is case sensitive. Specifies the principal name for the host
or service in this format: DNS/[email protected]
— DNS = Service name in uppercase format.
— ns1.corp100.com = Instance in FQDN (fully-qualified domain name) format; this is the same as the DNS
name of the NIOS appliance.
— GSS.LOCAL = The Kerberos realm in uppercase format. This must be the same as the AD domain name.
-mapuser = Maps the Kerberos principal name to the AD user account. If you omit the account name, mapping is
deleted from the specified principal. You can use ksetup without any parameters or arguments to see the
current mapped settings and the default realm. Example: ksetup /mapuser <Principal> <Account>. To
create an AD user account, see Creating an AD User Account on page 935.
— jsmith = The AD user name for the NIOS appliance.
— GSS.LOCAL = The Kerberos realm in uppercase. The realm (or domain name) must be the same as that
specified in the -princ option.
-pass = The AD user account password. The Ktpass command changes the account password to the specified
value, thus incrementing the version number of the user account and the resulting keytab file.
— 37Le37 = The password of the user account for the NIOS appliance.
-out = The name of the keytab file that is generated.
— ns1.ktb = The name of the keytab file
-ptype = Sets the principal type. This must be krb5_nt_principal.
-crypto = Specifies the encryption type. You can specify the following encryption types:
— DES-CBC-CRC = Specifies DES encryption for the account. This encryption type is used for compatibility.
— DES-CBC-MD5 = Specifies DES encryption for the account. This encryption type adheres to the MIT
implementation and is used for compatibility.
— RC4-HMAC-NT = Specifies 128-bit RC4-HMAC encryption for the account. This is enabled by default.
— AES256-SHA1 = Specifies 256-bit AES encryption for the account.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 939

Configuring DDNS Updates

— AES128-SHA1 = Specifies 128-bit AES encryption for the account.

— ALL = Specifies all of the above encryption types. Infoblox recommends that you use the /crypto all
encryption type.
After you execute the command to generate the keytab file, the AD domain controller displays a series of messages
similar to the following to confirm that it successfully generated the keytab file:
Targeting domain controller: qacert.test.local
Using legacy password setting method
Successfully mapped DNS/ns1.corp100.com to ns1.
Key created.
Output keytab to ns1.keytab:
Keytab version: 0x502
keysize 80 DNS/[email protected] ptype 1 (KRB5_NT_PRINCIPAL) vno 3 etype 0x12
(AES256-SHA1)
keylength 32 (0xea8675d7abf13fd760a744088642fb917ceb6c9d267f5c54e595597846f06407)

Creating an External Zone for GSS-TSIG Updates

For each network view, you specify the zone to be updated, the IP address of the primary DNS server for that zone,
and the security method, GSS-TSIG. The zone must be in the same AD domain as the member that is sending the
updates.
You can add information for a forward and reverse zone. The DHCP server updates the A record in the forward zone
and the PTR record in the reverse zone.
To enable the NIOS appliance to send dynamic updates to a DNS server using GSS-TSIG for authentication:
1. If there are multiple network views in the Grid, select a network view.
2. From the Data Management tab, select the DHCP tab, expand the Toolbar and click Configure DDNS.
3. In the DDNS Updates to External Zones table of the DDNS Properties editor, click the Add icon and complete the
following fields in the Add External DDNS Zone panel:
— Zone Name: Enter the name of the zone that receives the updates. You can specify both forward-mapping
and reverse-mapping zones.
— DNS Server Address: Enter the IP address of the primary name server for that zone.
— Security: Select GSS-TSIG.
— AD Domain: Select the AD domain associated with the keytab file.
— DNS Principal: The name and domain of the DNS server receiving the DDNS updates. Note that this is
not the same as the Kerberos principal you specified when you generated the keytab file.
Use the following format when you complete this field: DNS/dns_server_fqdn@ad_domain
dns_server_fqdn: This is the FQDN of the DNS server. You can use the “dig” command to perform a DNS
lookup to obtain the FQDN of the DNS server as it appears on the SOA record.
ad_domain: This is the AD domain of the DNS server.
— Click Test GSS-TSIG to list the Grid members that are allowed to send GSS-TSIG updates to the DNS
server.
4. Save the configuration and click Restart if it appears at the top of the screen.

Verifying the Configuration

After you configure the AD domain controller and the Infoblox DHCP server, you can view the syslog of the Infoblox
DHCP server to verify if it successfully established a security context with the AD domain controller. The DHCP server
displays a series of messages similar to the following:
dhcpd: Enabled GSS-TSIG for zone corp100. using principal jdoe/[email protected].
dhcpd: GSS-TSIG security thread has started.
dhcpd: GSS-TSIG security update starting at 1222389338.
dhcpd: Acquiring GSS-TSIG credential for jdoe/[email protected].
dhcpd: Acquired GSS-TSIG credential for jdoe/[email protected](good for 3568s).

940 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About GSS-TSIG

dhcpd: Security context established with server 10.34.123.4 for principal

jdoe/[email protected] (good for 568s).
dhcpd: GSS-TSIG security update complete at 1222389338. Next update in 360s.
In addition, you can log in to the Infoblox CLI and use the show dhcp_gss_tsig CLI command to troubleshoot your
configuration. For information about this command, refer to the Infoblox CLI Guide.

Sending Secure DDNS Updates to a DNS Server in Another Domain

Domain and forest trust relationships provide clients authenticated access to resources in other domains. Some
trusts are automatically created, such as the two-way, direct trust between parent and child domains in a forest. Other
trusts must be created manually. Refer to the Microsoft Active Directory documentation for information on
establishing trusts between domains.
Once a direct trust exists between two AD domains, a KDC from one domain can grant a referral to the KDC of the other
domain. The Infoblox DHCP server can then use the referral to request access to services in the other domain.
In Figure 21.8, the Infoblox DHCP server in the child.corp100.com domain needs to send GSS-TSIG authenticated
DDNS updates to the DNS server in its parent domain, corp100.com domain. There is an automatic two-way trust
between the domains because corp100.com domain is the parent of child.corp100.com domain.

Figure 21.8 Sending Secure DDNS Updates to a DNS Server in Another Domain

ib.child.corp100.com ad.child.corp100.com
DHCP Server Kerberos Server
AD Domain Controller

2 ad.corp100.com
Kerberos Server
AD Domain Controller

3 ns1.corp100.com
DNS Server
10.23.2.24

After you configure the Infoblox DHCP server and AD domain controller, the following occurs:
1. Kerberos – In Same Domain
The Infoblox DHCP server uses the TGT (ticket-granting ticket) from the AD/Kerberos server,
ad.child.corp100.com, to request a service ticket for DNS/[email protected]. The Kerberos
server replies with a referral ticket for the Kerberos server in the corp100.com domain, ad.corp100.com.
2. Kerberos — In the Other Domain
The Infoblox DHCP server uses the referral ticket and requests a service ticket from ad.corp100.com for
DNS/[email protected]. The Kerberos server replies with a service ticket for
DNS/[email protected].
3. TKEY Negotiations (GSS Handshake)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 941

Configuring DDNS Updates

The Infoblox DHCP server sends the DNS server ns1.corp100.com a TKEY (transaction key) request, which
includes the service ticket. The DNS server replies with a TKEY response that includes a TSIG (transaction
signature). The Infoblox appliance and the DNS server have established a security context, enabling the DHCP
server to send DDNS updates to the DNS server.

Configuring DHCP to Send GSS-TSIG Updates to Another Domain

Before the DHCP server can send secure DDNS updates to a DNS server in a different domain, you must ensure that
a direct trust relationship exists between the domain of the DHCP server and that of the DNS server. (For information,
refer to the Active Directory documentation.)
Following are the tasks to configure the AD domain controller and the Infoblox DHCP server for secure updates to
another domain. All the configuration is done on the AD domain controller for the domain of the DHCP server and on
the Infoblox DHCP server.:
1. Complete the following tasks on the AD domain controller for the domain of the DHCP server:
a. Add a user account for the Infoblox DHCP server. In the configuration example, the user account is ibdhcp.
For information, see Creating an AD User Account on page 935.
b. Generate the keytab file for the Infoblox DHCP server and export it from the AD domain controller to a local
directory on your management system. For the DHCP server in Figure 21.8, the principal is
ibdhcp/[email protected]. For information, see Generating and Exporting the
Keytab File on page 935.
2. Complete the following tasks on the Infoblox DHCP server:
a. Import the keytab file from your management system to the appliance and enable GSS-TSIG dynamic
updates at the Grid or member level. For information, see Enabling GSS-TSIG Authentication for DHCP on
page 945.
b. Configure the external forward-mapping zone for the DDNS updates. Note that the DNS principal uses the
domain of the DNS server, regardless of the domain of the DHCP server. For the DNS server in Figure 21.8,
the DNS principal is DNS/[email protected]. For information, see Managing GSS-TSIG keys
on page 948.

Configuration Example
Following are the steps to configure the example shown in Figure 21.8:
On the AD domain controller:
1. Create a user account for the Infoblox DHCP server. The user account is ibdhcp.
2. Generate the keytab file and export it to your management system. If the domain controller is running Windows
Server 2003:
ktpass -princ ibdhcp/[email protected] -mapuser
[email protected] -pass infoblox -out ibdhcp.ktb -ptype krb5_nt_principal -crypto
des-cbc-md5 +desonly
On the Infoblox DHCP server:
1. Enable GSS-TSIG at the member level.
2. From the DHCP tab, click the Members tab -> member check box -> Edit icon.
3. In the DDNS -> Basic tab of the editor, complete the following:
— Override: Select this check box.
— DDNS Updates: Select the Enable DDNS Updates check box.
— GSS-TSIG: Select Override and complete the following:
— Enable GSS-TSIG Updates: Select this check box.
— Domain Controller: Enter ad.child.corp100.com. This is the KDC in the domain of the DHCP server.
— GSS-TSIG Key: Click Manage Keytab Files. In the Keytab File Manager dialog box, click the Add icon. Click
Browse, navigate to the keytab file, select it, and then click Upload.

942 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About GSS-TSIG

Select the keytab file that you just uploaded, ibdhcp/[email protected].

— Domain: The appliance displays the name of the domain associated with the key, which is
child.corp100.com.
— Click Test GSS-TSIG to list the external zones to which the Grid member can send secure DDNS updates.
4. Save the configuration and click Restart if it appears at the top of the screen.
5. Configure the external forward mapping zone, corp100.com.
a. From the DHCP tab, expand the Toolbar and click Configure DDNS.
b. In the DNS Updates to External Zones table of the DDNS Properties editor, click the Add icon and complete
the following fields in the Add External DDNS Zone panel:
— Zone Name: Enter corp100.com.
— DNS Server Address: Enter the IP address of the primary DNS server to which the Infoblox DHCP server
sends DDNS updates. In the example, the DNS server is ns.corp100.com. Therefore, enter its IP address,
which is 10.23.2.24.
— Security: Select GSS-TSIG.
— AD Domain: Select child.corp100.com.
— DNS Principal: Enter DNS/[email protected].
— Click Test GSS-TSIG to list the Grid members that are allowed to send GSS-TSIG updates to the DNS
server.
6. Save the configuration and click Restart if it appears at the top of the screen.

Sending GSS-TSIG Updates to a DNS Server in Another Forest

The Infoblox DHCP server can also send secure DDNS updates to a DNS server that belongs to a domain in another
forest, as long as a forest trust exists. Refer to the Microsoft Active Directory documentation for information on
establishing forest trusts.
Similar to the authentication process between domains, the authentication process between forests also uses
referrals. The appliance follows the referral chain until it reaches the domain controller of the domain in which the
service is located. Note that forest trusts are not transitive. For example, if the DHCP server is in forest A and the DNS
server is in forest C, a direct trust must exist between forest A and forest C for the DDNS updates to succeed. Having
a trust between forest A and B, and between forest B and C is not sufficient.
In Figure 21.9, a trust exists between the A.Local forest and the B.Local forest. The Infoblox DHCP server in the A.Local
forest needs to dynamically update the DNS server in the B.Local forest.

Figure 21.9 Sending Secure DDNS Updates to a DNS Server in Another Forest

A.Local Forest B.Local Forest

ib.child.corp100.com
DHCP Server

ad.child.corp100.com
Kerberos Server
AD Domain Controller
ad.corp200.com ns1.corp200.com
Kerberos Server DNS Server
AD Domain Controller
ad.corp100.com
Kerberos Server
AD Domain Controller

NIOS 7.3 NIOS Administrator Guide (Rev. A) 943

Configuring DDNS Updates

The following authentication process occurs:

1. Kerberos – In Same Domain
The Infoblox appliance uses the TGT (ticket-granting ticket) from the AD/Kerberos server, ad.child.corp100.com,
to request a service ticket for DNS/[email protected]. The Kerberos server does not find the
principal name in its domain database and after consulting the global catalog, it replies with a referral ticket for
its parent domain.
2. Kerberos — Referral Chain
The appliance contacts a domain controller in corp100.com and requests a referral to a domain controller in the
corp200.com domain in B.Local Forest.
When it receives the referral, the DHCP server contacts the domain controller and requests a service ticket for
the DNS server, ns1.corp200.com. The domain controller replies with a service ticket for
DNS/[email protected].
3. TKEY Negotiations (GSS Handshake)
The Infoblox appliance sends the DNS server ns1.corp200.com a TKEY (transaction key) request, which includes
the service ticket. The DNS server replies with a TKEY response that includes a TSIG (transaction signature). The
Infoblox appliance and the DNS server have established a security context.

Configuring DHCP to Send GSS-TSIG Updates to a Different Forest

Configuring the Infoblox DHCP server for dynamic updates to a DNS server in another forest is similar to the
configuration used to send dynamic updates to another domain in the same forest. For information, see Configuring
DHCP to Send GSS-TSIG Updates to Another Domain on page 942.

Configuring GSS-TSIG keys

You can upload keytab files that contain a single GSS-TSIG key or multiple GSS-TSIG keys on a single NIOS appliance.
For each member in the Grid, you can upload up to 256 GSS-TSIG keys in a single keytab file. Trust relationships
between AD domains and AD forests are not required. You can upload GSS-TSIG keys through Grid Manager or the
Infoblox API.
Note that only superusers can manage all GSS-TSIG keys globally on a given member through Grid Manager or the
Infoblox API. Using this feature, superusers can determine the keys that belong to a particular member. You can
assign multiple GSS-TSIG keys to a member and all these keys are saved in the Grid. The uploaded keys will be
available in the member DNS, Grid DNS, member DHCP or Grid DHCP properties. NIOS supports the following
GSS-TSIG encryption types:
• des-cbc-crc
• des-cbc-md5
• arcfour-hmac-md5
• aes128-cts-hmac-sha1-96
• aes256-cts-hmac-sha1-96
NIOS displays a warning message in Grid Manager and in the syslog if you upload a key that does not belong to the
GSS-TSIG encryption types. For more information, see Logging Messages on page 948.

944 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring GSS-TSIG keys

Limitations when Using Multiple GSS-TSIG keys

• You can assign SPNs belonging to different domains to a DNS member, but you cannot assign SPNs belonging
to different domains to a DHCP member, although two DHCP members can update the same DNS member.
• You must ensure that the domains assigned to a DNS member are unique.
• The GSS-TSIG domain for a remote forward or remote reverse zone is single-valued. For example, if DHCP clients
ABC and XYZ from Grid 1 want to send DDNS updates to Grid 2, either client ABC or XYZ will succeed.

Scheduled Upgrade
A scheduled upgrade with one or more keys in the keytab files that you have uploaded will operate the same as prior
to upgrade. NIOS will parse and extract keys from the uploaded keytab file. NIOS automatically assigns these keys to
the DNS member, DHCP member, Grid DHCP or Grid DNS to which the keytab file was uploaded before the upgrade.
You can assign these keys to Grid members after the upgrade is complete.
NIOS does not display an error message if the keys do not have an SPN with the DNS prefix, but it will record a warning
message in the syslog.

Admin Permissions for Configuring GSS-TSIG keys

You can assign a key to a Grid member only if you have read permission for the kerberos key and read/write
permission for the member. You can upload keys only if you have read/write permissions for kerberos keys. To remove
a key that is assigned to a member, you must have read/write permission for the respective member.
Note that in the Administration -> Administrators -> Permissions tab, NIOS displays All Kerberos Keys and Kerberos
Key in the Resource and Resource Type columns respectively for DHCP Admin and DNS Admin roles with default
read/write permissions.

Enabling GSS-TSIG Authentication for DHCP

You can enable GSS-TSIG authentication at the Grid or member level and associate it with one or more keys of the
same SPN or realm. When you enable GSS-TSIG authentication, make sure that you upload the keytab file from the
Kerberos account for the Infoblox DHCP server. You can import keytab files with multiple keys to the Grid or to
individual members. You can assign the uploaded keys to member DHCP or Grid DHCP. The appliance displays a
warning message if you assign a GSS-TSIG key with service class “DNS” in its SPN to a DHCP member. For more
information about GSS-TSIG keys, see Configuring GSS-TSIG keys on page 944.
The appliance displays an error message in the following cases:
• if you assign keys of different realms to a DHCP member or Grid DHCP.
• when you try to enable GSS-TSIG without a valid key.
The AD domain controller stores the keytab file in the directory in which you generated the keytab file. You can copy
this file to a management system that connects to the NIOS appliance or launch the NIOS Grid Manager on the AD
domain controller and import the keytab file to the NIOS appliance.
To enable GSS-TSIG authentication for DHCP and import keytab files:
1. Grid: From the Data Management tab, select the DHCP tab, expand the Toolbar and click Grid DHCP Properties.
Member: From the Data Management tab, select the DHCP tab and click the Members tab -> member check box
-> Edit icon. To override an inherited property, click Override next to it and complete the appropriate fields.
Standalone DHCP: From the Data Management tab, select the DHCP tab, expand the Toolbar and click System
DHCP Properties.
2. In the IPv4 DDNS -> Basic tab or the IPv6 DDNS -> Basic tab of the editor, complete the following:
— DDNS Updates: Select Enable DDNS Updates to enable the DHCP servers in the Grid to send DDNS updates.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 945

Configuring DDNS Updates

— DDNS Domain Name: Specify the domain name of the network that the appliance uses to update DNS. For
IPv4 clients, you can specify this at the network, network template, range, and range template levels. For
IPv6 clients, you can specify this at the Grid, member, network, shared network, and network template
levels.
— DDNS Update TTL: You can set the TTL used for A record and PTR records updated by the DHCP server. The
default is shown as zero. If you do not enter a value here, the appliance by default sets the TTL to half of the
DHCP lease time with a maximum of 3600 seconds. For example, a lease time of 1800 seconds results in a
TTL of 900 seconds, and a lease time of 86400 seconds results in a TTL of 3600 seconds.
— GSS-TSIG: Complete the following:
— Enable GSS-TSIG Updates: Select this to enable the DHCP server to send GSS-TSIG authenticated DDNS
updates.
— Manage Keytab Files: To upload a keytab file, click Manage GSS-TSIG keys. In the Manage GSS-TSIG
Keys dialog box, click the Add icon. In the Upload dialog box, click Select, navigate to the keytab file,
select it, and then click Upload. You can also delete individual keys. For more information about
managing GSS-TSIG keys, see Managing GSS-TSIG keys on page 948.
— Domain Controller: Enter the resolvable host name or IP address of the AD domain controller that hosts
the KDC for the domain.
— Principal: The principal member of the key. For GSS-TSIG based DDNS updates, the SPN of the key used
to carry out the update does not require the server class ‘DHCP.’ You can either specify an FQDN or an IP
address for the <host> of an SPN.
— GSS-TSIG Key: Select the name of the GSS-TSIG key from the drop-down list that you want the Grid to
use. This is only available if you have uploaded a keytab file. Click the arrow beside the Add icon to
either assign keys or upload and assign keys. You can either select Assign Keys or Upload&Assign Keys
from the drop-down list.
• Assign Keys: Select Assign Keys to select a GSS-TSIG key from the GSS-TSIG Key Selector. Click
Principal, which is displayed as a hyperlink, to select it. For more information about the GSS_TSIG
Key Selector, see Selecting Keys in the GSS-TSIG Key Selector on page 949.
• Upload&Assign Keys: Select Upload&Assign Keys to upload and assign keys. In the Upload dialog
box, select the file and navigate to the file you want to upload. Click Upload. The appliance assigns
the keys contained in the selected keytab file.
— The following are displayed in the table:
• Version: The version of the key.
• Encryption type: The encryption type of the key.
• Last update: The timestamp when the key was uploaded.
— Zones this member can update securely: Click Display to list the external zones to which the Grid member
can send secured DDNS updates.
— Lease Renewal Update: Select Update DNS on DHCP Lease Renewal to enable the DHCP server to update
DNS when a DHCP lease is renewed.
3. Save the configuration and click Restart if it appears at the top of the screen.

Deleting GSS-TSIG keys associated with DHCP Objects

You can delete individual keys if it is not in use by the Grid or any member. To delete a key that is assigned to a
member, you must have Read/Write permission for the member. To delete individual keys:
1. Grid: From the Data Management tab, select the DHCP tab, expand the Toolbar and click Grid DHCP Properties.
Member: From the Data Management tab, select the DHCP tab and click the Members tab -> member check box
-> Edit icon.
Standalone DHCP: From the Data Management tab, select the DHCP tab, expand the Toolbar and click System
DHCP Properties.

946 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring GSS-TSIG keys

2. In the IPv4 DDNS tab or the IPv6 DDNS -> Basic tab of the editor, select keys from the list under GSS-TSIG Keys
and click the Delete icon to delete keys.

Enabling GSS-TSIG Authentication for DNS

For GSS-TSIG based DDNS updates, the SPN of the key used to carry out the update must have ‘DNS’ in its service
class. You can upload a keytab file to the Grid with multiple keys in which each key has an SPN in this format:
DNS/<host>@<realm>. You can associate a DNS member or a Grid DNS with one or more keys of the same SPN or
realm or of different SPN or realms. You can assign the uploaded keys to member DNS or Grid DNS, but NIOS displays
an error when you try to enable GSS-TSIG without a valid key if the assigned key does not have the service class ‘DNS’
in its SPN.
To enable GSS-TSIG authentication for DNS and import keytab files:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon. To override an inherited property, click Override next to it and complete the appropriate fields.
Standalone DNS: From the Data Management tab, select the DNS tab, expand the Toolbar and click System DNS
Properties.
2. In the GSS-TSIG -> Basic tab of the editor, complete the following:
— GSS-TSIG: Select Enable GSS-TSIG authentication of clients to accept GSS-TSIG signed DDNS updates from
clients that belong to different AD domains in which each domain has an unique GSS-TSIG key.
— Manage Keytab Files: To upload a keytab file, click Manage GSS-TSIG keys. In the Manage GSS-TSIG Keys
dialog box, click the Add icon. In the Upload dialog box, click Select, navigate to the keytab file, select it,
and then click Upload. You can also delete individual keys. For more information, see Managing GSS-TSIG
keys on page 948.
— GSS-TSIG Keys: Click the arrow beside the Add icon to either assign keys or upload and assign keys. You can
either select Assign Keys or Upload&Assign Keys from the drop-down list.
— Assign Keys: Select Assign Keys to select a GSS-TSIG key from the GSS-TSIG Key Selector. Click
Principal, which is displayed as a hyperlink, to select it. For more information about the GSS_TSIG Key
Selector, see Selecting Keys in the GSS-TSIG Key Selector on page 949.
— Upload&Assign Keys: Select Upload&Assign Keys to upload and assign keys. In the Upload dialog box,
select the file and navigate to the file you want to upload. Click Upload. The appliance assigns keys in
the uploaded file.
The following are displayed:
— Principal: The principal member of the key. For GSS-TSIG based DDNS updates, the SPN of the key used
to carry out the update must have DNS in its service class. It is of the following form:
DNS/<host>@<realm>
You can either specify an FQDN or an IP address for the <host> of an SPN.
— Domain: The domain name assigned to the DNS member.
— Version: The version of the key.
— Encryption type: The encryption type of the key.
— Last update: The timestamp when the key was uploaded.
3. Save the configuration.
NIOS sorts the data in the table based on the last updated timestamp, by default. Note that sometimes GSS-TSIG
updates might stop working after you restart the DNS service because the appliance discards the GSS-TSIG keys,
when you restart the DNS service. If this happens, wait several minutes until the Microsoft server performs another
handshake using the new key.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 947

Configuring DDNS Updates

Deleting GSS-TSIG keys associated with the DNS Objects

You can delete individual keys if it is not in use by the Grid or any member. To delete a key that is assigned to a
member, you must have Read/Write permission for the member. To delete individual keys:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
Standalone DNS: From the Data Management tab, select the DNS tab, expand the Toolbar and click System DNS
Properties.
2. In the GSS-TSIG -> Basic tab of the editor, select keys from the list under GSS-TSIG Keys.
3. Click the Delete icon to delete.

Logging Messages
The appliance saves the audit log entries for insert and delete operations. If you upload keys with encryption types
other than the ones that NIOS supports, the appliance displays a warning message in Grid Manager and in the syslog
and also it displays the encryption type as other in Grid Manager and in the syslog. For more information about the
syslog, see Using a Syslog Server on page 1334.
The appliance generates an audit log when you upload a key, assign the key to a member, remove the key associated
with a member or delete a key. The audit log entries are based on each key that you have uploaded. For example,
NIOS saves the following in the audit log when you upload a key:
2014-02-14 18:17:30.531Z [admin]: imported DNS Kerberos key for
principal='DNS/[email protected]', version=5, enctype=des-cbc-crc
For more information about audit logs, see Using the Audit Log on page 1344. You can search Kerberos keys using
the realm (domain), principal name or an encryption type.
The appliance generates a comment in the option section of the DNS configuration file for each Kerberos principal
that is associated with the Grid member. These comments are for information only and it indicates the principals,
their versions and encryption types that are used by the appliance.

Managing GSS-TSIG keys

You can upload a keytab file that contains one or multiple GSS-TSIG keys and delete multiple keys through the
Manage GSS-TSIG Keys wizard. To manage multiple GSS-TSIG keys, complete the following:
1. From the Grid tab, select the Grid Manager tab -> Members tab, expand the Toolbar and click Manage GSS-TSIG
Keys.
2. In the Manage GSS-TSIG Keys wizard, the following are displayed:
— Principal: The principal name that is mapped to the keytab file.
— Domain: The name of the domain that is mapped to the keytab file.
— Version: The version of the keytab file.
— In use: Indicates whether the keytab file is in use or not.
— Members: The members associated with the keytab file. Click the hyperlink and the Members dialog box is
displayed. It displays the list of members that are associated with the keytab file.
— Encryption type: The encryption type of the key.
— Last update: The timestamp when the key was last uploaded.
3. Click the Upload Keytab File icon to upload a new keytab file. In the Upload dialog box, click Select and navigate
to the keytab file. Click Upload to upload the file.
To delete a GSS-TSIG key, select the appropriate key and click the Delete icon.

948 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accepting DDNS Updates from DHCP Clients

Selecting Keys in the GSS-TSIG Key Selector

NIOS displays the keys that you have uploaded using the keytab files. You can choose a filter and an operator to view
specific keys that you have uploaded. The GSS-TSIG Key Selector wizard is displayed only when you select Assign
Keys in the Properties editor. For more information about how to assign keys to DNS and DHCP objects, see Enabling
GSS-TSIG Authentication for DNS on page 947 and Enabling GSS-TSIG Authentication for DHCP on page 945
respectively.
To select a key from the GSS-TSIG Key Selector, complete the following:
1. Click Show Filter to filter the values:
— Select a value from the drop-down list to filter your values: Domain, Encryption type, In use, Last update,
Principal, and Version.
— Select one of these operators from the drop-down list: equals, does not equal, begins with, and does not
begin with.
— Enter the value that you want to search in the text box.
Click Hide Filter to hide the filter. Alternatively, you can enter a value in the text box for Find and click Go to
search specific keys from the keytab files.
2. The following details are displayed in the table:
— Principal: The principal name that is mapped to the keytab file. Click Principal to assign the key to the DNS
or DHCP object.
— Domain: The name of the domain that is mapped to the keytab file.
— Version: The version of the keytab file.
— In use: Indicates whether the keytab file is in use or not.
— Members: The members associated with the keytab file.
— Encryption type: The encryption type of the key.
— Last update: The timestamp when the key was last uploaded.

Accepting DDNS Updates from DHCP Clients

A NIOS appliance serving DNS can support Active Directory and accept both unauthenticated and GSS-TSIG
authenticated updates from DHCP clients, DHCP servers, and AD domain controllers. The appliance supports servers
running Windows 2000 Server, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows
Server 2012, or Windows Server 2012 R2 with the Active Directory service installed.
When adding a NIOS appliance that serves DNS to an AD environment, you must configure the AD/Kerberos server
and NIOS appliance as follows—based on whether or not you want the DNS server to support DDNS updates using
GSS-TSIG authentication:
• AD/Kerberos Server
1. Enable zone transfers to the NIOS appliance.
2. (For GSS-TSIG) Create a user account for the NIOS appliance that it can use for authentication.
3. (For GSS-TSIG) Generate the keytab file of the DNS server and save it to your management system.
• NIOS Appliance
4. (GSS-TSIG) Enable GSS-TSIG support.
5. (GSS-TSIG) Import the keytab file of the DNS server from your management system to the NIOS appliance.
6. (GSS-TSIG) Enable GSS-TSIG authentication.
7. Add a forward-mapping zone and give it a name matching the AD DNS zone whose resource records you
want to import.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 949

Configuring DDNS Updates

8. Specify the domain controller from which the appliance can receive DDNS updates. An AD domain
controller replicates its data among other domain controllers within its AD domain and among domain
controllers in other domains.
9. Import zone data from the specified domain controller.
10. Enable the acceptance of DDNS updates from the AD domain controller and from the DHCP clients and
servers whose addresses the DHCP server assigns. You can set this at the Grid, member, and zone levels.
11. (For GSS-TSIG) Enable acceptance of GSS-TSIG DDNS updates from the AD domain controller and from the
addresses that the DHCP server assigns. You can set this at the Grid, member, and zone levels.
As you can see from the above task list, adding a NIOS appliance that serves DNS to an AD environment without
GSS-TSIG support involves four simple steps. To include GSS-TSIG support, there are several additional steps.

Supporting Active Directory and Unauthenticated DDNS Updates

Before configuring the NIOS appliance, configure the AD domain controller to permit zone transfers to the IP address
of the appliance. Then on the appliance, you can do the following to configure a forward-mapping zone to support AD
(Active Directory) and receive unauthenticated DDNS updates from DHCP clients, DHCP servers, and AD domain
controllers.
• Create a forward-mapping zone, as described in Creating an Authoritative Forward-Mapping Zone on page 830.
Give it a name that matches the AD DNS zone whose resource records you want to import.
• Specify the domain controllers from which the appliance can receive updates, as described in Configuring AD
Support on page 950
• Import the zone date from the domain controller. For information, see Importing Data into Zones on page 851.
• Enable the appliance to accept DDNS updates from the DHCP clients and servers whose addresses the DHCP
server assigns. You can set this at the Grid, member, and zone levels. For information, see Enabling DNS Servers
to Accept DDNS Updates on page 928.

Configuring AD Support
You can configure a forward-mapping zone to support AD from the Active Directory wizard or from the Active Directory
tab of the Authoritative Zone editor. This section describes both methods.
To configure AD support using the Active Directory wizard:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Configure Active Directory.
Note that from the Zones tab, you must select a zone before you click Configure Active Directory.
2. In the Active Directory wizard, complete the following, and then click Next:
— Select Zone: Click this and select a zone. The name of the zone must match the name in the AD domain
controller so the zone transfer from the AD domain controller to the NIOS appliance can succeed.
— Allow unsigned updates from Domain Controllers: Select this option.
If you have configured DNS resolvers in the Grid, the appliance sends DNS queries for the names and addresses
of the AD domain’s domain controllers. Since the name of the zone that you selected is the same as the AD
domain name on the domain controller, the appliance can then send a DNS query for the SRV records attached
to the domain name. It also sends a DNS query for the A record of each domain controller to determine its IP
address. The query results are listed in the next panel.
3. You can edit the list of domain controllers, if necessary. Click Next to proceed to the next step.
— To add a domain controller, click the Add icon and specify the IP address.
— To delete a domain controller from the list, select it and click the Delete icon.
4. Complete the following:
— Do you want to create underscore zones to hold the records added by the Domain Controllers?
This option allows the appliance to create the following subzones that the DNS server must have to answer
AD-related DNS queries:
_msdcs.zone

950 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accepting GSS-TSIG-Authenticated Updates

_sites.zone
_tcp.zone
_udp.zone
domaindnszones.zone
forestdnszones.zone
Note that these zones are automatically generated. You cannot edit these zones or import data into them.
They cannot be modified, thus providing protection against forged updates.
5. Save the configuration and click Restart if it appears at the top of the screen.
To configure AD support using the Authoritative Zone editor:
1. From the Data Management tab, select the DNS tab -> Zones tab -> zone check box -> Edit icon.
2. In the Authoritative Zone editor, select the Active Directory tab and do the following:
— Allow unsigned updates from these Domain Controllers: Select this check box and specify the AD domain
controllers from which the appliance can receive DDNS updates.
— Automatically create underscore zones: Select this check box to automatically create the subzones.
3. Save the configuration and click Restart if it appears at the top of the screen.
You can then import zone data, as described in Importing Data into Zones on page 851.

Accepting GSS-TSIG-Authenticated Updates

A NIOS appliance can support Active Directory and process secure GSS-TSIG-authenticated DDNS updates from DHCP
clients, DHCP servers, and AD domain controllers. The appliance supports servers running Windows 2000 Server,
Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server
2012 R2 with the Active Directory service installed. The process in which a DHCP client dynamically updates its
resource records on a DNS server using GSS-TSIG authentication is shown in Figure 21.10. The illustration also shows
the relationship of the clients, the DHCP server, the DNS server, and the Kerberos server (running on the AD domain
controller).

Note: For explanations of the alphanumerically notated steps in Figure 21.10, see the section following the
illustration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 951

Configuring DDNS Updates

Figure 21.10 Authenticating DDNS Updates with GSS-TSIG

DHCP Client DHCP Server AD (Active Directory) Server

AD Member DNS Server Kerberos Server

DHCP 1 a
b

Active 2 a
Directory
b

DNS 3 a
Query
b

Kerberos 4 a
b
c
d

a1
Unauthenticated DDNS
a2 Update Attempt (Refused)

b1
DDNS 5 TKEY Negotiations
Update b2 (GSS Handshake)

c1
c2 GSS-TSIG-Authenticated
DDNS Update (Accepted)
c3

1. DHCP – IP Address and Network Parameters Assignment

a. The DHCP client requests an IP address.
b. The DHCP server assigns an IP address, subnet mask, gateway address, and a DNS server address.
2. Active Directory – Computer and User Logins
a. The computer sends a DNS request to locate the AD domain controller, and then logs in to the domain
controller.

Note: Computer accounts have passwords that the AD domain controller and computer maintain automatically.
There are two passwords for each computer: a computer account password and a private key password.
By default, both passwords are automatically changed every 30 days.

b. The user manually logs in to a domain.

3. DNS – Query for the Kerberos Server
a. The computer (or client ) automatically sends a query for _kerberos._udp.dc_msdcs.dom_name to the DNS
server whose IP address it received through DHCP.
b. The NIOS appliance replies with the name of the Kerberos server.

952 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accepting GSS-TSIG-Authenticated Updates

4. Kerberos – Login, and TGT and Service Ticket Assignments

a. The client automatically logs in to the Kerberos server.
b. The Kerberos server sends the client a TGT (ticket-granting ticket).
c. Using the TGT, the AD member requests a service ticket for the DNS server.
d. The Kerberos server replies with a service ticket for that server.
5. DDNS – Dynamic Update of the Client’s Resource Records
a. Unauthenticated DDNS Update Attempt (Refused)
1. The client sends an unauthenticated DDNS update.
2. The DNS server refuses the update.
b. TKEY negotiations (GSS Handshake):
1. The client sends the DNS server a TKEY (transaction key) request. A Transaction Key record estab-
lishes shared secret keys for use with the TSIG resource record. For more information, see RFC
2930, Secret Key Establishment for DNS (TKEY RR).
The request includes the service ticket. The service ticket includes the appliance’s principal and
proposed TSIG (transaction signature) key, along with other items such as a ticket lifetime and a
timestamp.
2. The DNS server responds with a DNS server-signed TSIG, which is a “meta-record” that is never
cached and never appears in zone data. A TSIG record is a signature of the update using an HMAC-MD5
hash that provides transaction-level authentication. For more information, see RFC 2845, Secret Key
Transaction Authentication for DNS (TSIG).
The two participants have established a security context.
c. GSS-TSIG-Authenticated DDNS Update (Accepted)
1. The client sends an authenticated DDNS update, which includes the following resource records:
• A – Address record
or
PTR – Pointer record
• TKEY – Transaction Key record
• TSIG – TSIG record
2. The DNS server authenticates the DDNS update and processes it.
3. The DNS server sends a GSS-TSIG-authenticated response to the AD member, confirming the
update.

Note: For GSS-TSIG authentication to work properly, the system clock times of the Infoblox DHCP server, AD domain
controller and DNS server must be synchronized. One approach is to use NTP and synchronize all three devices
with the same NTP servers.

Configuring DNS to Receive GSS-TSIG Updates

You can configure an appliance to support Active Directory and accept secure DDNS updates from clients using
GSS-TSIG. The initial configuration tasks are shown in Figure 21.11. The appliance supports servers running Windows
2000 Server, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or
Windows Server 2012 R2 with the Active Directory service installed.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 953

Configuring DDNS Updates

Figure 21.11 Adding a NIOS Appliance to an AD Environment with GSS-TSIG Support

1 Add a user account 2 Generate the keytab file for the Keytab
for the DNS server. DNS server account and export it File
from the Kerberos server to a local Administrator’s
User Account directory on your management Management
system. System

AD (Active Directory)
Kerberos Server
3 Import the keytab file to
the NIOS appliance.

4 Create a forward-mapping
zone and import zone data NIOS
from the AD domain Appliance
controller.
Note: Make sure that zone
transfers from the AD domain
controller to the NIOS
appliance are enabled.
AD DNS Forward-
Zone corp100.com Import Zone Data corp100.com Mapping
Zone

5 Optional: Create a Reverse-

reverse-mapping 1.1.10.in-addr.arpa Mapping
zone. Zone

6 Enable GSS-TSIG updates.

On an already functioning AD domain controller:

1. Enable zone transfers to the NIOS appliance.
2. Add a user account for the NIOS appliance serving DNS. A corresponding account on the Kerberos server is
automatically created. For information, see Creating an AD User Account on page 955.
3. Export the keytab file for the NIOS appliance account from the Kerberos server to a local directory on your
management system. For information, see Generating and Exporting the Keytab File on page 955.
On an Infoblox appliance:
1. Import the keytab file from your management system to the Infoblox appliance and enable GSS-TSIG
authentication on the appliance. For information, see Importing the Keytab File and Enabling GSS-TSIG
Authentication on page 957.
2. Configure a forward-mapping zone with the same name as the AD zone. For information, see Creating an
Authoritative Forward-Mapping Zone on page 830.
3. (Optional) Create a reverse-mapping zone for the network address space that corresponds to the domain name
space in the forward-mapping zone. For information, see Creating an Authoritative Reverse-Mapping Zone on
page 830.
4. Import the zone data from the AD domain controller. For information, see Importing Zone Data on page 849.
5. Enable the acceptance of GSS-TSIG-signed updates from the AD controller and from the DHCP clients and servers
whose addresses the DHCP server assigns. For information, see Accepting GSS-TSIG Updates on page 957.

954 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accepting GSS-TSIG-Authenticated Updates

Creating an AD User Account

Connect to the AD domain controller and create a user account for the NIOS appliance.

Note: The name you enter in the User logon name is the name that you later use when exporting the keytab file.
This is also the principal name. The text in the First name, Initials, Last name, and Full name fields is
irrelevant to this task.

The AD domain controller automatically creates a Kerberos account for this user with an accompanying keytab. Note
the following:
• If you define an expiration date for the user account and you later create a new account when the first one
expires, the keytab for the corresponding Kerberos account changes. At that point, you must update the keytab
file on the NIOS appliance (see Generating and Exporting the Keytab File and Importing the Keytab File and
Enabling GSS-TSIG Authentication on page 957). Optionally, if your security policy allows it, you can set the
user account for the NIOS appliance so that it never expires.
• If the AD domain controller is running Windows Server 2003, the user account must have the DES encryption
type enabled. You can enable this either in the Account tab when you create the user account or by specifying
+DesOnly when you use the Ktpass tool to generate the keytab file.

Generating and Exporting the Keytab File

You can generate and export the keytab file for the Kerberos account by using the Ktpass tool. Note that the version
of the Ktpass tool that you use must match the Windows version of the domain controller. For example, if you are
using a domain controller running Windows Server 2008 or Windows Server 2008 R2, you must use the Ktpass tool
for Windows Server 2008 or Windows Server 2008 R2.
You enter different commands for generating and exporting the keytab file, depending on whether you are generating
the keytab file from a server running Microsoft Windows 2000, Windows Server 2003, Windows Server 2008, or
Windows Server 2008 R2.

Generating the Keytab on Windows 2000

To export the keytab file using a Microsoft Windows 2000 Resource Kit:
1. Start a command prompt.
2. Enter the following command to export the keytab file for the NIOS appliance user account:
C:> ktpass -princ service_name/FQDN_instance@REALM -mapuser AD_username -pass password -out
filename.keytab
For example:
C:> ktpass -princ DNS/[email protected] -mapuser [email protected] -pass 37Le37
-out ns1.keytab

Generating the Keytab on Windows Server 2003

The Ktpass tool is included in the Windows Server 2003 Support Tools. To export the keytab file using a Microsoft
Windows 2003 Resource Kit:
1. Start a command prompt.
2. Enter the following command to export the keytab file for the NIOS appliance user account:
ktpass -princ DNS/FQDN_instance@REALM -mapuser AD_username -pass password -out filename.keytab
-ptype KRB5_NT_PRINCIPAL -crypto des-cbc-md5 +DesOnly
For example:
ktpass -princ DNS/[email protected] -mapuser [email protected] -pass 37Le37 -out
ns1.keytab -ptype KRB5_NT_PRINCIPAL -crypto des-cbc-md5 +DesOnly
where:
-princ = Kerberos principal
— DNS = Service name in uppercase format

NIOS 7.3 NIOS Administrator Guide (Rev. A) 955

Configuring DDNS Updates

— ns1.corp100.com = Instance in FQDN (fully-qualified domain name) format; this is the same as the DNS
name of the NIOS appliance
— CORP100.COM = The Kerberos realm in uppercase format; this must be the same as the AD domain
name
-mapuser = Maps the Kerberos principal name to the AD user account
— [email protected] = The AD user name for the NIOS appliance
-pass = The AD user account password
— 37Le37 = The password of the user account for the NIOS appliance
-out = Exports the keytab file
— ns1.keytab = The name of the keytab file
-ptype = Sets the principal type. This must be krb5_nt_principal.
-crypto = Specifies the encryption type. This must be des-cbc-md5.
+DesOnly = Specifies DES encryption for the account. Include this if you did not enable DES encryption for the
account.

Generating the Keytab on Windows Server 2008/Windows Server 2008 R2

A Windows Server 2008 or Windows Server 2008 R2 domain controller allows you to generate a keytab file with
multiple keys for one principal. The Infoblox DNS server accepts GSS-TSIG updates from DHCP clients that provide a
Kerberos ticket for any of the keys in its configured keytab. To generate the keytab file using the Ktpass tool:
1. Start a command prompt.
2. Enter the following command to export the keytab file for the NIOS appliance user account:
ktpass -princ DNS/FQDN_instance@REALM -mapuser AD_username -pass password -out filename.keytab
-ptype krb5_nt_principal -crypto encryption
For example:
ktpass -princ DNS/[email protected] -mapuser [email protected] -pass 37Le37 -out
ns1.keytab -ptype krb5_nt_principal -crypto AES256-SHA1
where:
-princ = Kerberos principal
— DNS = Service name in uppercase format
— ns1.corp100.com = Instance in FQDN format; this is the same as the DNS name of the NIOS appliance
— CORP100.COM = The Kerberos realm in uppercase; this must be the same as the AD domain name
-mapuser = Maps the Kerberos principal name to the AD user account
— [email protected] = The AD user name for the NIOS appliance
-pass = The AD user account password
— 37Le37 = The password of the user account for the NIOS appliance
-out = Exports the keytab file
— ns1.keytab = The name of the keytab file
-ptype = Sets the principal type. This must be krb5_nt_principal.
-crypto = Specifies the encryption type.
After you execute the command to generate the keytab file, the AD domain controller displays a series of messages
similar to the following to confirm that it successfully generated the keytab file:
Targeting domain controller: qacert.test.local
Using legacy password setting method
Successfully mapped DNS/ns1.corp100.com to ns1.
Key created.
Output keytab to ns1.keytab:
Keytab version: 0x502
keysize 80 DNS/[email protected] ptype 1 (KRB5_NT_PRINCIPAL) vno 3 etype 0x12
(AES256-SHA1)
keylength 32 (0xea8675d7abf13fd760a744088642fb917ceb6c9d267f5c54e595597846f06407)

956 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Accepting GSS-TSIG-Authenticated Updates

Note: The keytab file contains highly sensitive data for the NIOS appliance account. Ensure that you store and
transport its contents securely.

Modifying an AD User Account

To change any AD user account information (login, password, etc):
1. Remove the previous user account from AD.
2. Create a new user for GSS-TSIG mapping.
3. Generate a new keytab file.
4. Import the keytab file to the DNS server.

Importing the Keytab File and Enabling GSS-TSIG Authentication

Before you can enable GSS-TSIG authentication, you must import the keytab file from the Kerberos account for the
NIOS appliance. To import the keytab file:
1. From the Data Management tab, select the DNS tab and click the Members tab -> member check box -> Edit icon.
2. In the Member DNS Properties editor, click Toggle Expert Mode.
3. When the additional tabs appear, click GSS-TSIG and do the following:
If a principal name and version number are listed, there is a keytab file loaded on the appliance. Compare this
information with that for the NIOS appliance account on the Kerberos server to make sure that they match. If
there is no keytab file on the NIOS appliance or if the loaded keytab file does not match that on the Kerberos
server, you must load the correct keytab file
— Click Upload, click Browse to navigate to the keytab file, and then click Upload.
— Enable GSS-TSIG authentication of clients: Select this check box.
4. Save the configuration and click Restart if it appears at the top of the screen.
Each time you export a keytab file from a Kerberos server running on Windows Server 2003, the version number of
the keytab file increases incrementally. Because the version number on the keytab file that you import to the NIOS
appliance must match the version that is in use on the Kerberos server, you should select the last keytab file that is
exported from the Kerberos server if you have exported multiple keytab files. (A Kerberos server running on Windows
2000 does not increase the version number of keytab files with each export.)

Accepting GSS-TSIG Updates

You can allow a Grid or specific members or zones to accept GSS-TSIG signed updates from domain controllers and
DHCP clients and servers, as follows:
1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box -> Edit icon.
Zone: From the Data Management tab, select the DNS tab -> Zones tab -> zone check box -> Edit icon.
To override an inherited property, click Override next to it and complete the appropriate fields.
2. Select the Updates tab and do the following in the Basic subtab:
— Allow GSS-TSIG signed updates: Select this option.
3. Save the configuration and click Restart if it appears at the top of the screen.
You can then use the Active Directory wizard or navigate to the Active Directory tab of the Authoritative Zone editor to
enable the appliance to create underscore zones for the records hosted by domain controllers and to allow GSS-TSIG
signed updates to the underscore zones.
To use the Active Directory wizard:
1. From the Data Management tab, select the DNS tab, expand the Toolbar and click Configure Active Directory.
2. In the Configure Active Directory wizard, complete the following, and then click Next:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 957

Configuring DDNS Updates

— Select Zone: Click this and select a zone. The name of the zone must match the name in the AD domain
controller so the zone transfer from the AD domain controller to the NIOS appliance can succeed.
— Allow GSS-TSIG-signed (secure) updates from Domain Controllers: Select this option.
3. Complete the following:
— Do you want to create underscore zones to hold the records added by the Domain Controllers?
This option allows the appliance to create the following subzones that the DNS server must have to answer
AD-related DNS queries:
_msdcs.zone
_sites.zone
_tcp.zone
_udp.zone
domaindnszones.zone
forestdnszones.zone
Note that these zones are automatically generated. You cannot edit these zones or import data into them.
— Allow GSS-TSIG-signed updates to underscore zones: Select this check box to allow underscore zones to
accept GSS-TSIG signed updates.
4. Save the configuration and click Restart if it appears at the top of the screen.
To use the Authoritative Zone editor:
1. From the Data Management tab, select the DNS tab -> Zones tab -> zone check box -> Edit icon.
2. In the Authoritative Zone editor, select the Active Directory tab and do the following:
— Allow unsigned updates from these Domain Controllers: Clear this check box.
— Automatically create underscore zones: (select)
This option automatically creates the following subzones that the DNS server must have to answer
AD-related DNS queries:
_msdcs.zone
_sites.zone
_tcp.zone
_udp.zone
domaindnszones.zone
forestdnszones.zone
Note that these zones are automatically generated and cannot be manually edited.
— Allow GSS-TSIG-signed updates to underscore zones: Select this check box to allow underscore zones to
accept GSS-TSIG signed updates.
3. Save the configuration and click Restart if it appears at the top of the screen.

958 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Secure Dynamic Updates

Secure Dynamic Updates

The secure dynamic updates feature provides several methods to restrict dynamic DNS updates to certain records.
This includes:
• Restrictions for updates to statics records. For more information, see Restricting Updates to Static Records on
page 959.
• Restrictions for updates to records marked as protected. For more information, see Restricting Updates to
Protected Records on page 960.
• Restrictions based on GSS-TSIG principal authentication. For more information, see Restricting Updates Based
on GSS-TSIG Principal Authentication on page 960.
• Restrictions based on FQDN patterns. For more information, see Restricting Updates Based on FQDN Patterns
on page 962.
Only static and dynamic record source type support secure dynamic updates. You can see the record source type in
the Resource Record Viewer. The following table shows which type of secure dynamic updates is applicable to
different record source types.

Table 21.1 Secure Dynamic Update Types

Secure Dynamic Update Type Record Source Type

Restrictions for updates to statics records Static
Restrictions for updates to protected records Static, dynamic
Restrictions based on GSS-TSIG principal authentication Dynamic
Restrictions based on FQDN patterns Static, dynamic

Failed attempts to dynamically update secured records are recorded in the NIOS syslog. You can view it, as described
in Viewing the Syslog on page 1341 and Searching in the Syslog on page 1343.
You can use Smart Folders to organize data by record source, principal, or protection state. For more information, see
Chapter 3, Smart Folders, on page 173.
In addition, you can use Global Search to search for records by principal name. For more information, see Using
Global Search on page 78.

Note: To use the secure dynamic updates feature, you must have a DNS license installed in the Grid Manager.

Restricting Updates to Static Records

This method prevents updates to all RRsets containing static records at once in the Grid, DNS view, or zone. To
prevent updates to specific static records, see Restricting Updates to Protected Records on page 960.
To restrict updates to all static records in the Grid, DNS view, or zone:
1. In the Grid DNS, view, or zone properties, click Updates -> Advanced.
2. To override the inherited properties, click Override.
3. Under Secure Dynamic Updates, select Prevent dynamic updates to RRsets containing static records.
4. Click Save & Close.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 959

Configuring DDNS Updates

Restricting Updates to Protected Records

You can restrict updates to the records of your choice, by marking them as protected. You can do this for both static
and dynamic records. The Resource Record Viewer displays the protection status of the records in the Protected
column: Yes or No.
You can protect the following record types:
• A record
• AAAA record
• CNAME record
• DNAME record
• MX record
• NAPTR record
• PTR record
• SRV record
• TXT record
• Host record
For all the above mentioned records except the host record, you can change the type from static to dynamic and back,
if required.
To restrict updates to protected records:
1. In the DNS Resource Records viewer, select a record or multiple records.
2. In the Toolbar, select Protect Records -> Enable Protection.
Or
In the properties dialog for a record, click Updates, select the Protected check box, and then click Save & Close.
3. Enable updates prevention at the corresponding level:
a. In the Grid DNS, view, or zone properties, click Updates -> Advanced.
b. If necessary, click Override to override the inherited properties.
c. Select Prevent dynamic updates to RRsets containing protected records.
d. Click Save & Close.

Restricting Updates Based on GSS-TSIG Principal Authentication

This method implies tracking the Kerberos GSS-TSIG principal that created a record and restricting DDNS updates
attempted by a different GSS-TSIG principal on this record.
The Resource Record Viewer displays the GSS-TSIG authentication information in the Principal column: it displays the
principal name if the client that created the record is authenticated and the principal is tracked.
The tracked principal is also displayed in the record properties. You can change the principal associated to a record
by clicking Select Principal in the record properties and specifying the required principal.
Additionally, you can use dynamic update groups to manage the allowed principals. For more information, see About
Dynamic Update Groups on page 961.
To restrict updates based on GSS-TSIG principal authentication:
1. In the Grid DNS, view, or zone properties, click Updates -> Advanced.
2. To override the inherited properties, click Override.
3. Under Secure Dynamic Updates, select Track the GSS-TSIG principals that create dynamic records.

Note: For this option to work, ensure that you have selected Enable GSS-TSIG authentication of clients in the
GSS-TSIG properties of the Grid or the corresponding zone or view.

960 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Secure Dynamic Updates

4. Select Require the appropriate GSS-TSIG principal to update RRsets that track principals.
5. Optionally, specify an active dynamic update group.
6. Click Save & Close.

About Dynamic Update Groups

In some cases, for example, in DHCP failover associations, you need to allow different GSS-TSIG principals to update
each other’s records. To that end, you can join multiple principals into clusters, where all principals are considered
as equivalent and therefore can update affected records without being their originators. You can join multiple clusters
into a dynamic update group. The clusters within a group, however, are not considered equivalent and cannot update
each other’s records.
When you have several dynamic update groups defined, you can assign different groups to be active for the Grid, a
DNS view, or a zone as described in Restricting Updates Based on GSS-TSIG Principal Authentication on page 960. If
no group is assigned, then no principals are considered to be equivalent.
For information on how to add dynamic update groups and clusters, see Managing Dynamic Update Groups and
Clusters on page 961.

Note: Viewing and modifying the configuration of a dynamic update group requires Grid DNS permissions. Selecting
a group as active for the Grid, a view, or a zone requires read permission on the Grid DNS, as well as write
permission on the object being modified.

Managing Dynamic Update Groups and Clusters

To add a dynamic update group:
1. In Data Management -> DNS, expand the Toolbar and click Manage Dynamic Update Groups.
2. Click the Add icon.
3. Select Add Dynamic Update Group.
4. Specify the group name.
5. Optionally, provide a comment.
6. Click Save and Close. Proceed to adding clusters to the group as described below.
To add a cluster:
1. In the Manage Dynamic Update Groups window, click the Add icon.
2. Select Add Cluster.
3. Select the dynamic update group in which you want to include the cluster.
4. Specify the cluster name.
5. Optionally, provide a comment.
6. Click Save and Close.
7. To add principals to the cluster, select the cluster in the Manage Dynamic Update Groups window and click the
Add icon. A principal can appear in multiple clusters.
8. Select one of the following:
— Add Principal: This adds a new row in the table. Specify the principal name in the row.
— Select Principal: This opens the Principal Selector dialog. Select the required principal from the list.
9. Click Close.
To edit or delete a group, cluster, or principal, select it in the Manage Dynamic Update Groups window, and click the
corresponding icon.
You can also export data about dynamic update groups, their clusters, and principals in the Infoblox CSV Import
format by clicking the Export icon in the Manage Dynamic Update Groups window. For more information, see
Exporting Data to Files on page 108.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 961

Configuring DDNS Updates

Restricting Updates Based on FQDN Patterns

This implies defining FQDN patterns for domain names which prevents DDNS updates to matching FQDNs.
To restrict updates based on FQDN patterns:
1. In the Grid DNS, view, or zone properties, click Updates -> Advanced.
2. To override the inherited properties, click Override.
3. Under Dynamic Update Patterns, select Prevent dynamic updates to FQDNs matching these patterns and specify
patterns:
— To add an FQDN pattern, click the Add icon and specify a pattern in the new table row.

Note: Use the DNS Traffic Control LBDN wild cards to specify FQDN patterns. For more information, see
Configuring LBDN Patterns on page 1022.

— To delete an FQDN pattern, select the check box next to the pattern and click the Delete icon.
4. Click Save & Close.

962 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 22 DNSSEC
This chapter provides general information about DNSSEC. The topics in this chapter include:
• About DNSSEC on page 965
— DNSSEC Resource Records on page 966
— DNSKEY Resource Records on page 966
— RRSIG Resource Records on page 968
— NSEC/NSEC3 Resource Records on page 969
— NSEC3PARAM Resource Records on page 970
— DS Resource Records on page 970
• Configuring DNSSEC on a Grid on page 971
• Enabling DNSSEC on page 973
• Setting DNSSEC Parameters on page 973
— About the DNSKEY Algorithm on page 974
— About Key Rollovers on page 974
— RRSIG Signatures on page 975
— Configuring DNSSEC Parameters on page 975
— Applying the Algorithm Changes on page 977
— Deleting the DNSSEC Keys Associated with a Zone on page 977
• Signing a Zone on page 978
• Managing Signed Zones on page 981
— Importing a Keyset on page 981
— Exporting Trust Anchors on page 981
— Checking Key-Signing Keys on page 982
— Rolling Key-Signing Keys on page 982
— Rolling Zone-Signing Keys on page 983
— Best Practices for Configuring Zone Signing Keys on page 983
— Unsigning a Zone on page 983
— Deleting and Restoring Signed Zones on page 984
— Configuring Automatic KSK Rollovers and Notifications on page 984
— Configuring NSEC3 Salt Length and Hashing Iterations on page 985
— Deleting Server Keys on page 986
— Configuring Emergency KSK Rollover on page 986
— Viewing Scheduled Tasks on page 987
• About HSM Signing on page 987

NIOS 7.3 NIOS Administrator Guide (Rev. A) 963

DNSSEC

— Configuring a SafeNet HSM Device on page 988

— Adding and Managing a Thales HSM Group on page 989
— Synchronizing the HSM Group on page 991
— Monitoring the HSM Group on page 990
— Enabling HSM Signing on page 991
• Configuring Grid Members to Support DNSSEC as Secondary Servers on page 991
• Enabling Recursion and Validation for Signed Zones on page 992
— Enabling Recursion and Validation for Signed Zones on page 992
— Enabling DNSSEC Validation on page 993
— Defining Negative Trust Anchors on page 994
• Applying Policies and Rules to DNS Queries that Request DNSSEC Data on page 995

964 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNSSEC

About DNSSEC
DNSSEC (DNS Security Extensions) provides mechanisms for authenticating the source of DNS data and ensuring its
integrity. It protects DNS data from certain attacks, such as man-in the middle attacks and cache poisoning. A
man-in-the middle attack occurs when an attacker intercepts responses to queries and inserts false records. Cache
poisoning can occur when a client accepts maliciously created data. DNSSEC helps you avoid such attacks on your
networks.
DNSSEC provides changes to the DNS protocol and additional resource records (RRs) as described in the following
RFCs:
• RFC 4033, DNS Security Introduction and Requirements
• RFC 4034, Resource Records for the DNS Security Extensions
• RFC 4035, DNSSEC Protocol Modifications
• RFC 4641, DNSSEC Operational Practices
• RFC 4956, DNS Security (DNSSEC) Opt-In
• RFC 4986, Requirements Related to DNS Security (DNSSEC) Trust Anchor Rollover
• RFC 5155, DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
• RFC 5702, Use of SHA-2 Algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC
DNSSEC uses public key cryptography to authenticate the source of DNS responses and to ensure that DNS responses
were not modified during transit. Public key cryptography uses an asymmetric key algorithm. With asymmetric keys,
one key is used to decrypt data that was encrypted using the other key.
In DNSSEC, the primary name server of a zone generates at least one public/private key pair. It “signs” each data set
in the zone by running it through a one-way hash, and then encrypting the hash value with the private key. The public
key is stored in an RR type introduced by DNSSEC, the DNSKEY RR. Resolvers use the DNSKEY record to decrypt the
hash value. If the hash values match, then the resolver is assured of the authenticity of the message.
In addition to the DNSKEY record, DNSSEC also introduces new RRs which DNS servers can use to authenticate the
non-existence of servers, zones, or resource records. For information about the DNSSEC resource records, see
DNSSEC Resource Records on page 966.
DNSSEC uses the EDNSO message extension. Resolvers include the EDNS OPT pseudo-RR with the DO (DNSSEC OK)
bit set to indicate that they are requesting DNSSEC records. A DNS client or resolver sets the EDNS DO bit when it
sends a query for data in a signed zone. When the DNS server receives such a query, it includes the additional
DNSSEC records in its response, according to the DNSSEC standard rules. In addition, because DNSSEC messages are
often large, the EDNSO message extension also provides mechanisms for handling larger DNS UDP messages. For
information about EDNS0, refer to RFC 2671, Extension Mechanisms for DNS (EDNS0). For information about the DO
bit, refer to RFC 3225, Indicating Resolver Support of DNSSEC.

WARNING: Note that when you disable EDNS0 on the appliance, all outgoing DNSSEC queries to zones within
trusted anchors will fail even if DNSSEC validation is enabled. To ensure that DNSSEC functions
properly, do not disable EDNS0 on the appliance. For more information, see Using Extension
Mechanisms for DNS (EDNS0) on page 761.

DNSSEC also supports new data in the packet header, the CD (Checking Disabled) bit and the AD (Authenticated Data)
bit. The CD bit is used by resolvers in their DNS queries and the AD bit is used by recursive name servers in their
responses to queries.
A resolver can set the CD bit in its query to indicate that the name server should not validate the DNS response and
that the resolver takes responsibility for validating the DNS data it receives.
A name server that has successfully validated the data in a DNS response sets the AD (Authenticated Data) bit in the
message header to indicate that all resource records in its response have been validated and are authentic. Note that
unless the connection between the DNS server and client has been secured, such as through TSIG, the client cannot
rely on the AD bit to indicate valid data. The data could have been changed in transit between the server and client.
Resolvers can trust a response with the AD bit set only if their communication channel is secure.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 965

DNSSEC

You can also configure the NIOS appliance to always apply RPZ policies, DNS blacklists, or NXDOMAIN rules to DNS
responses, regardless of whether the queries request DNSSEC data. For more information about how to configure
this, see Applying Policies and Rules to DNS Queries that Request DNSSEC Data on page 995. For information about
RPZ policies, DNS blacklists, and NXDOMAIN rules, see their respective sections in this guide.

DNSSEC Resource Records

Following are the DNSSEC RR types:
• DNS Public Key (DNSKEY) resource records—For information, see DNSKEY Resource Records on page 966.
• Resource Record Signature (RRSIG) records—For information, see RRSIG Resource Records on page 968.
• Next Secure (NSEC/NSEC3) records—For information, see NSEC/NSEC3 Resource Records on page 969.
• NSEC3PARAM records—For information, see NSEC3PARAM Resource Records on page 970.
• Delegation Signer (DS) resource records—For information, see DS Resource Records on page 970.
For detailed information about each RR, refer to RFC 4034, Resource Records for the DNS Security Extensions and RFC
5155, DNS Security (DNSSEC) Hashed Authenticated Denial of Existence.

Note: The appliance supports IDNs for DNSKEY records, DS records, NSEC records, NSEC3PARAM records, and RRSIG
records.

DNSKEY Resource Records

When an authoritative name server digitally signs a zone, it typically generates two key pairs, a zone-signing key (ZSK)
pair and a key-signing key (KSK) pair. The name server uses the private key of the ZSK pair to sign each RRset in a
zone. (An RRset is a group of resource records that are of the same owner, class, and type.) It stores the public key of
the ZSK pair in a DNSKEY record. The name server then uses the private key of the KSK pair to sign all DNSKEY records,
including its own, and stores the corresponding public key in another DNSKEY record. As a result, a zone typically has
two DNSKEY records; a DNSKEY record that holds the public key of the ZSK pair, and another DNSKEY record for the
public key of the KSK pair.

Note: For the remainder of this chapter, the DNSKEY record that holds the public key of the ZSK pair is referred to as
the ZSK and the DNSKEY record that holds the public key of the KSK is referred to as the KSK.

The purpose of the KSK is two-fold. First, it is referenced in the Delegation Signer (DS) RR that is stored in a parent
zone. The DS record is used to authenticate the KSK of the child zone, so a resolver can establish a chain of trust from
the parent zone to its child zone. (For more information about the DS RR, see DS Resource Records on page 970).
Second, if a zone does not have a chain of trust from a parent zone, security aware resolvers can configure the KSK
as a trust anchor; that is, the starting point from which it can build a chain of trust from that zone to its child zones.
Note that though the two key pairs, KSK and ZSK, are used in most DNSSEC environments, their use is not required
by the RFCs. A zone administrator can use a single private/public key pair to sign all zone data. (Note that Infoblox
appliances require two key pairs.)

966 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNSSEC

Following is an example of a DNSKEY RR:

corp100.com 1296000 IN DNSKEY 257 3 5 20181231235959hiZsq1gPtqIKeVuGBbAchPSdg
4vSymSxBsqzueQW4jrjCBsQbH7VH95kdfcAPxhx
ZBvwQMgE07dxaOeTpwpaq0vpl6EOV0zLwWhiImw
l7XhOjIarzM8nTf1PJ+4av1KrqB1IPy3693jlChyL8sMT
0EfwS0tEAwD7Isvt2vW24cE= )

Owner TTL Class RR Flags

Name Type Field

Protocol

Algorithm Public Key

The first four fields specify the domain name of the zone that owns the key, the resource record TTL, class, and RR
type. The succeeding fields are:
• Flags Field: In its wire format, this field is two bytes long. (The wire format is used in DNS queries and
responses.) Bits 0 through 6 and 8 through 14 are reserved, and have a value of 0. Bit 7 indicates if the record
holds a DNS zone key. Bit 15 is the Secure Entry Point (SEP) flag, which serves as a hint that indicates whether
the DNSKEY record contains a ZSK or a KSK, as described in RFC 3757, DNSKEY RR SEP Flag. Zone administrators
typically set the SEP flag of a DNSKEY record of a zone when it contains the KSK, to indicate that it can be used
as a trust anchor. However, a DNSKEY record that does not have the SEP flag set can also be used as a trust
anchor.
Given the currently defined flags, in its text format, the flags field is represented as an unsigned decimal integer
with the possible values of 0, 256 and 257. A value of 256 indicates that the DNSKEY record holds the ZSK and
a value of 257 indicates that it contains the KSK. In general, this field contains an odd number when the
DNSKEY record holds the KSK.
• Protocol: This always has a value of 3, for DNSSEC.
• Algorithm: Identifies the public key’s cryptographic algorithm. The available types are:
— 1 = RSA/MD5
— 2 = Diffie-Hellman (This is not supported by BIND and Infoblox appliances.)
— 3 = DSA
— 4 = Reserved
— 5 = RSA/SHA1
— 6 = DSA/SHA1/NSEC3
— 7 = RSA/SHA1/NSEC3
— 8 = RSA/SHA-256
— 10 = RSA/SHA-512
• Public Key: The public key encoded in Base64.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 967

DNSSEC

RRSIG Resource Records

A signed zone has multiple RRsets, one for each record type and owner name. (The owner is the domain name of the
RRset.) When an authoritative name server uses the private key of the ZSK pair to sign each RRset in a zone, the digital
signature on each RRset is stored in an RRSIG record. Therefore, a signed zone contains an RRSIG record for each
RRset.
Following is an example of an RRSIG record:

RRset Expiration Inception

TTL Time Time
Key
Tag Signature
Name

corp100.com 86400 IN RRSIG A 5 2 86400 20181231235959 20081027145729

49890 corp100.com hiZsq1gPtqIKeVuGBbAchPSdg
4vSymSxBsqzueQW4jrjCBsQbH7VH95kdfcAPxhx
ZBvwQMgE07dxaOeTpwpaq0vpl6EOV0zLwWhiImw
l7XhOjIarzM8nTf1PJ+4av1KrqB1IPy3693jlChyL8sMT
Owner TTL Class RR 0EfwS0tEAwD7Isvt2vW24cE= )
Name Type
Type
Covered
Algorithm Signature
Number of
Labels

The first four fields specify the owner name, TTL, class, and RR type. The succeeding fields are:
• Type Covered: The RR type covered by the RRSIG record. The RRSIG record in the example covers the A records
for corp100.com.
• Algorithm: The cryptographic algorithm that was used to create the signature. It uses the same algorithm types
as the DNSKEY record indicated in the Key Tag field.
• Number of Labels: Indicates the number of labels in the owner name of the signed records. There are two labels
in the example, corp100 and com.
• RRset TTL: The TTL value of the RRset covered by the RRSIG record.
• Expiration Time: The signature expiration time in UTC format.
• Inception Time: The signature inception time in UTC format.
• Key Tag: The key tag value of the DNSKEY RR that validates the signature.
• Signature Name: The zone name of the RRset.
• Public Key: The Base64 encoding of the signature.

968 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNSSEC

NSEC/NSEC3 Resource Records

When a name server receives a request for a domain name that does not exist in a zone, the name server sends an
authenticated negative response in the form of an NSEC or NSEC3 RR. NSEC and NSEC3 records contain the next
secure domain name in a zone and list the RR types present at the NSEC or NSEC3 RR’s owner name. The difference
between an NSEC and NSEC3 RRs is that the owner name in an NSEC3 RR is a cryptographic hash of the original owner
name prepended to the name of the zone. NSEC3 RRs protect against zone enumeration.
Following is an example of an NSEC record:

corp100.com 86400 IN NSEC a1.corp100.com. NS SOA RRSIG NSEC DNSKEY

RRsets
Owner TTL Class RR Next Owner
Name Type Name

The first four fields specify the owner name, TT, class and RR type. The succeeding fields are:
• Next Owner Name: In the canonical order of the zone, the next owner name that has authoritative data or that
contains a delegation point NS record.
• RRsets: The RRsets that exist at the owner name of the NSEC record, which are NS, SOA, RRSIG, NSEC, and
DNSKEY in the example.
Following is an example of an NSEC3 RR:

Iterations
Flags
TTL Class Algorithm
Salt Field

u1e6lovi99jvlertev0e080ta34ocu39 900 IN NSEC3 1 0 100 74ae486f6ecbbd29010047ad

ULJ8BVITGP5OAORMMRFUPQV6A2197FIB NS SOA
RRSIG DNSKEY NSEC3PARAM

Hashed Owner Name RR Type Next Owner Name

RRsets

The first field contains the hashed owner name. It is followed by the TTL ,class and RR type. The fields after the RR
type are:
• Algorithm: The hash algorithm that was used. The currently supported algorithm is SHA-1, which is represented
by a value of 1.
• Flags Field: Contains 8 one-bit flags, of which only one flag, the Opt-Out flag, is defined by RFC 5155. The
Opt-Out flag indicates whether the NSEC3 record covers unsigned delegations.
• Iterations: The number of times the hash function was performed.
• Salt Field: A series of case-insensitive hexadecimal digits. It is appended to the original owner name as
protection against pre-calculated dictionary attacks.
• Next Owner Name: Displays the next hashed owner name.
• RRsets: The RR types that are at the owner name.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 969

DNSSEC

NSEC3PARAM Resource Records

An authoritative DNS server uses NSEC3PARAM RRs to determine which NSEC3 records it includes in its negative
responses. An NSEC3PARAM RR contains the parameters that an authoritative server needs to calculate hashed
owner names. As stated in RFC 5155, the presence of an NSEC3PARAM RR at a zone apex indicates that the specified
parameters may be used by authoritative servers to choose an appropriate set of NSEC3 RRs for negative responses.
Following is an example of an NSEC3PARAM record:

corp100.com 900 IN NSEC3PARAM 1 0 100 74ae486f6ecbbd29010047ad

Owner TTL Class RR Algorithm Iterations Salt Field

Name Type
Flags

The first four fields specify the owner name, TTL, class and RR type. The succeeding fields are:
• Algorithm: The hash algorithm that was used. The currently supported algorithm is SHA-1, which is represented
by a value of 1.
• Flags Field: Contains 8 one-bit flags, of which only one flag, the Opt-Out flag, is defined by RFC 5155. The
Opt-Out flag indicates whether the NSEC3 record covers unsigned delegations.
• Iterations: The number of times the hash function was performed. The number of NSEC3 iterations is set to 10.
• Salt Field: A series of case-insensitive hexadecimal digits. It is appended to the original owner name as
protection against pre-calculated dictionary attacks. New salt value is generated when the ZSK rolls over, for
which the user can control the period. For random salt, the selected length is between one and 15 octets.

DS Resource Records
A DS RR contains a hash of a child zone's KSK and can be used as a trust anchor in some security-aware resolvers and
to create a secure delegation point for a signed subzone in DNS servers. As illustrated in Figure 22.1, the DS RR in the
parent zone corp100.com contains a hash of the KSK of the child zone sales.corp100.com, which in turn has a DS
record that contains a hash of the KSK of its child zone, nw.sales.corp100.com.

Figure 22.1

A server1.corp100.com A server2.sales.corp100.com A server3.nw.sales.corp100.com

A ftp.corp100.com A ftp1.sales.corp100.com A ftp1.nw.sales.corp100.com
A sales.corp100.com RRSIG A 5 2 86400.... RRSIG A 5 2 86400....
RRSIG A 5 2 86400.... DS 25854 5 1 DNSKEY 256
DS 25924 5 1 DNSKEY 256 DNSKEY 257
DNSKEY 256 DNSKEY 257
DNSKEY 257

corp100.com sales.corp100.com nw.sales.corp100.com

970 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DNSSEC on a Grid

Following is an example of the DS RR:

corp100.com 86400 IN DS 25924 5 1 49D2801B50E25D59440F1FF1A8012B568435
B622B1F8709F33D744C4C6D71EA2

Owner TTL Class RR Key

Name Type Tag
Algorithm
Digest
Digest
Type

The first four fields specify the owner name, TTL, class and RR type. The succeeding fields are as follows:
• Key Tag: The key tag value that is used to determine which key to use to verify signatures.
• Algorithm: Identifies the algorithm of the DNSKEY RR to which this DS RR refers. It uses the same algorithm
values and types as the corresponding DNSKEY RR.
• Digest Type: Identifies the algorithm used to construct the digest. The supported algorithms are:
— 1 = SHA-1
— 2 = SHA-256
• Digest: If SHA-1 is the digest type, this field contains a 20 octet digest. If SHA-256 is the digest type, this field
contains a 32 octet digest.

Configuring DNSSEC on a Grid

You can configure the name servers in a Grid to support DNSSEC. You can configure the Grid Master as the primary
server for a signed zone and the Grid members as secondary servers. (For more information, see Configuring Grid
Members to Support DNSSEC as Secondary Servers on page 991.) Note that only the Grid Master can serve as the
primary server for a signed zone.
You can enable the Grid Master to sign zones and manage the DNSSEC keys, or you can configure the Grid Master as
a client to a third-party, network-attached Hardware Security Module (HSM) that performs the key generation, zone
signing, and key safekeeping. You must use either the Grid Master or HSM for zone signing and key management; you
cannot use both. Note that each method may have different performance implications, depending on the hardware
platform, number of zones and other factors. For information about using HSMs, see About HSM Signing on page
987.
Any authoritative forward-mapping or reverse-mapping zone can be signed according to the following criteria:
• The zone does not contain any bulk host records.
• DNSSEC is enabled on the Grid Master.
• The primary server of the zone must be a Grid member. If the zone is assigned to an NS group, the primary
server in the group must be a Grid member that has DNSSEC enabled.
Note that you can use DNS views to separate internal and external zone data, to manage your zones more efficiently
and reduce the size of the zones that require signing. For information about DNS views, see Using Infoblox DNS Views
on page 812.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 971

DNSSEC

Grid Master as Primary Server

When you sign a zone whose primary server is a Grid member, that member becomes a secondary server and the Grid
Master becomes the hidden primary server. If the zone is assigned to an NS group, the Grid Master removes the
association with the NS group. The previous primary server becomes a secondary server for the zone.
If a Master Candidate is promoted to Grid Master and the previous Grid Master was the primary server for signed
zones, the new Grid Master becomes the hidden primary server for all signed zones. The previous Grid Master, which
was the primary server for the zone, becomes a secondary server for the zone.
As the primary server, the Grid Master sends zone data to the secondary servers through zone transfers; or, if the
secondary servers are Grid members, the Grid Master transfers data to all Grid members through the database
replication process, by default. The Grid Master transfers all records in that zone, including all NSEC/NSEC3, RRSIG,
DNSKEY and DS records with owner names that belong to that zone. The RRSIG RRs are included in zone transfers of
the zone in which they are authoritative data. The Grid Master also performs incremental zone transfers to secondary
servers as a result of incremental zone signings.
In addition, the Grid Master automatically performs an incremental signing of the zone data sets when their contents
change. Incremental signing refers to signing just those parts of a zone that change when RRs are added, modified,
or deleted. The Grid Master uses the private key of the ZSK when it incrementally signs a zone. In addition, the Grid
Master adds, modifies or deletes the corresponding RRSIG records and the appropriate NSEC/NSEC3 records.
For example, Figure 22.2 shows a Grid Master as the primary server of a signed zone and its Grid members as
secondary servers. The Grid Master, ns1.corp100.com, is the hidden primary DNS server for the corp100.com zone.
As the hidden primary name server for corp100.com, the Grid Master does not respond to queries from other name
servers. Instead, it provides data to its secondary servers, ns2.corp100.com and ns3.corp100.com, which use this
data to respond to DNS queries. Because the secondary servers are Grid members, they receive zone data from the
Grid Master through the Grid database replication process.
The name server ns1.corp200.com is a recursive name server. It has configured the DNSKEY of the corp100.com zone
as a trust anchor. Therefore, it is able to validate the data it receives when it sends a query for the corp100.com zone.

Figure 22.2

corp100.com

1 A DNS client sends a 2 ns1.corp200.com sends a query ns1.corp100.com

query for data in the to ns2.corp100.com. It sets the Hidden Primary Server
corp100.com zone. EDNS DO bit in the query to Grid Master
indicate that it is requesting
DNSSEC data. A
A
server1.corp100.com
ftp.corp100.com Zone Data
A sales.corp100.com
RRSIG A 5 2 86400....
DNSKEY 256
DNSKEY 257

Internet

ns2.corp100.com ns3.corp100.com
DNS client ns1.corp200.com Secondary Server Secondary Server
The DNSKEY of the Grid Member Grid Member
corp100.com zone is
configured as a trust anchor.

4 ns1.corp200.com uses the DNSKEY RR 3 ns2.corp100.com responds

of corp100.com to validate the with the requested data and
response. It then sends the response to the appropriate DNSSEC
the DNS client, with the AD bit set, RRs.
indicating that it validated the response.

972 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Enabling DNSSEC

Following are the tasks to configure the Grid Master to sign zones:
1. Create the zones. For information, see Configuring Authoritative Zones on page 829.
— Specify the Grid Master as the primary server.
2. Enable DNSSEC, as described in Enabling DNSSEC.
3. Optionally, change the default DNSSEC settings. For information, see Setting DNSSEC Parameters on page 973.
4. Sign the zone. The appliance automatically generates the DNSSEC RRs when you sign a zone. For information,
see Signing a Zone on page 978.

Enabling DNSSEC
You can enable DNSSEC on a Grid, individual members, and DNS views. Because only Grid Masters can serve as
primary servers for signed zones, you must enable DNSSEC on the Grid Master before you can sign zones. You must
also enable DNSSEC on any Grid member that serves as a secondary server for signed zones.
When you enable DNSSEC on a Grid, you can set certain parameters that control the DNSSEC RRs, as described in
Setting DNSSEC Parameters on page 973.
When you enable DNSSEC on a Grid member or DNS view, you can set parameters that affect its operations as a
secondary server, as described in Configuring Grid Members to Support DNSSEC as Secondary Servers on page 991.
To enable DNSSEC on a Grid, member or DNS view:
1. Grid: From the Data Management tab, select the DNS tab. Expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the Members tab -> member check box and click the Edit icon.
DNS View: From the Data Management tab, select the Zones tab -> dns_view check box and click the Edit icon.
2. In the editor, click Toggle Expert Mode.
3. When the additional tabs appear, click DNSSEC.
4. In the DNSSEC tab, select Enable DNSSEC.

Note: When you disable EDNS0, all outgoing DNSSEC queries to zones within trusted anchors will fail even if
DNSSEC validation is enabled. This is due to the restriction of the UDP packet length when you disable
EDNS0. For information about EDNS0, see Using Extension Mechanisms for DNS (EDNS0) on page 761.

5. Save the configuration and click Restart if it appears at the top of the screen.

Setting DNSSEC Parameters

The Grid Master uses certain default parameters when it signs a zone and generates the DNSSEC RRs. You can change
these defaults for the entire Grid and for individual zones, in case you want to use different parameters for certain
zones. The following sections describe the different parameters that you can set:
• About the DNSKEY Algorithm
• About Key Rollovers
• RRSIG Signatures on page 975
For information on setting these parameters, see Configuring DNSSEC Parameters on page 975.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 973

DNSSEC

About the DNSKEY Algorithm

You can add multiple cryptographic algorithms that the Grid Master uses when it generates the KSK and ZSK. You can
also add multiple algorithms at the Grid level and override them at the zone level. By default, the appliance uses
RSA/SHA1 for both KSK and ZSK. You can add DSA, RSA/MD5, RSA/SHA1, RSA/SHA-256, or RSA/SHA-512
algorithms. However, you cannot add RSA/MD5 if the zone is signed with NSEC3 records. Note that a zone can contain
either NSEC or NSEC3 records, but not both. You can add same or different set of algorithms with possibly different
key sizes for both KSK and ZSK.
You can assign the DNSKey algorithm for HSMs. Thales HSMs don’t support DSA. All other parameters are not used
by HSMs.

About Key Rollovers

To reduce the probability of their being compromised, ZSKs and KSKs must be periodically changed. The time within
which a key pair is effective is its rollover period. The rollover period starts as soon as a zone is signed. After a rollover
period starts, you cannot interrupt or restart it unless you unsign the zone. During the key rollover, all the algorithms
are rolled over at the same time and the rollover is performed on a per-zone basis.

Zone-Signing Key Rollover

You can configure automatic ZSK rollovers on the Grid Master, using the double signature rollover method or the
pre-publish method. For more information, see Configuring DNSSEC Parameters on page 975. The appliance initiates
the ZSK rollover of signed zones when they are due. You can also perform a manual rollover of ZSKs. For more
information, see Rolling Zone-Signing Keys on page 983.
The double signature method provides a grace period, which is half of the rollover period. The default ZSK rollover
period is 30 days; thus the default grace period is 15 days.
At the end of a rollover period of a ZSK, the Grid Master generates a new ZSK key pair. It signs the zone with the private
key of the new ZSK key pair, and consequently generates new RRSIG RRs with the new signatures. However, the Grid
Master also retains the old ZSK key pair and RRSIG RRs. Thus during the grace period, the data in the zone is signed
by the private keys of both the old and new ZSKs. Their corresponding public keys (stored in DNSSEC RRs) can be used
to verify both the old and new RRSIGs.
The grace period also allows the data that exists in remote caches to expire and during this time, the updated zone
data can be propagated to all authoritative name servers. The Grid Master removes the old ZSK and its RRSIGs when
the rollover grace period elapses. When a scheduled DNSSEC operation exists for a zone, the appliance does not lock
it against other administrative changes and the administrator can still operate on a given zone even if there is a
pending DNSSEC operation scheduled for it.
The appliance sets pre-publish method described in RFC 4641 as the default zone-signing key rollover method for
NIOS 6.11.0 or later releases. In the pre-publish rollover method, the new key is published in the keyset before the
actual rollover. After the key propagates to all client caches, Grid Master removes the old signatures and creates new
signatures with the new keys. The pre-publish rollover method uses the current key to sign the zone.

Key-Signing Key Rollover

You can configure automatic KSK rollovers on the Grid Master or perform a manual KSK rollover. The default KSK
rollover period is one year. The Grid Master also uses the double signature rollover method described in RFC 4641 for
KSK rollovers. To configure automatic KSK rollovers, see Configuring Automatic KSK Rollovers and Notifications on
page 984. For information about performing a manual KSK rollover, see Rolling Key-Signing Keys on page 982.
When the KSK rollover is overdue or is due within seven days, the Grid Master displays a warning when admins log
in. In addition, you can also check which KSKs are due for a rollover as described in Checking Key-Signing Keys on
page 982.

974 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Setting DNSSEC Parameters

When a user initiates a KSK rollover, the Grid Master sets the grace period to half the KSK rollover period. It generates
a new KSK, and signs the DNSKEY records with the new KSK. Thus during the grace period, the DNSKEY records are
signed by the private keys of both the old and new KSKs. Both the old and the new KSKs can be used to validate the
zone. The grace period allows the old keys in remote caches to expire. In addition, the admin should also export the
new KSK and send it to the recursive name servers that use the KSK as trust anchors.
If the KSK rollover is for a child zone and the primary server of the parent zone is a Grid member, the Grid Master also
inserts a DS record in the parent zone for the new DNSKEY in the child zone. If the primary server of the parent zone
is external to the Grid, the admin must export either the DS record or the new KSK to the admin of the parent zone.
For information about exporting a KSK, see Exporting Trust Anchors on page 981.
The Grid Master then removes the old KSK and its RRSIG records when the grace period for the KSK rollover ends.

About Key Rollovers and DNS TTLs

Note that the KSK and ZSK rollover intervals affect TTLs used by RRs in signed zones.
A grace period is half of the key rollover interval. For example, if the KSK rollover interval is 1 year (365 days), then
the grace period is 182.5 days; if the ZSK rollover interval is 30 days, then the grace period is 15 days.
The DNSKEY RRset in the zone is assigned a TTL that is the minimum of the KSK and ZSK grace period. In the preceding
example, the minimum or lowest of these is 15 days. Therefore, the TTLs used for the DNSKEY RRset are 15 days
(1296000 seconds).
All other RRs in the signed zone are limited to a “zone maximum TTL,” which is the grace period of the ZSK. In the
example, this is also 15 days.
When the zone is initially signed, if the TTL of an RR exceeds the zone maximum TTL, the Grid Master reduces the TTL
to the zone maximum TTL. Additionally, the TTL settings for the signed zone are set to override; the values are
inherited from the Grid DNS properties at that time, and the default TTL setting is reduced to the zone maximum TTL
if the Grid property exceeds it. If the zone is later unsigned, the zone DNS properties remain at their overriden
settings.

RRSIG Signatures
As shown in the sample RRSIG record in RRSIG Resource Records on page 968, the signatures have an inception and
an expiration time. The default validity period of signatures in RRSIG records on the Grid Master is four days. You can
change this default, as long as it is not less than one day or more than 3660 days. The Grid Master automatically
renews signatures before their expiration date.

Configuring DNSSEC Parameters

The following are the guidelines for choosing the DNSSEC parameters:
• RSA/SHA1 is the most widely used cryptographic algorithm for generating KSK and ZSK. However, it is
recommended to use RSA/SHA-256 and RSA/SHA-512 for better interoperability.
• The usage of DSA cryptographic algorithm is optional. As stated in RFC 6944, it may not be supported by many
systems.
• It is not recommend to use RSA/MD5 cryptographic algorithm as it is not very secure. As stated in RFC 6944,
there are known defects in MD5.
• The key size of KSK algorithm is recommended to be equal to or greater than the key size of ZSK algorithm.
To set parameters at the Grid or zone level:
1. Grid: From the Data Management tab, select the DNS tab. Expand the Toolbar and click Grid DNS Properties.
Zone: From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and click the Edit icon.
Click Override to override the parameters.
Standalone appliance: From the Data Management tab, select the DNS tab. Expand the Toolbar and click
System DNS Properties.
2. In the editor, click Toggle Advanced Mode.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 975

DNSSEC

3. When the additional tabs appear, click DNSSEC.

4. In the DNSSEC tab, click the Basic tab and complete the following:
— Select NSEC or NSEC3. The default is NSEC. A zone cannot contain both NSEC and NSEC3 records. Note that
if you select NSEC3, RSA/MD5 cannot be specified for KSK and ZSK algorithm.
— Key-signing Key: Click the Add icon to add the cryptographic algorithm that the Grid Master or HSM uses
when it generates the KSK. You can add multiple algorithms, but you cannot add the same algorithm more
than once. Grid Manager adds a row to the table each time you click the Add icon. Select the row and the
algorithm from the drop-down list and enter the key size for the algorithm. The default is RSA/SHA1 with the
key size 2048.
Following are the valid values for each algorithm:
DSA: The minimum is 512 bits and the maximum is 1024 bits, which is also the default. The key length
must be a multiple of 64. Note that Thales HSMs do not support DSA.
RSA/MD5: The minimum is 512 bits, the maximum is 4096 bits, and the default is 2048 bits. You can
configure this for NSEC only.
RSA/SHA1: The minimum is 512 bits, the maximum is 4096 bits, and the default is 2048 bits.
RSA/SHA-256: The minimum is 512 bits, the maximum is 4096 bits, and the default is 2048 bits.
RSA/SHA-512: The minimum is 1024 bits, the maximum is 4096 bits, and the default is 2048 bits.
You can delete an algorithm by selecting it and clicking the Delete icon.
— Key-signing Key Rollover Interval: You can specify the key signing key rollover interval for all the algorithms.
The minimum value is one day and the maximum is the time remaining to January 2038. The default is one
year.
— Zone-signing Key: Click the Add icon to add the cryptographic algorithm that the Grid Master or HSM uses
when it generates the ZSK. You can add multiple algorithms, but you cannot add the same algorithm more
than once. Grid Manager adds a row to the table each time you click the Add icon. Select the row and the
algorithm from the drop-down list and enter the key size for the algorithm. The default is RSA/SHA1 with the
key size 1024.
Following are the valid values for each algorithm:
DSA: The key length must be a multiple of 64. The minimum is 512 bits and the maximum is 1024 bits. The
default is 1024 bits. Note that Thales HSMs do not support DSA.
RSA/MD5: The minimum is 512 bits, the maximum is 4096 bits, and the default is 1024 bits. You can
configure this for NSEC only.
RSA/SHA1: The minimum is 512 bits, the maximum is 4096 bits, and the default is 1024 bits.
RSA/SHA-256: The minimum is 512 bits, the maximum is 4096 bits, and the default is 1024 bits.
RSA/SHA-512: The minimum is 1024 bits, the maximum is 4096 bits, and the default is 1024 bits.
You can delete an algorithm by selecting it and clicking the Delete icon.
— Zone-signing Key Rollover Interval: You can specify the zone signing key rollover interval for all the
algorithms. The minimum value is one day and the maximum is the time remaining to January 2038. The
default is 30 days.
— Signature Validity: Specify the signature validity period for RRSIG RRs. The minimum is one day and the
maximum is 3660 days. The default signature validity interval is four days.
— Zone-signing Key rollover method: You can use either of these methods to sign all the RRsets in a zone:
— Pre-publish: Select this if you want to use the pre-publish signature scheme to sign all the RRsets in a
zone while performing the ZSK rollover. When you select this option, the record sets are signed using a
single key. The appliance sets this option as the default zone-signing key method for NIOS 6.11.0 and
later releases.
— Double Sign: Select this if you want to use the double signature scheme to sign all the RRsets in a zone
while performing the ZSK rollover. The non-DNSKEY RRset are signed twice, which increases the size of
the zone files.

976 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Setting DNSSEC Parameters

Note: You can select the Zone-signing Key rollover method only after you enable DNSSEC.

5. Save the configuration and click Restart if it appears at the top of the screen.
When you modify the algorithms for a signed zone, you can apply the algorithm changes to the zone, as described in
Applying the Algorithm Changes on page 977 or you can unsign the zone and sign it again. For an unsigned zone
however, you can apply the algorithm changes by signing the zone. For information about signing a zone, see Signing
a Zone on page 978.
When you re-sign a zone after adding an algorithm, the DNSKEY key pairs of the old algorithms are rolled over and all
the old RRSIG records are removed. The zone is re-signed with the new DNSKEY key pairs. When you re-sign a zone
after removing an algorithm, the DNSKEY key pairs of the remaining algorithms are rolled over and the DNSKEY key
pairs of the removed algorithm is removed. All old RRSIG records are removed and the zone is re-signed with the new
DNSKEY key pairs.

Note: If you add or remove a KSK algorithm from a zone, you must update the DS RRsets at the parent zone when the
parent zone is managed by a non-Infoblox DNS server or an Infoblox server that is part of a different Grid. For
information, see Importing a Keyset on page 981.

Applying the Algorithm Changes

You can apply the algorithm changes to a zone whenever the KSK or ZSK algorithms are modified. You can apply the
algorithm changes only to a signed zone.
To apply the algorithm changes to a signed zone:
1. From the Data Management tab, select the DNS tab.
2. Expand the Toolbar and click DNSSEC -> Apply Algorithm Changes.
3. In the Apply Algorithm Changes dialog box, click the Add icon to select a zone. When there are multiple zones,
Grid Manager displays the Zone Selector dialog box. The appliance displays signed zones only. Select a zone. To
add multiple zones, click the Add icon and select a zone.
To remove a zone from the list, select the check box adjacent to the respective zone and click the Delete icon.
You can click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel,
either select Now or select Later and enter a date, time, and time zone.
4. After you have selected the zones, click Apply Algorithm Changes.
5. When the confirmation dialog appears, click Yes.

Deleting the DNSSEC Keys Associated with a Zone

You can view the status of KSKs and ZSKs or delete the existing keys. Note that you can only delete keys that are either
published or rolled over. You cannot delete keys that are active.
To delete keys:
1. From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and click the Edit icon.
2. In the Authoritative Zone editor, click the DNSSEC tab, and the following are displayed in the Advanced tab:
— Key ID: The appliance generates a separate ID for each key. Select the check box adjacent to the Key ID.
To delete an KSK, select the check box in the Key-signing Keys table. Select the check box in the
Zone-signing Keys table to delete an ZSK.
— Status: The Status column displays the status of the respective key. It can be one of the following: Active,
Published, or Rolled.
— Public Key: This column displays the public key that is associated with the respective KSK or ZSK.
— Algorithm: This column displays the algorithm that is associated with the respective KSK or ZSK.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 977

DNSSEC

— Time until next event: This column displays the time that is left to perform the next action for a key that is
associated with the respective ZSK. This column help you decide whether to roll over manually or wait for a
zone to resign automatically. The time is displayed in months, days, hours format. For example, 2m 3d 13 h
implies time left to perform the next action is 2 months, 3 days and 13 hours.
— Active Key: Indicates the time when the active key is rolled and zone is signed with the published key.
— Published Key: Indicates the time when the published key is used to resign a zone.
— Rolled Key: Indicates the time when a rolled key is deleted. Rolled keys are stored for quite a long
period of time and are not used. You can manually cleanup the rolled keys.
3. Click the Delete icon.

Signing a Zone
When it signs a zone, the Grid Master generates new DNSKEY key pairs. As shown in Figure 22.3, it uses the private
key of the ZSK to sign the authoritative RRsets in the zone, and stores the corresponding public key in a DNSKEY
record. It then uses the private key of the KSK to sign the DNSKEY records and stores the corresponding public key in
another DNSKEY record. It stores the private keys in the Grid database and stores the public keys in the DNSKEY
records in the database.

Figure 22.3 Zone Signing Process

Zone-Signing Key-Signing
Key Pair Key Pair
Public Key
DNSKEY 257

Public Key
DNSKEY 256 DNSKEY 256

Private Key
A server1.corp100.com A server1.corp100.com
A server1.corp100.com
A ftp.corp100.com A ftp.corp100.com
A ftp.corp100.com
A sales.corp100.com A sales.corp100.com
A sales.corp100.com
A web1.corp100.com A web1.corp100.com
A web1.corp100.com

A RRsset Private Key RRSIG A

RRSIG A

1 The A RRset is signed with the 2 The signature is stored in the 3 The private key of the KSK pair
private key of the ZSK pair. RRSIG record, the public key is signs the DNSKEY record of
stored in the DNSKEY record, and the ZSK. The public key of the
the private key is stored securely in KSK is stored in another
the Grid database. DNSKEY record.

The Grid Master also does the following:

• It inserts NSEC or NSEC3 records. The use of NSEC or NSEC3 records depends on the NSEC type you selected for
the Grid or the zone. When you select NSEC3, the Grid Master uses NSEC3 records in signed zones.
• It increments the SOA serial number and notifies the secondary servers that there is a change to its zone data.
When the secondary servers check the serial number and see that it has been incremented, the secondary
servers request a zone transfer.
• If the TTL of an RR in the zone exceeds the ZSK grace period, the Grid Master reduces the TTL to the ZSK grace
period. (For information about the grace period, see About Key Rollovers on page 974.) Setting a TTL value that
exceeds half of the rollover period is not allowed.
• If the KSK rollover period is less than the ZSK rollover period, the Grid Master sets the TTL of the DNSKEY RR to
the KSK rollover period.

978 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Signing a Zone

• The appliance sets the Grid Master as the primary server for zones, enables DNSSEC on the Grid Master, and
starts DNS service on the Grid Master.
When it signs a subzone, the Grid Master automatically inserts DS records for parent zones that are hosted by Grid
members. The appliance allows you to sign a single zone or multiple zones simultaneously. For example, if you have
multiple zones that are due for rollover at the same time, you can select all such zones and sign them at once. Note
that each operation is independent of the other. For example, if you want to sign five zones at the same time, and if
one of the zones fails during this time, NIOS signs the remaining four zones. Note that the selected zones must have
an associated primary server. The appliance displays an error message if the zone does not have a primary server.
When the sign operation fails, the appliance displays the zone names, associated DNS views, and the error message
indicating the reason for failure.
To sign a zone:
1. From the Data Management tab, select the DNS tab.
2. Expand the Toolbar and click DNSSEC -> Sign Zones.
3. In the Sign Zones dialog box, the displayed zone name can either be the last selected zone or the zone from
which you are signing. If no zone name is displayed or if you want to select a different zone, click the Add icon.
The appliance displays unsigned zones only. When there are multiple zones, Grid Manager displays the Zone
Selector dialog box. Select a zone. To add multiple zones, click the Add icon and select a zone.
You can click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel,
either select Now or select Later and enter a date, time, and time zone. For information, see Scheduling Tasks
on page 85.
4. After you have selected the zones, click Sign Zones.
5. When the confirmation dialog displays, click Yes.
When you sign multiple zones, the appliance displays generic error messages for the following cases:
• The value to which the resource record TTL is reduced is not displayed.
• The appliance displays a message about name server group disassociation if at least one zone is associated
with a name server group. It will not list the affected zones.
• When you sign a zone or multiple zones, the appliance displays a warning message indicating that the
operation might take a longer time.
• The appliance displays an error message if the number of characters in the zone name, which you want to sign,
exceeds 180 characters. You can sign a zone only when the name of the zone is less than 180 characters in size.
To remove a zone from the list, select the check box adjacent to the respective zone and click the Delete icon. To view
the records of the signed zone, from the Data Management tab, select the DNS tab -> Zones tab -> zone. Expand the
Records section to list the RRs of the zone, as shown in Figure 22.4.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 979

DNSSEC

Figure 22.4

980 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Signed Zones

Managing Signed Zones

After you sign a zone, you can do the following:
• You can add a DS RR at the delegation point for a signed subzone when the subzone is hosted on a non-Infoblox
DNS server or an Infoblox server that is part of a different Grid. For information, see Importing a Keyset on page
981.
• Trust anchors can be specified as DNSKEY RRs, DS RRs, and as a BIND trusted-keys statement. You can export
any of these as trust anchors. For information, see Exporting Trust Anchors on page 981.
• You must change the KSK periodically, to ensure its security. For information, seeChecking Key-Signing Keys on
page 982 and Rolling Key-Signing Keys on page 982.
• You can initiate ZSK rollovers manually. For information, see Rolling Zone-Signing Keys on page 983.
• If, for any reason, the security of the keys are compromised, you can delete a key and perform a manual rollover.
For information, see Configuring Emergency KSK Rollover on page 986.
Note that when you re-sign a zone, the Grid Master generates new ZSK and KSK pairs. You must send the new
DNSKEY of the KSK to resolvers that use it as a trust anchor and generate new DS records and send them to the
parent zones.
• You can move a signed zone to the Recycle Bin, from where you can delete it permanently or restore it. For
information, see Deleting and Restoring Signed Zones on page 984.
In addition, signed zones can accept dynamic DNS updates. For information about configuring zones to accept
dynamic DNS updates, see Configuring DNS Servers for DDNS on page 927.

Importing a Keyset
A keyset is a DS RRset, or a DNSKEY RRset which is used as input to generate the DS RRset. To import a keyset:
1. From the Data Management tab, select the DNS tab.
2. Expand the Toolbar and click DNSSEC -> Import Keyset.
3. In the Import Keyset dialog box, the displayed zone name can either be the last selected zone or the zone from
which you are importing the keyset. If no zone name is displayed or if you want to select a different zone, click
Select Zone. When there are multiple zones, Grid Manager displays the Zone Selector dialog box from which you
can select a zone.
4. Paste the KSK or DS record being imported. It must be a KSK or DS record, and must belong to an immediate
subzone of the zone to which the record is being imported.
5. Click Import.
If you imported a DNSKEY RRset, the Grid Master uses the SHA-1 algorithm to generate the DS RRset, which it adds
to the parent zone. If you imported a DS RRset, the Grid Master adds it to the parent zone. The Grid Master
incrementally signs the DS RRset.

Exporting Trust Anchors

A trust anchor is a DNSSEC public key which is used by security-aware resolvers as the starting point for establishing
authentication chains. A trust anchor can be specified as a DNSKEY RR or a DS RR, which contains the hash of a
DNSKEY RR and can also be used to create a secure delegation point for a signed subzone in DNS servers.
In BIND, trust anchors are configured using the trusted-keys directive. A trusted key is a DNSKEY RR without the TTL,
class and RR type. You can export the trust anchors for the selected zone in a format that can be used in a BIND
trusted-keys directive. Exporting trust anchors supports multiple algorithms, which means you can export all the
algorithms in a key.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 981

DNSSEC

To export trust anchors:

1. From the Data Management tab, select the DNS tab.
2. Expand the Toolbar and click DNSSEC -> Export Trust Anchors.
3. In the Export Trust Anchors dialog box, do the following:
— The displayed zone name can either be the last selected zone or the zone from which you are exporting
trust anchors. If no zone name is displayed or if you want to select a different zone, click Select Zone. When
there are multiple zones, Grid Manager displays the Zone Selector dialog box from which you can select
one.
— Select one of the following: DNSKEY records, DS records, or BIND trusted-keys statement.
4. Click Export.
5. Specify the location of the exported file and click OK.
If you exported DS records, the exported file contains DS records that use the SHA-1 and SHA-256 algorithms.

Checking Key-Signing Keys

To check which key-signing keys are overdue for a rollover or are due to roll over within a week:
1. From the Data Management tab, select the DNS tab.
2. Expand the Toolbar and click DNSSEC -> Check KSK Rollover Due.
3. The KSK Rollover Due dialog box lists the key-signing keys that are due to rollover. It includes the domain name
of the zone, DNS view (if there are multiple DNS views), and the number of days until the rollover.
You can click the Schedule icon at the top of the wizard to schedule a KSK rollover for one or more zones at a
given date and time. In the Schedule Change panel, either select Now or select Later and enter a date, time, and
time zone. For information, see Scheduling Tasks on page 85.
4. Click Close.

Rolling Key-Signing Keys

You can initiate a rollover before or after a rollover period, or when you need to replace the KSK for security reasons.
You can initiate a KSK rollover several times simultaneously, but note that the number of keys will increase each time
you perform a rollover. You can schedule the KSK rollover to occur at a later date and time.
To roll over key-signing keys:
1. From the Data Management tab, select the DNS tab.
2. Expand the Toolbar and click DNSSEC -> Roll Over Key-Signing Key.
3. In the Roll Over Key-Signing Key dialog box, the displayed zone name can either be the last selected zone or the
zone from which you are rolling over key-signing keys. If no zone name is displayed or if you want to select a
different zone, click the Add icon. The appliance displays signed zones only. When there are multiple zones, Grid
Manager displays the Zone Selector dialog box. To add multiple zones, click the Add icon and select a zone.
You can click the Schedule icon at the top of the wizard to schedule a KSK rollover for one or more zones at a
given date and time. In the Schedule Change panel, either select Now or select Later and enter a date, time, and
time zone. For information, see Scheduling Tasks on page 85. Note that you cannot schedule the KSK rollover
on a recurring basis.
4. Click Roll Over.
You can export the new KSK and send it to the security-aware resolvers that use it as a trust anchor. To remove a zone
from the list, select the check box adjacent to the respective zone and click the Delete icon.

982 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Signed Zones

Rolling Zone-Signing Keys

Only an administrator can initiate ZSK rollovers either before or after a rollover period, or when you want to replace
the ZSK for security reasons. You can initiate a ZSK rollover several times simultaneously, but note that the number
of keys will increase each time you perform a rollover.
To roll over zone-signing keys:
1. From the Data Management tab, select the DNS tab.
2. Expand the Toolbar and click DNSSEC -> Roll Over Zone-Signing Key.
3. In the Roll Over Zone-Signing Key dialog box, the displayed zone name can either be the last selected zone or the
zone from which you are rolling over zone-signing keys. If no zone name is displayed or if you want to select a
different zone, click the Add icon. The appliance displays unsigned zones only. When there are multiple zones,
Grid Manager displays the Zone Selector dialog box. To add multiple zones, click the Add icon and select a zone.
You can click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel,
either select Now or select Later and enter a date, time, and time zone. For information, see Scheduling Tasks
on page 85.
4. Click Roll Over.
To remove a zone from the list, select the check box adjacent to the respective zone and click the Delete icon. The
appliance displays warning messages when the changes take effect on the first zone or when the rollover occurs. You
cannot change the zone-signing key rollover method while the previous change is still in progress. The previous
change will be completed only when the zone active key, which is active when the rollover method is changing,
expires and is deleted.

Best Practices for Configuring Zone Signing Keys

Infoblox recommends that you use the pre-publish option for zone signing key method for the following reasons:
• The double-signature ZSK rollover doubles the number of signatures in your zone when a rollover is in progress.
The size of the zone increases due to the duplicate signature records. This is not recommended if the size of
your zones are large. When you select this option, the appliance creates a new set of signatures for all the
resource records. This also increases the database usage.
• When you select to pre-publish key rollover, the rollover uses a single key to sign the records at a given time and
it does not sign the zone data twice. The appliance publishes the new key in the keyset even before the actual
rollover. This reduces the database usage.

Unsigning a Zone
When you unsign a zone, the Grid Master permanently removes all automatically generated DNSSEC records in the
zone and parent zone. It does not remove any DS records associated with a child zone. You can unsign a single zone
or multiple zones at the same time.
To unsign a zone:
1. From the Data Management tab, select the DNS tab.
2. Expand the Toolbar and click DNSSEC -> Unsign Zones.
3. In the Unsign Zones dialog box, the displayed zone name can either be the last selected zone or the zone from
which you are unsigning. If no zone name is displayed or if you want to select a different zone, click the Add icon.
When there are multiple zones, Grid Manager displays the Zone Selector dialog box. The appliance displays
signed zones only. Select a zone. To add multiple zones, click the Add icon and select a zone.
You can click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel,
either select Now and click Save or select Later and enter a date, time, and time zone. For information, see
Scheduling Tasks on page 85.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 983

DNSSEC

4. After you have selected the zones, click Unsign Zones.

5. When the confirmation dialog displays, click Yes.
To remove a zone from the list, select the check box adjacent to the respective zone and click the Delete icon.

Deleting and Restoring Signed Zones

When you delete a signed zone, the Grid Master unsigns the zone before moving it to the Recycle Bin. Unsigning the
zone effectively deletes all auto-generated DNSSEC RRs; only user-defined DS records are retained and moved to the
Recycle Bin as well. The Grid Master also retains the ZSK and KSK in its database, until you permanently delete the
zone from the Recycle Bin.
When you restore a signed zone, the Grid Master restores it and re-signs its data sets with the original keys, which
are also restored. You can also restore the user-defined DS records. The rollover period of the ZSK and KSK starts
when the zone is signed after it is restored. Note that when you restore a zone that contains rolled keys, either KSK
or ZSK, the appliance removes all these rolled keys.
Note that when you restore a deleted zone from recycle bin on the NIOS server, which is created and signed on the
Microsoft Server 2012, then all the DNSSEC records will be deleted, except for the DNSKEY records. The DNSKEY
records will only be resynchronized. The DNSSEC records are read-only and cannot be regenerated using NIOS. You
must recreate the zone manually on the Microsoft Server. When you recreate the zone on the Microsoft Server, new
keys will be generated. The signed zone, which is restored, and the DNSSEC keys are synced to Microsoft Server. This
zone will be seen as an unsigned zone on the Microsoft Server, as NIOS does not trigger the signing zone request for
the corresponding zone. For such zones, the 'DNSSEC' label is not displayed and the value for 'Signed' column is 'No'.
To delete a signed zone:
1. From the Data Management tab, select the DNS tab -> Zones tab.
2. Click the check box of the zone you want to delete.
3. Click the Delete icon.
4. Click Yes to confirm the deletion.
To restore a signed zone:
1. In the Finder panel, expand Recycle Bin.
2. Select the zone you want to restore.
3. Click the Restore icon.

Configuring Automatic KSK Rollovers and Notifications

You can configure automatic KSK rollovers at the Grid level and override the settings at the zone level. You can also
configure notifications for KSK rollovers. The appliance sends one notification, SNMP, or email, or both based on the
selection, for each event. For example, if the KSK of two zones are rolled over in the same batch, the appliance sends
two notifications, one for each zone. Note that the appliance sends these notifications only once, and they are not
recurring. Apart from the notifications that you receive, Grid Manager also displays a banner when you log in to the
Grid indicating that the KSK rollover is due within the next seven days.
These notifications are not applicable to an ZSK, as the ZSK rollover is an automated process. The appliance
generates numerous notifications.
To configure KSK rollover, complete the following:
1. Grid: From the Data Management tab, select the DNS tab. Expand the Toolbar and click Grid DNS Properties.
Zone: From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and click the Edit icon.
Click Override to override the values at the zone level.
Standalone appliance: From the Data Management tab, select the DNS tab. Expand the Toolbar and click
System DNS Properties.
2. Select the DNSSEC tab and complete the following in the Basic tab:
— KSK Notification Configuration: You can choose to receive notifications for KSK rollover events.

984 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Signed Zones

— No Notifications: Select this if you do not want to receive any notifications for KSK rollover events.
— Notifications for all KSK rollover events: Select this if you want to receive notifications for all KSK
rollover events. The appliance sends notifications after the rollover.
— Notifications only for KSK rollover events requiring manual DS update to parent zone: Select this if you
want to receive notifications only for KSK rollover events that require manual DS updates to parent
zone. This is selected by default.
— Enable KSK Email Notification: Select this to receive email notifications about DNSSEC keys.
— Enable KSK SNMP Notification: Select this to receive SNMP trap alerts about DNSSEC keys.
3. Enable automatic KSK rollover: This is selected by default. When you select this option, the appliance will
automatically roll over KSKs when they are due. The appliance starts the rollover process at most six hours after
the due date. The appliance logs the messages in the syslog.

Note: The appliance enables notifications and automatic KSK rollover by default for NIOS 6.11.0 and later releases.
These are not available for earlier releases. Similar to automatic ZSK rollover, the appliance automatically
restarts the DNS service after a KSK is rolled over.

4. Save the configuration.

Configuring NSEC3 Salt Length and Hashing Iterations

The salt is a random string, which is appended to the domain name before it gets hashed. The number of iterations
indicates the number of additional times the hashing occurs. These serve as a protection against dictionary attacks.
The appliance generates a new salt for initial signing and changes it every time a ZSK rollover occurs. Note that when
you use a longer salt and higher number of iterations, DNS is more secure and the chances of dictionary attacks on
NSEC3 are reduced.
You can choose the minimum and the maximum salt length at the Grid level and override them at the zone level. Note
that the length of the salt has an impact on the size of the NSEC3 record, but it does not have an impact on the
performance of the appliance.
When the number of iterations increases, the DNS client has to validate a additional data and the cost of the DNS
server to serve the zone increases. This might also reduce the performance of the system with regards to DNSSEC
operations.
To define salt length and hashing iterations, complete the following:
1. Grid: From the Data Management tab, select the DNS tab. Expand the Toolbar and click Grid DNS Properties.
Zone: From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and click the Edit icon.
Click Override to override the parameters.
Standalone appliance: From the Data Management tab, select the DNS tab. Expand the Toolbar and click
System DNS Properties.
2. Select the DNSSEC tab and complete the following in the Basic tab:
• Zone-signing Key Settings
— NSEC3 Salt Length: Specify a minimum and maximum length for NSEC3 salt. The minimum length is one
octet and the maximum length is 255 octets. The appliance sets the following default values for minimum
and maximum lengths respectively: one and 15 octets.
— Number of NSEC3 hashing iterations: The appliance uses the default value, ten, for hashing iterations. The
minimum value is ten and the maximum value depends on the smallest key size, as defined in RFC 5155 as
follows:
— 150 if the key size is equal or less than 1024 bits.
— 500 if the key size is equal or less than 2048 bits.
— 2,500 if the key size is equal or less than 4096 bits.

Note: The above fields are displayed only when you select NSEC3 record type.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 985

DNSSEC

Deleting Server Keys

The appliance retains the key until the expiration of the grace period. For example, if the validity period of a KSK is
two years, you can delete the rolled key after publishing the DS record to the parent zone and waiting for a period
greater than its TTL.
The following rules are valid for KSK and ZSK signing using the double-signature scheme:
• You cannot delete an active key.
• When you delete a rolled key, the appliance displays a warning message indicating that it might break
validation on clients.
The following rules are valid for ZSK signing using the pre-publish scheme:
• You cannot delete an active key.
• When you delete a pre-published key, the appliance generates a new pre-published key.
• You can delete a rolled key. The appliance deletes this key as it is no longer used.
When you use an HSM, the appliance does not delete the key from HSM. For more information, see About HSM
Signing on page 987.

Configuring Emergency KSK Rollover

The appliance supports emergency rollover that can be used when the keys are compromised. In an emergency
operation, you must delete the compromised key and the associated compromised data from the zone. The ability to
perform emergency rollovers enable administrators to react quickly when a zone is compromised. To initiate an
emergency rollover, you must first perform a manual rollover. For information about rolling over a KSK manually, see
Rolling Key-Signing Keys on page 982. After the rollover, you must delete the compromised key. For information about
deleting the compromised key, seeDeleting Server Keys on page 986.
An emergency KSK rollover involves the following:
• The administrator of the compromised zone, which is hosted on the Infoblox appliance, must initiate the
emergency KSK rollover and later export the corresponding DS record.
• The administrator of the parent zone, which is hosted on an external server, must import the DS record of the
child zone. This is required to maintain the chain of trust.
During this emergency procedure, the chain of trust is temporarily broken. As stated in RFC 6781, the effect depends
on the order of the operations:
• You must perform the KSK rollover first. The chain of trust is broken until the administrator of the parent zone
replaces the DS record. In the meantime, the zone appears bogus to a validating client.
• You must remove the compromised DS record first. The chain of trust is broken until the NIOS administrator
performs the KSK rollover, communicates the new DS record to the administrator of the parent zone who then
adds it. In the meantime, the zone appears insecure to validating resolvers.

Handling Error and Warning Messages for DNSSEC Operations

Grid Manager consolidates warnings from one or more DNSSEC long running operations and displays them in a single
dialog box. For more information about long running tasks, see About Long Running Tasks on page 100. When the
long running operations are completed with warnings, the appliance displays the message using a yellow banner at
the top of Grid Manager. Click Show Warnings to view the warnings that are generated by the server for DNSSEC
operations. Click Close to close the warning dialog box.
The appliance also displays a warning icon in the Execution Status column of the Task Manager. For more information
about the task manager, see Viewing Tasks on page 82. When you click the icon, the appliance displays a dialog box
indicating that the task is complete with warnings. Click the show task details hyperlink to view detailed information
about the error or warning message. The appliance displays Scheduled Task Details wizard in which you can view the
task details and error or warning messages, if any. For more information, seeViewing Scheduled Tasks on page 987.
The appliance clears the warning messages from the cache when you close the dialog box.
When a DNSSEC operation fails, NIOS saves the messages in the syslog. For more information about the syslog, see
Using a Syslog Server on page 1334.

986 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About HSM Signing

Viewing Scheduled Tasks

You can view the status of operations that are scheduled. The appliance also displays error or warning messages, if
any. For example, if you schedule the Sign Zones operation for multiple zones, there is a possibility that some
operations may fail, some may succeed with warnings, and some are completed successfully. You can also view the
error or warning messages that are generated for certain affected zones. To view the status:
1. From the Administration tab, select the Workflow tab -> Task Manager tab.
2. Grid Manager displays the DNSSEC operations that are scheduled. To view the details you can either click the
Action icon next to the task ID and select View from the menu or select the check box adjacent to the Action
icon and then click View from the Toolbar.
3. The General tab of the Scheduled Task Details wizard displays the following details:
— Task ID: The ID associated with the task. The appliance assigns an ID to a task in chronological order. By
default, the appliance sorts tasks by Task ID.
— Action Type: The operation the appliance performs in this task.
— Submitter: The username of the admin who scheduled or submitted the task.
— Submitted Time: The date, time, and time zone when the task was submitted.
— Ticket Number: For an approval workflow, this number may be entered by the submitter to associate the
task with a help desk ticket number or a reference number.
— Approver: The username of the admin who has approved this task.
— Approver Comments: Comments entered by the approver.
— Execution Status: The execution status of the task. Possible values are Completed, Failed, Pending, and
Executing.
— Execution Time: The date, time, and time zone when the task was executed.
— Affected Objects: The name of the object and object type.
4. The Warnings/Errors tab of the Scheduled Task Details wizard displays error or warning messages related to
tasks. It also displays object execution details. This table is blank if there are no error messages or warnings. You
can view the error message and the name of the zone with which the error or warning message is associated.
5. Click Close to close the dialog box.

About HSM Signing

You can integrate a Grid with third-party, network-attached Hardware Security Modules (HSMs) for secure private key
storage and generation, and zone-signing off-loading. Infoblox appliances support integration with either SafeNet
HSMs or Thales HSMs. When using a network-attached HSM, you can provide tight physical access control, allowing
only selected security personnel to physically access the HSM that stores the DNSSEC keys. When you enable this
feature, the HSM performs DNSSEC zone signing, key generation, and key safe keeping.
Note that if you migrate from using the Grid Master to HSMs, HSM signing starts at the next key rollover.
Only a superuser can configure this feature. To configure HSM signing in a Grid, do the following:
1. Create the HSM group and add HSMs to the group. You can create either a SafeNet HSM group or a Thales HSM
group. You can use only one group at a time. After you add the HSM group, the Add icon and Add button in the
Toolbar are greyed out.
— For information on adding an SafeNet HSM group, see Configuring a SafeNet HSM Device on page 988.
— For information on adding a Thales HSM group, see Adding and Managing a Thales HSM Group on page
989.
Note that if you delete an HSM or an HSM group, it is permanently deleted. It is not stored in the Recycle Bin.
2. Enable HSM signing. For information, see Enabling HSM Signing on page 991.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 987

DNSSEC

After you enable this feature, you can monitor the HSM group, as described in Monitoring the HSM Group on page
990. In addition, the Grid sends SNMP traps when zone signing succeeds or fails. For information about these traps,
see Processing and Software Failure Traps on page 1398.
Note that NIOS does not provide key life cycle management functions; these are handled by the HSM and must be
configured via the HSM's administrative interface to adhere to corporate policies on key management. The keys (ZSK
and KSK) used for DNSSEC are stored securely on the HSM and are not deleted by NIOS when the key is no longer
required by the DNSSEC function. However, references to the keys are removed from the appliance.

Configuring a SafeNet HSM Device

You can integrate a Grid with a SafeNet HSM group. The SafeNet HSM group can contain either SafeNet Luna SA 4 or
SafeNet Luna SA 5 devices in standalone or HA mode; the group cannot contain a mix of both models. You must first
configure each HSM device, as described in Configuring a SafeNet HSM Device; and then create the group and add
the devices to the group, as described in Adding a SafeNet HSM Group.

Configuring a SafeNet HSM Device

Do the following for each SafeNet HSM device that you are adding to the group:
1. On the Grid, generate a client certificate for the Grid Master and Grid Master Candidate. For information, see
About Client Certificates on page 65.
2. On the SafeNet HSM, do the following:
— Assign the Grid Master and Grid Master Candidate to a partition on the HSM to avoid any service
interruptions, in case the Grid Master Candidate is promoted to Grid Master.
— Upload the certificates of the Grid Master and Grid Master Candidate to the HSM and register the
certificates in the HSM’s list of clients. The certificates of the Grid Master and Grid Master Candidate are
linked to their IP addresses. Therefore, if any of their IP addresses change, you must generate a new client
certificate and register it with the HSM.
Note that if the HSM is configured and you replace an appliance that was a Grid Master or Grid Master
Candidate and you backed up the database of the old appliance and restored it on the replacement
appliance, the certificates remain intact. Therefore, you do not need to regenerate a new certificate for the
replacement, as long as the IP address does not change.
— Download the HSM certificate.

Note: Make sure that the common name used in the certificates is distinct when you configure HSM servers in
HA mode.

For additional information, refer to your SafeNet HSM documentation.

988 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About HSM Signing

Adding a SafeNet HSM Group

When you configure a SafeNet HSM group, add the SafeNet HSM devices to the group and upload their certificates to
the Grid. You can add only one HSM group. To add a SafeNet HSM Group:
1. From the Grid tab, select the HSM Group tab.
2. Click the Add drop-down list and select HSM SafeNet Group.
3. In the Add HSM SafeNet Group wizard, complete the following and click Next:
— Name: Enter a name for the HSM group.
— Partition Password: Enter the partition password, and re-enter it in the Confirm Partition Password field.
— Version: Select the SafeNet HSM version, which is either LUNA SA 4 or LUNA SA 5.
— Comment: You can enter additional information about the HSM.
4. Click the Add icon to add a SafeNet HSM device, and complete the following:
— Name or IP Address: Enter the hostname or IP address of the HSM device.
— Partition SN: Enter the partition serial number (PSN) of the HSM. The Partition ID field automatically
displays the ID after the configuration is saved and the appliance has successfully connected to the device.
— Disabled: Select this check box to disable use of this HSM.
— Server Certificate: Upload the certificate of the SafeNet HSM.
5. Save the configuration.
After you add the HSM group, the Add icon and Add button in the Toolbar are greyed out. Note that if the HSM is
configured in FIPS 140-2 compliant mode, certain key algorithms and key sizes are disallowed. Requests for those
key algorithms or key sizes result in an error. The following algorithms are FIPS 140-2 compliant: DSA, DSA/NSEC3,
RSA/SHA1, RSA/SHA1/NSEC3, RSA/SHA-256, and RSA/SHA-512. For additional information about selecting key
algorithms, see About the DNSKEY Algorithm on page 974.
You can verify whether the Grid Master Candidate is properly registered with the HSM by navigating to the Grid -> Grid
Manager -> Members page. It’s Status icon is yellow if it is not registered with the HSM.
If DNS service is enabled, you can also verify whether the Grid Master was able to contact the SafeNet HSMs by
navigating to the Data Management > DNS > Members page. If the Grid Master status is yellow, check the status of the
HSMs in the Grid > HSM Group page. (For more information, see Monitoring the HSM Group on page 990.) If the status
is not green, check the configuration of the HSMs and restart the DNS service.

Adding and Managing a Thales HSM Group

On the Thales HSM, configure the Grid Master and Grid Master Candidate as HSM clients. Enroll the IP addresses of
both the Grid Master and Grid Master Candidate to avoid any service interruptions, in case the Grid Master Candidate
is promoted to Grid Master. If the Grid Master and Grid Master Candidates are HA pairs, you must enroll their VIPs.

Note: In the unlikely event that the Grid Master Candidate was registered with the Thales HSM after the Grid Master
promotion, you must restart the DNS service on the newly promoted Grid Master.

In addition, you must also set up client cooperation to allow both the Grid Master and Grid Master Candidate access
to the Remote File Server (RFS). Note that anytime you add a new Grid Master Candidate, you must enroll its IP
address and set up a client cooperation to allow it access to the RFS. For more information on these procedures, refer
to your HSM documentation.
Note that DSA cannot be used as the DNSSEC cryptographic algorithm for Thales HSMs. Therefore, migrating to Thales
HSMs is not allowed if the Grid Master uses DSA as the DNSSEC cryptographic algorithm.
You can create one Thales HSM group in the Grid, and then add HSMs to the group. The appliance tries to connect to
each of the HSMs in the order that they are listed.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 989

DNSSEC

To add a Thales HSM group:

1. From the Grid tab, select the HSM Group tab and click the Add icon.
2. In the Add HSM Group wizard complete the following, and then click Next:
— Name: Enter a name for the HSM group.
— Protection: Select the level of protection that the HSM group uses for the DNSSEC key data.
— Module: Select this if the HSM group uses a module-protected key. You do not have to enter a
password phrase for this type of key.
— Softcard: Select this if the HSM group uses a softcard-protected key. You must then specify the card
name and password.
— Card Name: Enter a name for the softcard.
— Password Phrase: Enter the password and re-enter it in the Confirm Password Phrase field.
— RFS IP Address: Enter the remote file server (RFS) IP address. Note that you must ensure that you enter a
valid RFS IP address for the Security World. Validation is limited to IP address checking. Infoblox
recommends that you use Test HSM Group to check the HSM group configuration before proceeding.
— RFS Port: Specify the port of the RFS.
— Comment: Optionally, enter additional information about the group.
3. To add modules to the group, click the Add icon and complete the following:
— Remote IP: Enter the IP address of the HSM.
— Remote Port: Specify the destination port on the HSM. The firewall must be configured to allow connection
to this port.
— Disabled: Select this check box to disable use of this HSM.
— Keyhash: Enter the keyhash, which is displayed on the console of the HSM. It can be obtained through an
out of band mechanism from the HSM administrator. Note that the appliance validates the keyhash. If the
entry is correct, the appliance displays the Electronic Serial Number (ESN) of the HSM when the editor is
next launched. If the keyhash is incorrect, the appliance does not connect to the HSM.
— ESN: This is a read-only field that displays the ESN of the HSM after you save the configuration and relaunch
the editor. Infoblox strongly recommends that you verify the ESN displayed by the appliance with the one
obtained from the HSM administrator to ensure that the appliance is communicating with the correct HSM.
4. Save the configuration.

Monitoring the HSM Group

You can monitor the status of the HSM group and of individual modules in the group by navigating to the Grid tab >
HSM Group panel. To view the status of each HSM, click the arrow beside the group name. This panel displays the
following information:
• Name: The name of the HSM group or module.
• Status: The HSM group status displays the status for all the HSMs in the group. The status icon can be one of
the following:
Green: All the HSMs in the group are functioning properly.
Yellow: At least one HSM in the group is not functioning properly.
Red: All the HSMs in the group are not functioning properly.
Black: The status of the HSM devices is unknown.
The status icon for each HSM can be one of the following:
Green: The HSM is functioning properly. For SafeNet Luna SA 5 devices, the status icon can also display x% used
which refers to the storage capacity of the HSM partition that is assigned to the Grid. Note that when the
capacity reaches 100%, new zone signings and key rollovers for existing zones cannot be performed.
Red: The HSM is not functioning properly. For a SafeNet HSM, this indicates that the Grid Master was able to
connect to the HSM, but no partition was assigned to the Grid Master.

990 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Grid Members to Support DNSSEC as Secondary Servers

Black: The status of the HSM device is unknown.

• FIPS: This applies to a SafeNet HSM only. It indicates if the HSM is in FIPS compliant mode.
• Comment: Any comments that were entered about the HSM group.
You can also do the following in this tab:
• Sort the data in ascending or descending order by column.
• Print and export the data in this tab.

Enabling HSM Signing

When you enable HSM signing, the HSM starts generating the DNSSEC keys at the next key rollover. For information
about key rollovers, see About Key Rollovers on page 974. You can enable this feature at the Grid level only.
To enable HSM signing:
1. From the Data Management tab -> DNS tab, expand the Toolbar and click Grid DNS Properties.
2. In the Grid DNS Properties editor, Click Toggle Expert Mode, if the editor is in Basic mode, and then select the
DNSSEC tab.
3. In the DNSSEC tab, select the Enable DNSSEC check box, if it is not selected, and then select the HSM Signing
check box.
4. Complete the other fields described in Configuring DNSSEC Parameters on page 975. Note that Thales HSMs do
not support DSA.
5. Save the configuration.

Testing the HSM Group

After you configure the HSM group, you can test the HSM signing functionality of the group. Click Test HSM Group in
the Toolbar, and then click Yes when the confirmation dialog displays. The appliance then executes the command to
perform a signing test. The feedback panel displays the status of the test in the Grid Manager feedback panel.

Synchronizing the HSM Group

You can click Resync HSM Group in the Toolbar to do any of the following:
• For a Thales HSM group, if the RFS security settings change use this function to have the appliance perform an
RFS synchronization.
• For a SafeNet HSM group, use this function to synchronize the keys of the HSM members in the group.

Configuring Grid Members to Support DNSSEC as Secondary

Servers
Any Infoblox Grid member can function as a secondary server for DNSSEC signed zones. It can receive transfers of
signed zones from the Grid Master or an external primary server, and from other secondary servers. It can also
respond to queries for DNS data in DNSSEC signed zones for which it is a secondary server.

Configuring a Secondary Server for Signed Zones

The following are the tasks to configure an appliance as a secondary server for signed zones:
1. Enable DNSSEC on the appliance. For information, see Enabling DNSSEC on page 973.
2. Configure the appliance as a secondary server for the zone. For information, see Specifying Secondary Servers
on page 843.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 991

DNSSEC

3. If the primary server for the signed zone is external, then you must allow zone transfers to the secondary server.
For information, see Enabling Zone Transfers on page 788. If the primary server is the Grid Master, then the
secondary server receives data through the Grid replication process by default.

Configuring Recursion and Validation for Signed Zones

When you enable recursion on a Grid member and it receives a recursive query for DNS data it does not have, it
queries remote name servers that you specified in the Grid DNS Properties or Member DNS Properties editor. It then
includes the DNSSEC data it retrieved through recursion in its responses to clients that requested DNSSEC RRs. You
can enable the appliance to validate the responses of these servers for certain zones. On the appliance, you specify
the zones to validate and configure their DNSKEY records as trust anchors. When the appliance validates a response
for a zone configured with a trust anchor or for any of its child zones, the appliance starts with the DNSKEY that you
configured and proceeds recursively down the DNS tree.
In the example shown in Figure 22.5, the following was configured on the NIOS appliance:
• Forwarder with the following IP address: 10.2.2.1
• Recursion was enabled
• DNSSEC and validation were enabled
• The corp100.com zone and its DNSKEY record were configured

Figure 22.5

1 A security-aware resolver 2 The appliance does not have the 3 The forwarder sends the
sends a recursive query for requested data. It sends a request response to the NIOS appliance
data in the corp100.com zone. to the configured forwarder, along with the appropriate
10.2.2.1. DNSSEC RRs.

1 2

5 3
4
corp100.com with 10.2.2.1
DNSKEY record

5 The appliance sends the response 4 The appliance uses the configured
to the DNS client. The AD bit is set DNSKEY RR of the corp100.com
to indicate that the appliance zone to validate the response.
validated the data.

Enabling Recursion and Validation for Signed Zones

The following are the tasks to enable recursion and validate recursively derived data:
1. Enable DNSSEC on the appliance. For information, see Enabling DNSSEC on page 973.
2. Enable validation and configure the trust anchor of each signed zone. For information, see Enabling DNSSEC
Validation on page 993. You must configure at least one trusted DNSKEY RR.
3. Enable recursion on the appliance. For information, see Enabling Recursive Queries on page 769.
4. Complete any of the following:
— Configure the forward, delegated, stub or root zones for the signed zones. For information, see Configuring
Delegated, Forward, and Stub Zones on page 857 and Creating a Root Zone on page 832.
— Configure global forwarders and custom root name servers, if needed. For information, see Using
Forwarders on page 767 and About Root Name Servers on page 792.

992 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Recursion and Validation for Signed Zones

Enabling DNSSEC Validation

To configure trust anchors and enable Infoblox name servers to validate responses:
1. Grid: From the Data Management tab, select the DNS tab. Expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the Members tab -> member check box and click the Edit icon.
DNS View: From the Data Management tab, select the Zones tab -> dns_view check box and click the Edit icon.
To override an inherited property, click Override next to the property to enable the configuration.
2. In the editor, click Toggle Expert Mode.
3. When the additional tabs appear, click DNSSEC.
4. In the DNSSEC tab, complete the following:
— Enable DNSSEC validation: If you allow the appliance to respond to recursive queries, you can select this
check box to enable the appliance to validate responses to recursive queries for domains that you specify.
You must configure the DNSKEY RR of each domain that you specify.
— Accept expired signatures: Click this check box to enable the appliance to accept responses with signatures
that have expired. Though enabling this feature might be necessary to work temporarily with zones that
have not had their signatures updated in a timely fashion, note that it could also increase the vulnerability
of your network to replay attacks.
— Trust Anchors: Configure the DNSKEY record that holds the KSK as a trust anchor for each zone for which the
Grid member returns validated data. Click the Add icon and complete the following:
— Zone: Enter the FQDN of the domain for which the member validates responses to recursive queries.
— Secure Entry Point (SEP): This check box is enabled by default to indicate that you are configuring a
KSK.
— Algorithm: Select the algorithm of the DNSKEY record: RSA/SHA1(5), DSA (3), DSA/NSEC3 (6),
RSA/MD5 (1), RSA/SHA1/NSEC3 (7), RSA/SHA-256 (8), or RSA-SHA-512 (10). This must be the same
algorithm that was used to generate the keys that were used to sign the zones.
— Public Key: Paste the key into this text box. You can use either of the following commands to retrieve
the key:
• dig . dnskey +multiline
The above command retrieves root zone keys and is the only public key you require for full chain of trust
validation.
• dig [@server_address] <zone> dnskey +multiline +dnssec
The above command retrieves public keys from the zone you specify on the server and can be used if
the parent zone is not signed.
Note that the aforementioned command provides you with a key you need to cross validate against other
servers to ensure you have an identical key.
As an alternative, you can use http://data.iana.org/root-anchors/ to retrieve signed public keys. You can
find the trust anchors in formats like XML and CSR. For more information, refer to
http://data.iana.org/root-anchors/draft-icann-dnssec-trust-anchor.txt.
— Negative Trust Anchors: Configure negative trust anchors to suppress DNSSEC validation for certain
domains. Click the Add icon to add the domain name to the list. You can define negative trust anchors at
the Grid level and override them at the member and DNS view levels. For more information about negative
trust anchors, see Defining Negative Trust Anchors on page 994.
To delete a negative trust anchor, select the check box adjacent to the Zone column and click the Delete
icon.
5. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 993

DNSSEC

Defining Negative Trust Anchors

A DNSSEC misconfiguration is not uncommon, and it can lead to failures in validating clients for particular domains.
You can use negative trust anchors to enhance the deployment of DNSSEC validation even with misconfigured
domains, as the administrator can enable DNSSEC validation without worrying about resolution failure for
misconfigured signed domains that succeeds without DNSSEC validation.
A negative trust anchor is a domain name for which DNSSEC validation must be suppressed even if the domain name
is listed under a trust anchor.
You can define a negative trust anchor at the Grid level and override it at the member and DNS view levels. You can
define negative trust anchors within a view or at the Grid level. If you define it at both levels, only the configuration
with the view will be effective for the respective view.
For any specific domain name, negative trust anchors are mutually exclusive of trusted anchors; if a negative trust
anchor is specified for a domain name, you cannot configure a trust anchor using the same name. Likewise, if a trust
anchor is configured for a domain name, you cannot configure negative trust anchor using the same name.
Note that if there is a trust anchor for a specific name under a negative trust anchor, that trust anchor will re-enable
DNSSEC validation for query names covered by the trust anchor. For example, if you configure trust anchors for “.”
and “example.com,” and “com” is in the negative trust anchor list, queries for “www.example.com” are subject to
DNSSEC validation, while DNSSEC validation will be suppressed for www.insecure.com, even if “.” is listed in the trust
anchor.
The appliance does not support automatic cleanup of negative trust anchors, nor does it provide any information
about their expiration. Administrators must manually keep track of the status of domains listed as a negative trust
anchor, and must remove them from the list as soon as the domains become DNSSEC signed correctly. Infoblox
recommends that you do not use negative trust anchors, and rather disable DNSSEC validation, if the administrator
is not familiar with negative trust anchors or is not able to maintain the negative trust anchors properly; careless use
of negative trust anchors would rather hinder the deployment of DNSSEC, which is the opposite to the purpose of
negative trust anchors. For more information about general technical details of negative trust anchors, refer to
http://tools.ietf.org/html/draft-livingood-negative-trust-anchors.
Note the following about negative trust anchors:
• You must restart the DNS service when you modify the list of negative trust anchors.
• The appliance displays an error message if an entry is present in both the trust anchors and the negative trust
anchors list for the same FQDN.
• The appliance displays an error message if the same FQDN is present multiple times in a negative trust anchor.
• When DNSSEC validation is suppressed due to a negative trust anchor, the corresponding response from the
validating resolver does not include the AD bit.

994 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Applying Policies and Rules to DNS Queries that Request DNSSEC Data

Applying Policies and Rules to DNS Queries that Request DNSSEC

Data
You can configure the NIOS appliance to always apply RPZ policies, DNS blacklists, or NXDOMAIN rules to DNS
queries, regardless of whether the queries request DNSSEC data. You can also configure the appliance to generate
synthesized AAAA records for DNS queries that request DNSSEC data.

WARNING: When you enable this feature, NIOS applies the selected policies and rules even when it responds
to DNS clients that support DNSSEC. Note that responses to these clients may result in resolution
failure. Infoblox recommends that you use caution when enabling this feature and DNSSEC
validation at the same time.

To enable this feature, complete the following:

1. Grid: From the Data Management tab, select the DNS tab. Expand the Toolbar and click Grid DNS Properties.
Member: From the Data Management tab, select the DNS tab -> Members tab -> member check box and click the
Edit icon.
DNS View: From the Data Management tab, select the DNS tab -> Zones tab -> default dns_view and click the Edit
icon.
2. In the editor, click Toggle Expert Mode, if the editor is in Basic mode, and then select the DNSSEC tab.
3. In the Apply the selected policies/rules to queries requesting DNSSEC records section, complete the following:
— Response Policy Zones (RPZ) policies: Select this to apply RPZ policies to DNS queries that request DNSSEC
data. You must install the RPZ license to view this check box. For more information, see About Infoblox DNS
Firewall on page 1671.
— Blacklist rules: Select this to apply blacklist rules to DNS queries that request DNSSEC data. For more
information, see About Blacklists on page 784.
— NXDOMAIN rules: Select this to apply NXDOMAIN rules to DNS queries that request DNSSEC data. This
check box is visible only if you install the Query Redirection license. For more information, see About
NXDOMAIN Redirection on page 772.
— DNS64 Groups: Select this to generate synthesized AAAA records for DNS queries that request DNSSEC
data. For more information, see Enabling DNS64 Service on page 803.
The member and the DNS views inherit settings from the Grid, by default. To override the settings, click
Override. You can override settings at the member and DNS view levels. To retain the same settings as the
Grid, click Inherit at the member and DNS view level.
4. Save the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 995

DNSSEC

996 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 23 Managing DNS Traffic Control
This chapter describes the Infoblox DNS Traffic Control solution. It provides guidelines about how to adjust DNS
responses based on DNS query source IP, server availability, and network topology. It also describes the required
objects in this process such as DTC (DNS Traffic Control) servers, pools, and LBDNs (Load Balanced Domain Names),
and how to configure them to achieve the best load balancing results.
It includes the following sections:
• About DNS Traffic Control on page 999
— DNS Traffic Control Configuration Example on page 999
— DNS Traffic Control Querying Process on page 1001
— Supported DNS Traffic Control Objects on page 1002
• License Requirements and Admin Permissions on page 1002
• Limitations of DNS Traffic Control on page 1003
• Configuring Topology Rules and Rulesets on page 1003
— Defining Topology Rulesets on page 1003
— Managing and Viewing Topology Rulesets and Rules on page 1005
— Importing a Topology Database on page 1006
• About Health Monitors on page 1006
— Configuring DNS Traffic Control Health Monitors on page 1007
— Managing Health Monitor Certificates on page 1007
— Modifying Health Monitors on page 1014
— Deleting Health Monitors on page 1015
— Viewing Health Monitors on page 1015
• Managing DNS Traffic Control Objects on page 1016
— Configuring DNS Traffic Control Servers on page 1016
— Modifying DNS Traffic Control Servers on page 1018
— Configuring DNS Traffic Control Pools on page 1018
— Modifying DNS Traffic Control Pools on page 1020
— Configuring DNS Traffic Control LBDNs on page 1020
— Modifying DNS Traffic Control LBDNs on page 1024
— Testing DTC LBDNs on page 1025
— Deleting DNS Traffic Control Objects on page 1025
— Viewing DNS Traffic Control LBDNs and LBDN Records on page 1026
— Viewing DNS Traffic Control Objects on page 1026

NIOS 7.3 NIOS Administrator Guide (Rev. A) 997

Managing DNS Traffic Control

— Viewing Traffic Management Structures on page 1027

— Enabling or Disabling Traffic Management Objects on page 1029

998 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS Traffic Control

About DNS Traffic Control

Infoblox DNS Traffic Control provides a load balancing solution by adjusting DNS responses based on DNS query
source IP, server availability, and network topology. Through DNS Traffic Control, you can set up multiple global sites
and configure supported objects and load balancing methods to direct DNS clients to the best available servers.
To use this feature and bypass the standard DNS querying process, you must install the DNS Traffic Control license
on designated members. For information about license and admin requirements, see License Requirements and
Admin Permissions on page 1002. Members that are not authoritative for zones or members that do not have the
DNS Traffic Control license installed will not process DNS queries through DNS Traffic Control. However, the appliance
can process DNS queries through DNS Traffic Control for secondary servers in the Grid using the data replication
method. For more information about data replication, see Replicating DNS Data on page 1537.
DNS Traffic Control utilizes a load balancing mechanism to construct DNS responses. It returns tailored DNS
responses based on settings you configure for associated objects such as DTC (DNS Traffic Control) servers, pools,
and LBDNs. For more information about these objects, see Supported DNS Traffic Control Objects on page 1002. You
can also configure load balancing methods for pools and LBDNs based on the source IP address. For more
information, see Configuring Topology Rules and Rulesets on page 1003.
After you install valid licenses, you can add DTC servers, pools, and LBDNs and associate them with authoritative
zones. You can also configure topology rules and load balancing methods for pools and LBDNs based on how you
want to manage DNS queries. For information about how to configure these objects, see Managing DNS Traffic Control
Objects on page 1016. To ensure that DTC servers are reachable and can process DNS queries, you can also configure
health monitors that help you determine the availability of these servers. For more information, see About Health
Monitors on page 1006.

DNS Traffic Control Configuration Example

Figure 23.1 illustrates the basic concept of DNS Traffic Control and how you can use it to direct DNS clients to the best
available server using the Topology load balancing method. In the illustration, consider your company manages five
data centers: California, Denver, New York, London, and Brussels. Each data center offers the same services and
applications your users need. To optimize server utilization and minimize response time, you use DNS Traffic Control
to provide DNS responses based on the source IP address and the geographic locations of your data centers. You
define your data centers as DTC server objects, and then add them to a pool based on their locations. Data centers
in California, Denver, and New York go into Pool USA while London and Brussels go into Pool EU. You also create a
topology ruleset containing geography rules that is used when you configure Topology as the load balancing method
for your LBDN and pools. To ensure that your data centers are available, you also configure health monitors so that
your pools can check the health of its DTC servers.
In DNS Traffic Control, you complete the following to set up the configuration:
1. Define a Geography Rule for the topology ruleset, as described in Configuring Topology Rules and Rulesets on
page 1003.
2. Configure each data center as a DTC server object, as described in Configuring DNS Traffic Control Servers on
page 1016.
3. Configure health monitors that NIOS will use to check the availability of DTC servers, as described in Configuring
DNS Traffic Control Health Monitors on page 1007.
4. Create two pools (USA and EU), which group your servers by geographical locations, configure health monitors
that you created earlier, and then select Topology as the load balancing method. For information, see Configuring
DNS Traffic Control Pools on page 1018.
5. Define an LBDN and select Topology as the load balancing method and then associate it with a DNS zone. The
appliance can then match the geography of the source IP addresses and direct the client to the best available
server. For information, see Configuring DNS Traffic Control LBDNs on page 1020.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 999

Managing DNS Traffic Control

Figure 23.1 DNS Traffic Control Example

Admin Grid Manager

Grid Master

Grid Member with DNS

Traffic Control enabled
DNS request contains Based on topology rules, the client should
source IP = 195.72.x.x have been directed to the Brussels data
(matches a Brussels center. However, based on the health
location in the topology check, Brussels is down; so the response
database) returns the London address.
LBDN

Pool = USA Pool = EU

Health Check Health Check

California Denver New York London Brussels

After you have set up DNS Traffic Control and have defined DTC objects, you can monitor their status through the
Traffic Management tab in Grid Manager. For information about viewing these objects, see Viewing DNS Traffic Control
Objects on page 1026. You can also view the hierarchy of DNS Traffic Control objects that Infoblox supports. For
information about how to view the hierarchical map, see Viewing Traffic Management Structures on page 1027.
To achieve load balancing results for DNS Traffic Control, you may configure DTC objects in the following order:
1. Create DNS Traffic Control servers for each data center or server you want to manage. For information, see
Configuring DNS Traffic Control Servers on page 1016.
2. Optionally, if you want to monitor server health, configure health monitors and add them to your pools when you
create them. For information, see Configuring DNS Traffic Control Health Monitors on page 1007.
3. Configure any topology rulesets that will be used by DTC Pools. For information, see Defining Topology Rulesets
on page 1003.
4. Configure DTC pools, as described in Configuring DNS Traffic Control Pools on page 1018.
5. Configure any topology rulesets that will be used with LBDNs, as described in Configuring Topology Rules and
Rulesets on page 1003.
6. Configure DTC LBDNs, as described in Configuring DNS Traffic Control LBDNs on page 1020.
For detailed information about how DNS Traffic Control handles DNS queries and responses, see DNS Traffic Control
Querying Process on page 1001. You can enable or disable logging for DNS Traffic Control load balancing and health
monitors. The appliance logs this information to the syslog. For more information, see Setting DNS Logging
Categories on page 1340.

1000 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DNS Traffic Control

DNS Traffic Control Querying Process

DNS Traffic Control handles a DNS query if the query name belongs to a zone for which the appliance is authoritative
and matches an LBDN that is linked to the respective zone. Otherwise, the appliance processes DNS queries normally
using the standard DNS query processing.
If you have configured persistence for DTC LBDN and the DTC cache contains a previous response for the same client,
then DTC returns the cached response to the respective client. Otherwise, the DNS Traffic Control querying process
first selects an LBDN, a pool, and then a specific server from that pool. A DNS record is synthesized from the address
of the selected server and returned to the client. When all the associated pools associated with the LBDNs are
unavailable, the appliance returns DNS data for the zone. For information about how to configure availability and
topology rules, see Configuring Topology Rules and Rulesets on page 1003.
Following is a brief description of the DNS Traffic Control querying process:
1. The DNS Traffic Control querying process first checks an LBDN’s DTC cache to verify if a response is available for
the same client, same query and if the server in the cached response is online. If these conditions match, it
returns the cached response to the client and refreshes the cache expiry time.
2. If the response is not available in the DNS Traffic Control cache, the DNS Traffic Control querying process occurs
as follows:
— Based on the FQDN in the request, the DNS Traffic Control querying process selects a matching LBDN based
on its associated zone and pattern.
— Based on the selected LBDN load balancing method, the DNS Traffic Control querying process selects an
available pool. It does not select pools that are not available or do not have online servers associated with
it. If pools are not available for the selected LBDN, the DNS Traffic Control querying process fails to
determine the result.
— After selecting a pool, the DNS Traffic Control querying process selects a server from the pool, based on the
load balancing method that you have selected for the respective pool. The DNS Traffic Control querying
process uses the preferred load balancing method of the pool by default and the alternate method only if
the preferred method fails to return a result.
— If the DNS Traffic Control querying process fails to determine a result, then the DNS server responds to the
client with the matching DNS records configured for the respective zone. If matching DNS records are not
configured, it returns an empty result.

Enabling Traffic Redirection Using EDNS0 Client Subnet Option

You can enable the appliance to redirect traffic according to EDNS0 client subnet option when DNS Traffic Control is
processing DNS queries that contain the EDNS0 client subnet option. When you enable this feature, DNS Traffic
Control querying process uses the client address specified in the EDNS0 client subnet option of the DNS query and
the appliance includes the EDNS0 client subnet option in the response message. If there are multiple EDNS0 client
subnet options in a query, the appliance considers only the first option and ignores the other options. When this
feature is disabled, DNS Traffic Control querying process ignores the EDNS0 client subnet option. You can enable this
feature at the Grid and member levels.
To enable traffic redirection using EDNS0 client subnet option:
1. Grid: From the Data Management tab, select the DNS tab, and then click Grid DNS Properties from the Toolbar.
Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box ->
Edit icon.
2. In the Grid DNS Properties editor and Member DNS Properties editor, select the Queries tab -> Advanced tab.
To override the Grid setting, click Override. To retain the same setting as the Grid, click Inherit.
3. Select the When DNS Traffic Control is enabled, direct traffic according to EDNS0 client subnet when possible
check box to direct traffic according to EDNS0 client subnet option when DNS Traffic Control is processing DNS
queries. This check box is deselected by default, meaning this feature is disabled. When this feature is disabled,
DNS Traffic Control querying process ignores the EDNS0 client subnet option.
4. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1001

Managing DNS Traffic Control

Supported DNS Traffic Control Objects

You can configure the following DNS Traffic Control objects in the Grid:
• Topology: A topology ruleset maps a client IP address to a DNS Traffic Control pool or server. When DNS Traffic
Control sends a DNS response, it evaluates the list of rules in the topology ruleset in the order they are listed
and uses the first match with an available destination and sends the response to the client. For more
information, see Configuring Topology Rules and Rulesets on page 1003.
• Health Monitor: A health monitor ensures that the servers are reachable and able to send and receive traffic. For
more information, see About Health Monitors on page 1006.
• Server: DNS Traffic Control synthesizes DNS records for the servers. For information about how to add and
modify servers, see Configuring DNS Traffic Control Servers on page 1016.
• Pool: A pool is a collection of servers that you can put together as possible responses to queries. For
information about how to add and modify load balancing pools, see Configuring DNS Traffic Control Pools on
page 1018.
• LBDN: A DTC LBDN is a load balanced domain name object that is used by DNS Traffic Control to process DNS
queries for load balanced resources. For more information about how to add and modify LBDN objects, see
Configuring DNS Traffic Control LBDNs on page 1020.

License Requirements and Admin Permissions

You must install the DNS Traffic Control and the DNS licenses on the appliance before you can use the DNS Traffic
Control feature. The DNS Traffic Control works as an add-on feature for the DNS service in the NIOS appliance. You can
add the DNS Traffic Control license only when you have installed the DNS license. The DNS Traffic Control feature
starts, stops, or restarts with the DNS service. You may need to restart the DNS service after you make configuration
changes. When you click Restart at the top of the screen, the DNS Traffic Control service takes some time to update
the configuration and the status of LBDNs, pools and servers on the appliance. For more information about how to
install licenses, see Managing Licenses on page 478.
Note the following about the DNS Traffic Control license:
• You can view the Traffic Management tab only if you install either the Load Balancer license or the DNS Traffic
Control license. For information about the Global Load Balancer integration features, see Managing Global Load
Balancers on page 1525.
• The appliance displays the Monitors and Topology tabs, wizard, Health Check Source and Test LBDN options
only when you install the DNS Traffic Control license.
The appliance creates a new role, DTC Admin, when you install the DNS Traffic Control license. For more information
about how to define permissions, see About Admin Roles on page 192.
• You can update, add or delete LBDNs if you have read/write permission on All DTC LBDNs, but you need
additional permissions to link them to a zone.
• You must have read/write permission on All DTC LBDNs to modify an LBDN if a configuration change results in a
deletion of LBDN records.
• You must have read/write permission on both All DTC LBDNs and All DTC LBDN Records to modify LBDN patterns
that might result in the creation of new LBDN records.
• Administrators who have access to set up zones have read/write access to their LBDN records. The LBDN
records permission is similar to other zone record permissions.
• When you link an LBDN to a zone, you must have both read-only permission on All DTC LBDNs and read/write
permission on the LBDN record of the zone.
• You must have read/write permission on All DTC LBDNs to disable an LBDN. This implicitly disables associated
LBDN records from the associated zones and does not require an LBDN record permission.
• You must have read/write permission on All DTC GeoIP to upload a MaxMind GeoIP location database. To modify
a rule in the topology ruleset, you must have read/write permission on All DTC Topologies.

1002 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Limitations of DNS Traffic Control

• To create and modify DTC pools, you must have read/write permission on All DTC Pools.
• You must have read/write permission on All DTC Servers to create and modify DTC servers.
• You must have read/write permission on All DTC Monitors, All DTC Certificates, and All DTC Topologies to create
and modify DTC monitors, certificates and topologies respectively.
For more information about defining global permissions, see Defining Global Permissions on page 196.

Limitations of DNS Traffic Control

• A member will return DNS Traffic Control results for a zone only if the member is a Grid primary, or a Grid
secondary that is using database replication. DNS Traffic Control results are not produced for zones using AXFR,
regardless of whether or not the primary member is in the Grid.
• The DNS Traffic Control querying process is not supported for recursive queries.
• DNS Traffic Control does not support the following:
— Global application of an LBDN pattern against all queries. The appliance returns a result only if the query
resolves to an authoritative zone to which an DNS Traffic Control LBDN is explicitly linked.
— SNMP.
• You can use the IDN converter for conversion, but the appliance supports manually encoded puny code as an
LBDN pattern.
• You cannot install the DNS Traffic Control license on the Infoblox 4030 appliance.
• DNS Traffic Control health monitoring does not monitor servers if the server has IPv4 and/or IPv6 addresses and
the health monitoring interface on the Grid member does not have the corresponding IP address type. The
appliance sets the status as unknown for such IPv4 and IPv6 addresses. In addition, the appliance may return a
timeout error while loading the Traffic Management tab in Grid Manager if you have configured health
monitoring for a lot of DTC servers.

Configuring Topology Rules and Rulesets

A topology rule maps a client IP address to a DNS Traffic Control pool or server. When the DNS Traffic Control returns
a response, it evaluates the list of rules in the topology ruleset in order and uses the first match with an available
destination. The method fails if there are no matches. To use Topology as the load balancing method for a pool or an
LBDN, you must define a topology ruleset containing at least one rule.
You can create, modify, or delete one or more custom topology rulesets. Each ruleset can contain multiple rules.
These rulesets are configured globally. You can either define a subnet rule or a geography rule. The destination is
either a server or a pool. An LBDN can use only topology rulesets with pool as the destination and a pool can use
topology rulesets with server as the destination. You can also use CSV import to import rules into NIOS.

Defining Topology Rulesets

A topology ruleset can contain multiple rules. The rules in a topology ruleset must use the same destination type.
Note that multiple LBDNs or pools can reuse a topology ruleset.
Each server that you use as a destination in the topology must exist in every pool that is using the topology. The
appliance displays a warning message if the topology ruleset is empty. You cannot use duplicate rules in a ruleset.
When you select Topology as a load balancing method for a pool, you can select one of these rulesets for the topology
rules. The ruleset can be a combination of subnet and/or geography rules.
Note the following about subnet and geography source matches:
• A rule with a subnet source matches if the subnet contains the client IP address.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1003

Managing DNS Traffic Control

• A rule with a geography source label matches if the client IP address and geography source label matches
corresponding information in the MaxMind location database. Note that the MaxMind location database is
static over the lifetime of the querying process until you upload a new database and restart services.
Note the following information about rules and rulesets:
• A geography label, such as a subdivision or a country must exist in the current MaxMind location database. The
appliance displays an error message if the values do not match.
• When you upload a new MaxMind location database or restore a backup, the appliance does not automatically
remove rules that contain invalid labels. Instead, it marks the rules with labels that do not exist in the database
as invalid. The appliance ignores these rules during the querying process, and you cannot save the
configuration if it is modified, but you can use the existing configuration.
• The appliance does not check specific combinations of labels when the rules use multiple conditions. For
example, a rule for Country - Canada and Continent - Africa is valid because both labels exist in the MaxMind
location database in the respective categories.
• When rules have multiple source conditions, the client must match all conditions for the rule to execute.
• A ruleset may have multiple subnet rules and the subnets may overlap. Similarly, a ruleset may have multiple
geography rules and the matches may overlap. During the querying process, the rules in a topology ruleset are
evaluated in order. For example, if you configure subnet rules where #1 is 10.10.0.0/16 and #2 is 10.0.0.0/8,
both are considered valid in the appliance.
To define rulesets, complete the following:
1. From the Data Management tab, select the Traffic Management tab -> Topology tab.
2. Click the Add icon or click Add and select Add Ruleset from the drop-down list in the Toolbar.
3. In the Ruleset wizard, complete the following:
— Name: Enter a name for the ruleset.
— Destination Type: Select a destination type, Pool or Server, from the drop-down list. You cannot change the
destination type if the ruleset contains any rules.
— Comment: Enter additional information about the ruleset.
— Rules: You can associate multiple subnets and/or geography rules with the ruleset. Click the arrow next to
the Add icon to select either a Subnet Rule or a Geography Rule.
— When you select a Subnet Rule, the appliance displays the following:
• Source Subnet: Select a value from the drop-down list. You can either select equals or does not
equal and specify a subnet IP address.
• Destination: Click Select to select a destination. The appliance displays the DTC Pool Selector
dialog box when you have selected the pool destination type and displays the DTC Server Selector
dialog box when you have selected the server destination type. Click a specific pool or server to
select it.
Click Add to add the source. The appliance displays the following information in the Rules table:
• Source: The subnet address that you specified.
• Destination Type: The destination type that you selected.
• Destination: The destination that you selected.
• Valid Source: If this is a subnet rule the rule will always be marked as valid after a Save and Close.
• Order: Displays the order of the rule in the ruleset.
— When you select a Geography Rule, the appliance displays the following:
• Source Type: Select a source type.
• Continent: Select a continent from the drop-down list. You can also enter the first few characters of
the continent to match an item in the database. The drop-down list has paging controls to page
through the available values.
• Country: Select a country from the drop-down list. You can also enter the first few characters of the
country to match an item in the database. The drop-down list has paging controls to page through
the available values.

1004 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Topology Rules and Rulesets

• Subdivision: Select a subdivision from the list. You can also enter the first few characters of the
subdivision to match an item in the database. The drop-down list has paging controls to page
through the available values.
• Destination: Click Select to select a destination. The appliance displays the DTC Pool Selector
dialog box when you have selected the pool destination type and the displays DTC Server Selector
dialog box when you have selected the server destination type. Click a specific pool or server to
select it.
Click Add to add the source. The appliance displays the following information in the Rules table:
• Source: The subnet address that you specified.
• Destination Type: The destination type that you selected.
• Destination: The destination that you selected.
• Valid Source: After a Save and Close the value will be True if the labels exist in the MaxMind
location database.
• Order: Displays the order of the rule in the ruleset.
— Default destination if none of the above rules match (optional): Click Select to select the default destination
if none of the above rules match. The appliance displays the DTC Pool Selector dialog box when you have
selected the pool destination type and displays the DTC Server Selector dialog box when you have selected
the server destination type. Click a specific pool or server to select it. You can click Clear to remove the
selected pool or server. Note that you can select a default destination even if there are no rules defined in
the Rules table.
4. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
5. Click Save & Close to save the configuration.

Managing and Viewing Topology Rulesets and Rules

To view topology rulesets, navigate to the Data Management tab -> Traffic Management tab -> Topology tab. The panel
lists the configured rulesets, their associated comments and extensible attributes.
You can do the following:
• Add new rulesets and associate rules. To add a new ruleset, click the Add icon or click the arrow next to Add and
select Add Ruleset from the drop-down list in the Toolbar. For more information, see Defining Topology Rulesets
on page 1003.
• Edit a ruleset by clicking the check box next to the name and clicking the Edit icon. You can modify the following
in the topology Ruleset editor:
In the General Basic tab, you can do the following:
— Add new rules to the ruleset. Click the arrow mark next to the Add icon and select either Subnet Rule or
Geography Rule from the drop-down list. For more information, see Defining Topology Rulesets on page
1003.
— Modify rules in a ruleset. You can edit entries in any of the fields. To edit an existing rule, click the check
box next to the Source and click the Edit icon. You can modify Destination Type only if there are no rules
in the ruleset. Click Save to save the changes. For more information, see Defining Topology Rulesets on
page 1003.
— Delete existing rules from the ruleset. Select the check box next to Source and click the Delete icon.
In the Extensible Attributes tab, you can add or edit existing extensible attributes. For information, see
Using Extensible Attributes on page 427.
• Delete a ruleset or schedule the deletion for a later time. To delete a ruleset, click the check box next to Name
and click the arrow next to the Delete icon. Select Delete from the drop-down list. Click Yes in the Delete
Confirmation dialog box to delete or No to cancel. Click Schedule Deletion and in the Schedule Change panel,
enter a date, time, and time zone to schedule deletion at a later date and time. For more information, see
Scheduling Deletions on page 90.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1005

Managing DNS Traffic Control

• Export topology rulesets. To export the entire list of rulesets in a format that can be imported, click the Export
icon and choose Export data in Infoblox CSV Import format. To export all data that is currently visible in the
Topology tab, click the Export icon and choose Export visible data.
• Print the data that is currently visible in the Topology tab. Click the Print icon to print.
• Import rulesets as CSV. For more information, see Configuring Import Options on page 104 and Viewing CSV
Import Jobs on page 106.
• Import topology database. For more information, see Importing a Topology Database on page 1006.

Importing a Topology Database

The DNS Traffic Control license includes a MaxMind location database that is deployed when you enable DNS Traffic
Control. Note that only a single MaxMind location database can be present on the Grid at a time. The MaxMind
location database contains various geography locations that can be used when you define a geography rule. NIOS
supports both paid and free GeoLite2 MaxMind location databases.
When you import a new MaxMind location database, the appliance replaces the existing database. You can import
MaxMind location databases that are in mmdb format only. To view the current version of the database, click Current
Version.
To import a MaxMind location database or to view the current version of the database, complete the following:
1. From the Data Management tab, select the Traffic Management tab -> Topology tab.
2. Click the arrow next to the Topology Database, and then select Import from the drop-down list.
3. In the Import Topology Database wizard, complete the following:
— File: Click Select and navigate to the MaxMind location database.
— Upload: Click Upload to import the MaxMind location database.
4. Click the arrow next to Topology Database, and select Current Version from the drop-down list to view the details
of the imported MaxMind location databases. Grid Manager displays the database type, build date, build
version, and the date and time when the database was deployed.

About Health Monitors

Health Monitors determine the availability of servers. You can associate health monitors with pools. Every health
monitor checks each server that is associated with the pool.
The appliance supports pre-defined monitors, which you can associate with a pool. You can create new custom health
monitors.
When you install the DNS Traffic Control license, each member that is associated with an LBDN independently
monitors the health of a server. The appliance resolves the server FQDN using the system resolver. The appliance
performs a health check on both the IPv4 and IPv6 addresses. If the member does not have the same IP address types
as the server or if the DNS name resolution for A or AAAA records fail to return results, the corresponding health check
is considered to be a failure. The appliance will cache the addresses that are resolved.
Note that monitoring is done by each Grid member that has a DNS Traffic Control license and is associated with a zone
that has an LBDN record. This implies that firewall policies should be such that the member can reach every server it
is monitoring. Otherwise, DNS Traffic Control cannot direct responses to servers that are not accessible.
By default, all monitor checks are initiated from the virtual interface of the member that is performing a health check.
If the monitored server has only an IPv4 or IPv6 address then the interface must have the corresponding IP address
type.
You can configure the monitor source to use VIP, MGMT, LAN2, ANY (normal routing), or a specific IP address for query
source. For more information, see Specifying Source Ports on page 760.
The status of a server depends upon the status of all the health monitors that are checking it. The status of a pool
depends upon the status of all the servers in the pool, and the status of the LBDN depends upon the status of all the
pools assigned to the LBDN.

1006 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Health Monitors

Configuring DNS Traffic Control Health Monitors

To configure health monitors, complete the following:
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, click the Add icon and select
a health monitor type from the drop-down list.
2. You can choose one of the following health monitor types from the drop-down list:
— HTTP Health Monitor: Select this from the drop-down list to configure HTTP health monitors. For more
information, see Configuring HTTP Health Monitors on page 1008.
— TCP Health Monitor: Select this from the drop-down list to configure TCP health monitors. For more
information, see Configuring TCP Health Monitors on page 1010.
— SIP Health Monitor: Select this from the drop-down list to configure SIP health monitors. For more
information, see Configuring SIP Health Monitors on page 1010.
— ICMP Health Monitor: Select this from the drop-down list to configure ICMP health monitors. For more
information, see Configuring ICMP Health Monitors on page 1012.
— PDP Health Monitor: Select this from the drop-down list to configure PDP health monitors. For more
information, see Configuring PDP Health Monitors on page 1013.
— SNMP Health Monitor: Select this from the drop-down list to configure SNMP health monitors. For more
information, see Configuring SNMP Health Monitors on page 1013.
3. Complete the details in the corresponding wizard.
4. Click Next to add extensible attributes. For information, see Using Extensible Attributes on page 427.
5. Save the configuration.
To schedule this task, click the Schedule icon at the top of the wizard. In the Schedule Change panel, click Later, and
then specify a date, time, and time zone.

Managing Health Monitor Certificates

You can upload multiple certificates to the appliance and associate them with HTTP and SIP health monitors. The
appliance supports certificates that are in PEM or PKCS#12 format only. A PEM file can contain more than one
certificate. Note that the uploaded certificate must include both the client certificate and the private key. You can add,
delete or view certificates.
To manage health monitor certificates:
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, and click Manage Health
Monitor Certificates in the Toolbar.
2. In the Health Monitor Certificates dialog box, click the Add icon.
3. In the Upload dialog box, click Select and navigate to the certificate you want to upload.
4. Select the file and click Upload.
The appliance displays the following information in the Health Monitor Certificates dialog box:
• Issuer: The name of the trusted CA that issued the certificate.
• Valid From: The date from which the certificate becomes valid.
• Valid To: The date until which the certificate is valid.
• Subject: The name of the certificate.
To upload a certificate from a web browser, follow the steps mentioned below:
1. Export a PEM file from a web browser.
2. Generate a private key using the following command:
— openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout mycert.pem -out
mycert.pem
3. Copy the private key section out of mycert.pem and add it to the PEM file from the web browser.
4. Or add both the PEM and the private key together as PKCS#12.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1007

Managing DNS Traffic Control

You can also do the following in the Health Monitor Certificates dialog box:
• Click the check box next to the issuer and click the Delete icon to delete it.
• Print the data or export it in .csv format.

Configuring HTTP Health Monitors

An HTTP health monitor will send either an HTTP or HTTPS request to the server. The health check monitor then
examines the response received from the server. The validation is successful if the server returns a response with the
expected result code. The monitor ignores the response content and terminates the connection prematurely after
receiving the response header.
The HTTP/HTTPS monitor validates the response code only. It does not check response content, and it does not
support user name or password authentication. You can specify a multi-line message and include HTTP headers in
the HTTP request.
The HTTP 1.1 contains a request line and a single host header:
Example 1:
GET / HTTP/1.1
Host: www.yoursite.com
Connection: close
Example 2:
GET /index.html HTTP/1.1
Host: www.example.com
Note that the lines are terminated with two chars “\r\n”. The whole request terminates with an empty line
“\r\n\r\n” character sequence. NIOS adds “\r\n\r\n” string if it is absent. You can request “GET /” instead of
“GET /index.html”.
The host header differentiates between several HTTP servers that are running on a single IP address on the same port.
In HTTP 1.1, the server keeps the connection alive by default after the response is sent. You can disable the
connection by adding a Connection: close header line to the request.
An HTTP 1.0 request may consist of a single line followed by the automatically added “\r\n\r\n”:
GET /index.html HTTP/1.0
Or in the most simple form:
GET / HTTP/1.0
The server will close the connection after the response has been sent. You can use Connection: Keep-Alive
header to alter this behavior. The “Content-Length” header is important to determine the end of the response for
keep-alive connections.
Apart from HTTP 1.0/1.1, NIOS also supports a request format known as HTTP 0.9:
GET /index.html
or
GET /
Normally, the response header consists of a response line, such as “HTTP/1.1 200 OK” or “HTTP/1.0 400 Bad
Request”, followed by a couple of header lines, and then by an empty line which signals the end of the response
header. With HTTP 0.9, the response immediately starts with the content of the requested file, which means that there
is no HTTP return code for an HTTP 0.9 request.
The header lines of an HTTP request have the simple “name: value” syntax. The request headers are used to pass
cookies, authentication, and provide information about the client to the server, etc.
To configure an HTTP health monitor, complete the following:
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, and then click the Add icon
and select HTTP Health Monitor from the drop-down list.
2. In the HTTP Health Monitor wizard, complete the following:
— Name: Enter a name for the HTTP monitor.
— Comment: Enter information about the HTTP monitor.

1008 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Health Monitors

— Interval (seconds): Enter the interval value in seconds. The interval value is measured from the end of the
previous monitor cycle. The default value is five.
— Timeout (seconds): Enter the timeout value in seconds. The monitor waits for the number of seconds that
you specify after sending a response. If it does not receive a response within the number of seconds that
you specify, then the appliance considers this check as failed. The monitor discards any response it
receives after the timeout. The default value is 15.
— Retry Up Count: Enter a retry up count. When you specify a value, the appliance checks whether the server is
up based on the following: interval*retry up count. For example, if you specify the interval as five
seconds and the retry up count as 10 seconds, then the appliance tries to connect to the server every five
seconds for a period of 50 seconds. If the server is down initially, the appliance tries to connect to the
server for a period of 50 seconds in sequence. When the connection is successful, the HTTP monitor
considers the server to be up. If the server is unavailable for an entire period of 50 seconds, the appliance
considers this connection as a failure.
— Retry Down Count: Enter a retry down count. The HTTP monitor considers the server unavailable only if the
server is unavailable during the period: interval*retry down count. For example, if you specify the
interval as five seconds and the retry down count as 10 seconds, then the appliance checks if the server is
unavailable for 50 seconds in sequence. If the server is unavailable for an entire period of 50 seconds, the
appliance considers the server to be down.
3. Click Next and complete the following:
— HTTP Request: Specify the HTTP request to send the query from the client to the server. The appliance
displays GET / by default. You can specify a HTTP request up to 1024 characters.
— Expected Return Code: The response code expected from the server. Select a value from the drop-down list:
any, equals, and does not equals. The appliance displays any by default. When you select equals or does
not equals, the appliance displays 200 by default.
— Port: For HTTP, the appliance displays port number 80 by default. When you select HTTPS, the appliance
displays 443 by default.
— Use HTTPS: Select the check box to enable HTTPS.
— Client Certificate: Optionally, you can select a certificate to use while opening the SSL connection for
HTTPS. The monitor does not inspect or validate the server certificate, if any.
— Ciphers: Specify a list of SSL ciphers in an OpenSSL format. You can specify cipher texts up to 1024
characters. The client certificate and cipher list are only used for HTTPS transport. The following example
commands list some available ciphers:
Example 1:
$ openssl ciphers 'HIGH:!DES'
DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:
DHE-DSS-CAMELLIA256-SHA:ADH-AES256-SHA:ADH-CAMELLIA256-SHA:AES256-SHA:
CAMELLIA256-SHA:PSK-AES256-CBC-SHA:EDH-RSA-DES-CBC3-SHA:
EDH-DSS-DES-CBC3-SHA:ADH-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:
PSK-3DES-EDE-CBC-SHA:KRB5-DES-CBC3-SHA:KRB5-DES-CBC3-MD5:DHE-RSA-AES128-SHA:
DHE-DSS-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:
ADH-AES128-SHA:ADH-CAMELLIA128-SHA:AES128-SHA:CAMELLIA128-SHA:
PSK-AES128-CBC-SHA
Example 2:
$ openssl ciphers 'DEFAULT:!EDH+aRSA'
DHE-DSS-AES256-SHA:DHE-DSS-CAMELLIA256-SHA:AES256-SHA:CAMELLIA256-SHA:
PSK-AES256-CBC-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA:
KRB5-DES-CBC3-SHA:KRB5-DES-CBC3-MD5:DHE-DSS-AES128-SHA:DHE-DSS-SEED-SHA:
DHE-DSS-CAMELLIA128-SHA:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:
PSK-AES128-CBC-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:KRB5-RC4-SHA:KRB5-RC4-MD5:
EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:KRB5-DES-CBC-SHA:KRB5-DES-CBC-MD5:
EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-KRB5-RC2-CBC-SHA:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1009

Managing DNS Traffic Control

EXP-KRB5-DES-CBC-SHA:EXP-KRB5-RC2-CBC-MD5:EXP-KRB5-DES-CBC-MD5:EXP-RC4-MD5:
EXP-KRB5-RC4-SHA:EXP-KRB5-RC4-MD5

Note: The DHE cipher list family (“Diffie-Hellman key agreement” plus “RSA authentication”) could consume
excessive CPU and is excluded from the defaults used by DNS Traffic Control health monitors. Although
you can enable these ciphers by explicitly configuring them in the cipher list for HTTPS and SIP monitors,
you should be aware that doing so will increase CPU usage. Since health monitoring in general does not
require high security, Infoblox recommends that you enable these ciphers only for target servers that do
not accept other types of ciphers.

4. Click Next to add extensible attributes. For information, see Using Extensible Attributes on page 427.
5. Save the configuration.

Configuring TCP Health Monitors

A TCP monitor opens a TCP connection to communicate between the appliance and server. The connection is
successful only when the handshake is complete. A successfully opened connection will be immediately closed or
reset.
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, and then click the Add icon
and select TCP Health Monitor from the drop-down list.
2. In the TCP Health Monitor wizard, complete the following:
— Name: Enter a name for the TCP health monitor.
— Comment: Enter information about the TCP health monitor.
— Interval (seconds): Enter the interval value in seconds. The health monitor runs only for the specified
interval and it is measured from the end of the previous monitor cycle. The default value is five.
— Timeout (seconds): Enter the timeout value in seconds. The monitor waits for the number of seconds that
you specify after sending a response. If it does not receive a response within the number of seconds that
you specify, then the appliance considers this check as failed. The monitor discards any response it
receives after the timeout. The default value is 15.
— Retry Up Count: Enter a retry up count. When you specify a value, the appliance checks whether the server is
up based on the following: interval*retry up count. For example, if you specify the interval as five
seconds and the retry up count as 10 seconds, then the appliance tries to connect to the server every five
seconds for a period of 50 seconds. If the server is down initially, the appliance tries to connect to the
server for 50 seconds in sequence. When the connection is successful, the TCP monitor considers the
server to be up. If the server is unavailable for an entire period of 50 seconds, the appliance considers this
connection as a failure.
— Retry Down Count: Enter a retry down count. The TCP monitor considers the server unavailable only if the
server is unavailable during the period: interval*retry down count. For example, if you specify the
interval as five seconds and the retry down count as 10 seconds, then the appliance checks if the server is
unavailable for 50 seconds in sequence. If the server is unavailable for an entire period of 50 seconds, the
appliance considers the server to be down.
— Port: Specify a port for TCP connection. You can specify a value between zero and 65535.
3. Click Next to add extensible attributes. For information, see Using Extensible Attributes on page 427.
4. Save the configuration.

Configuring SIP Health Monitors

A SIP monitor sends a standard SIP OPTIONS request to the server. You cannot modify this request. The monitor
accepts only direct responses from the server and does not open alternate connections. The SIP monitor determines
the health of the SIP server such as SIP proxies and session border controllers, and SIP gateways by issuing SIP
OPTIONS to the server and examining the response provided by the server. The service is considered available if the
response received from the server matches the expected response.

1010 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Health Monitors

The SIP monitor does not support SCTP transport. It does not receive SIP connections. Responses are normally
received over the same connection as the request was sent. The server does not attempt to open a new connection
to send the response when it encounters an error message.
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, and then click the Add icon
and select SIP Health Monitor from the drop-down list.
2. In the SIP Health Monitor wizard, complete the following:
— Name: Enter a name for the SIP health monitor.
— Comment: Enter information about the SIP health monitor.
— Interval (seconds): Enter the interval value in seconds. The health monitor runs only for the specified
interval and it is measured from the end of the previous monitor cycle. The default value is five.
— Timeout (seconds): Enter the timeout value in seconds. The monitor waits for the number of seconds that
you specify after sending a response. If it does not receive a response within the number of seconds that
you specify, then the appliance considers this check as failed. The monitor discards any response it
receives after the timeout. The default value is 15.
— Retry Up Count: Enter a retry up count. When you specify a value, the appliance checks whether the server is
up based on the following: interval*retry up count. For example, if you specify the interval as five
seconds and the retry up count as 10 seconds, then the appliance tries to connect to the server every five
seconds for a period of 50 seconds. If the server is down initially, the appliance tries to connect to the
server for 50 seconds in sequence. When the connection is successful, the SIP monitor considers the server
to be up. If the server is unavailable for an entire period of 50 seconds, the appliance considers this
connection as a failure.
— Retry Down Count: Enter a retry down count. The SIP monitor considers the server unavailable only if the
server is unavailable during the period: interval*retry down count. For example, if you specify the
interval as five seconds and the retry down count as 10 seconds, then the appliance checks if the server is
unavailable for 50 seconds in sequence. If the server is unavailable for an entire period of 50 seconds, the
appliance considers the server to be down.
3. Click Next and complete the following:
— Expected Return Code: The response code expected from the server. Select a value from the drop-down list:
any, equals, and does not equals. When you select equals or does not equals, the appliance displays 200
by default. You can specify a value between zero and 999.
— Port: Specify a port for SIP connection. The appliance displays 5060 for TCP and UDP transport by default.
When you select SIPS and TLS transport options, the appliance displays 5061 by default. You can specify a
value between zero and 65535.
— Transport: Select a transport option from the drop-down list: SIPS, TCP, TLS, and UDP.
— Client Certificate: This is enabled only when you select SIPS and TLS transport options. Click Certificate
to select a client certificate. Select a certificate from the dialog box. Click Clear to delete the certificate
that you have uploaded. The monitor does not inspect or validate the server certificate, if any.
— Ciphers: This is enabled only when you select SIPS and TLS transport options. Specify a list of SSL ciphers
in an OpenSSL format. You can specify text up to 1024 characters. The following example commands list
some available ciphers:
Example 1:
$ openssl ciphers 'HIGH:!DES'
DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:
DHE-DSS-CAMELLIA256-SHA:ADH-AES256-SHA:ADH-CAMELLIA256-SHA:AES256-SHA:
CAMELLIA256-SHA:PSK-AES256-CBC-SHA:EDH-RSA-DES-CBC3-SHA:
EDH-DSS-DES-CBC3-SHA:ADH-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:
PSK-3DES-EDE-CBC-SHA:KRB5-DES-CBC3-SHA:KRB5-DES-CBC3-MD5:DHE-RSA-AES128-SHA:
DHE-DSS-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:
ADH-AES128-SHA:ADH-CAMELLIA128-SHA:AES128-SHA:CAMELLIA128-SHA:
PSK-AES128-CBC-SHA

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1011

Managing DNS Traffic Control

Example 2:
$ openssl ciphers 'DEFAULT:!EDH+aRSA'
DHE-DSS-AES256-SHA:DHE-DSS-CAMELLIA256-SHA:AES256-SHA:CAMELLIA256-SHA:
PSK-AES256-CBC-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA:
KRB5-DES-CBC3-SHA:KRB5-DES-CBC3-MD5:DHE-DSS-AES128-SHA:DHE-DSS-SEED-SHA:
DHE-DSS-CAMELLIA128-SHA:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:
PSK-AES128-CBC-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:KRB5-RC4-SHA:KRB5-RC4-MD5:
EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:KRB5-DES-CBC-SHA:KRB5-DES-CBC-MD5:
EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-KRB5-RC2-CBC-SHA:
EXP-KRB5-DES-CBC-SHA:EXP-KRB5-RC2-CBC-MD5:EXP-KRB5-DES-CBC-MD5:EXP-RC4-MD5:
EXP-KRB5-RC4-SHA:EXP-KRB5-RC4-MD5

Note: The DHE cipher list family (“Diffie-Hellman key agreement” plus “RSA authentication”) could consume
excessive CPU and is excluded from the defaults used by DNS Traffic Control health monitors. Although
you can enable these ciphers by explicitly configuring them in the cipher list for HTTPS and SIP monitors,
you should be aware that doing so will increase CPU usage. Since health monitoring in general does not
require high security, Infoblox recommends that you enable these ciphers only for target servers that do
not accept other types of ciphers.

4. Click Next to add extensible attributes. For information, see Using Extensible Attributes on page 427.
5. Save the configuration.

Configuring ICMP Health Monitors

An ICMP monitor sends an ICMP or ICMPv6 echo request to the IP address of the target server and expects an
ICMP/ICMPv6 echo response. The ICMP monitor determines the health of a server by monitoring the response to an
ICMP ping.
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, and then click the Add icon
and select ICMP Health Monitor from the drop-down list.
2. In the ICMP Health Monitor wizard, complete the following:
— Name: Enter a name for the ICMP health monitor.
— Comment: Enter information about the ICMP health monitor.
— Interval (seconds): Enter the interval value in seconds. The health monitor runs only for the specified
interval and it is measured from the end of the previous monitor cycle. The default value is five.
— Timeout (seconds): Enter the timeout value in seconds. The monitor waits for the number of seconds that
you specify after sending a response. If it does not receive a response within the number of seconds that
you specify, then the appliance considers this check as failed. The monitor discards any response it
receives after the timeout. The default value is 15.
— Retry Up Count: Enter a retry up count. When you specify a value, the appliance checks whether the server is
up based on the following: interval*retry up count. For example, if you specify the interval as five
seconds and the retry up count as 10 seconds, then the appliance tries to connect to the server every five
seconds for a period of 50 seconds. If the server is down initially, the appliance tries to connect to the
server for 50 seconds in sequence. When the connection is successful, the ICMP monitor considers the
server to be up. If the server is unavailable for an entire period of 50 seconds, the appliance considers this
connection as a failure.
— Retry Down Count: Enter a retry down count. The ICMP monitor considers the server unavailable only if the
server is unavailable during the period: interval*retry down count. For example, if you specify the
interval as five seconds and the retry down count as 10 seconds, then the appliance checks if the server is
unavailable for 50 seconds in sequence. If the server is unavailable for an entire period of 50 seconds, the
appliance considers the server to be down.
3. Click Next to add extensible attributes. For information, see Using Extensible Attributes on page 427.
4. Save the configuration.

1012 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Health Monitors

Configuring PDP Health Monitors

A PDP (Packet Data Protocol) monitor sends a standard GTP ECHO request to the server. The GTP (GPRS Tunneling
Protocol) echo message is used to ping the server. The connection is successful when the monitor receives an ECHO
response from the server. If the server does not respond after a specified number of echo requests, the server is
declared down by the monitor. You cannot modify the request or response.
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, and then click the Add icon
and select PDP Health Monitor from the drop-down list.
2. In the PDP Health Monitor wizard, complete the following:
— Name: Enter a name for the PDP health monitor.
— Comment: Enter information about the PDP health monitor.
— Interval (seconds): Enter the interval value in seconds. The health monitor runs only for the specified
interval and it is measured from the end of the previous monitor cycle. The default value is five.
— Timeout (seconds): Enter the timeout value in seconds. The monitor waits for the number of seconds that
you specify after sending a response. If it does not receive a response within the number of seconds that
you specify, then the appliance considers this check as failed. The monitor discards any response it
receives after the timeout. The default value is 15.
— Retry Up Count: Enter a retry up count. When you specify a value, the appliance checks whether the server is
up based on the following: interval*retry up count. For example, if you specify the interval as five
seconds and the retry up count as 10 seconds, then the appliance tries to connect to the server every five
seconds for a period of 50 seconds. If the server is down initially, the appliance tries to connect to the
server for 50 seconds in sequence. When the connection is successful, the PDP monitor considers the
server to be up. If the server is unavailable for an entire period of 50 seconds, the appliance considers this
connection as a failure.
— Retry Down Count: Enter a retry down count. The PDP monitor considers the server unavailable only if the
server is unavailable during the period: interval*retry down count. For example, if you specify the
interval as five seconds and the retry down count as 10 seconds, then the appliance checks if the server is
unavailable for 50 seconds in sequence. If the server is unavailable for an entire period of 50 seconds, the
appliance considers the server to be down.
— Port: Specify a port for PDP connection. The appliance displays 2123by default. You can specify a value
between zero and 65535.
3. Click Next to add extensible attributes. For information, see Using Extensible Attributes on page 427.
4. Save the configuration.

Configuring SNMP Health Monitors

An SNMP health monitor sends an SNMPv1 or SNMPv2c request to the monitored server. The SNMP agent in the
managed server provides the data in the form of variables, and each variable is associated with an unique OID (object
identifier). An OID is a dotted-decimal number that defines the location of the object in the universal MIB tree. You
can manually enter up to 15 OIDs to be monitored by the SNMP monitor. The server is considered available if the
response received from the server matches the expected result for all OIDs. If the server does not respond after a
specified number of requests, the server is declared down by the monitor.
To configure an SNMP OID health monitor, complete the following:
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, and then click the Add icon
and select SNMP Health Monitor from the drop-down list.
2. In the SNMP Health Monitor wizard, complete the following:
— Name: Enter a name for the SNMP monitor.
— Interval (seconds): Enter the interval value in seconds. The health monitor runs only for the specified
interval and it is measured from the end of the previous monitor cycle. The default value is five.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1013

Managing DNS Traffic Control

— Timeout (seconds): Enter the timeout value in seconds. The monitor waits for the number of seconds that
you specify after sending a response. If it does not receive a response within the number of seconds that
you specify, then the appliance considers this check failed. The monitor discards any responses it receives
after the timeout. The default value is 15.
— Retry Up Count: Enter a retry up count. When you specify a value, the appliance checks whether the server is
up based on the following: interval*retry up count. For example, if you specify the interval as five
seconds and the retry up count as 10, then the appliance tries to connect to the server every five seconds
for a period of 50 seconds. If the server is down initially, the appliance tries to connect to the server for 50
seconds in sequence. When the connection is successful, the SNMP monitor considers the server to be up.
If the server is unavailable for an entire period of 50 seconds, the appliance considers this connection as a
failure.
— Retry Down Count: Enter a retry down count. The SNMP monitor considers the server unavailable only if the
server is unavailable during the period: interval*retry down count. For example, if you specify the
interval as five seconds and the retry down count as 10, then the appliance checks if the server is
unavailable for 50 seconds in sequence. If the server is unavailable for an entire period of 50 seconds, the
appliance considers the server to be down.
— Port: Specify a port for the SNMP connection. The appliance displays 161 by default. You can specify a
value between zero and 65535.
— Comment: Enter information about the SNMP health monitor.
3. Click Next to configure the community, version, and OID settings:
— Community: Enter the text string that the SNMP monitor must send along with the queries to the server for
authentication. The community string is similar to a password and the server accepts queries only from the
SNMP monitor that provide the correct community string. Note that this community string must match
exactly what you enter in the management system. The default value is public.
— Version: Select the SNMP version, v1 or v2c from the drop-down list. The default is v2c.
Click the Add icon in the Health Monitor SNMP OIDs table to add an SNMP OID entry. Complete the following:
— OID: Specify the object identifier. An OID is a unique dotted-decimal number that identifies the location of
the object in the MIB tree.
— Type: Select either String or Integer from the drop-down list. The default is Integer.
— Operator: Select one of these operators from the drop-down list: Any, Equals, Larger, Smaller, and Range.
— If the operator is Equals, Larger, or Smaller, enter a value in the Value field. If the operator is Range, enter
the minimum and maximum values in the Min value and Max value fields respectively.
— Comment: Enter information about the SNMP OID entry.
— Click Add to add the SNMP OID to the table.
4. Click Next to add extensible attributes. For information, see Using Extensible Attributes on page 427.
5. Save the configuration.

Modifying Health Monitors

To modify a health monitor:
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, click the Action icon next
to the name and select Edit from the menu.
2. The Health Monitor editor contains the following basic tabs from which you can modify data. For information
about how to modify data, see Configuring DNS Traffic Control Health Monitors on page 1007.
— General: This tab displays the health monitor Name, Comment, Interval, Timeout, Retry Up Count, and Retry
Down Count fields. You can edit the values.
— Protocol: This tab displays the protocol for HTTP and SIP health monitors, which you can modify.
— Extensible Attributes: Add and delete extensible attributes that are associated with the pool. You can also
modify the values of extensible attributes. For information, see Using Extensible Attributes on page 427.

1014 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Health Monitors

3. Save the configuration.

or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting Health Monitors

To delete a health monitor:
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab, click the Action icon next
to the name and select Delete from the menu.
2. In the Delete Confirmation dialog box, click Yes to delete or No to cancel.
Click Schedule Deletion and in the Schedule Change panel, enter a date, time, and time zone to schedule
deletion at a later date and time. For more information, see Scheduling Deletions on page 90.

Viewing Health Monitors

You can view health monitors that you have created. You can add new health monitors, delete existing monitors,
modify health monitors, or associate extensible attributes. You can also upload and manage health monitor
certificates.
To view health monitors:
1. From the Data Management tab, select the Traffic Management tab -> Monitors tab.
2. The appliance displays the following information:
— Name: The name of the health monitor.
— Type: The type of health monitor.
— Comment: Displays information about the health monitor.
— Interval: The interval value in seconds.
— Timeout: The timeout value in seconds.
— Retry Up Count: The retry up count specified for the respective health monitor.
— Retry Down Count: The retry down count specified for the respective health monitor.
— Port: The port number specified for the respective health monitor. Note that this is not valid for an ICMP
monitor.
— Site: Value that was entered for the respective health monitor.
3. You can also do the following in this tab:
— Define new health monitors. For more information, see Configuring DNS Traffic Control Health Monitors on
page 1007.
— Edit existing health monitors. For more information, see Modifying Health Monitors on page 1014.
— Delete existing health monitors. For more information, see Deleting Health Monitors on page 1015.
— Edit extensible attributes.
— Manage health monitor certificates. For more information, see Managing Health Monitor Certificates on
page 1007.
— Click the Export icon to export the list of monitors to a .csv file.
— Click the Print icon to print the list of monitors.
— Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter
the first few characters of an object name in the Go to field and select the monitor from the possible
matches. Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters
on page 77.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1015

Managing DNS Traffic Control

Managing DNS Traffic Control Objects

You can configure DNS Traffic Control servers, pools, and LBDNs on the NIOS appliance. You can define multiple
servers, pools, or LBDNs.

Configuring DNS Traffic Control Servers

DNS Traffic Control servers are objects that will be associated with synthesized A, AAAA or CNAME records. DNS Traffic
Control servers can be in multiple pools and can be the destination for multiple topology rules. You can disable a
server while in use, but note that this affects the pools that are associated with the server. You cannot disable a server
if it is the last active server for any pool with which it is associated. The appliance displays an error message when
you try to delete a server that is being used by a topology rule. To delete a server, you must first remove each pool
and topology rule that is associated with the server. You can also enable translation for an IP address or a domain
name. For more information, see Translating Server Addresses on page 1016.
To configure a server, complete the following:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab, and then click the
arrow next to the Add icon and select Server -> DTC Server from the drop-down list.

Note: You can see the Server menu only when you install the DNS Traffic Control and Load Balancer licenses. For
example, if you have installed only the DNS Traffic Control license, you can only see the DTC Server menu.
For more information about Global Load Balancers, see About Global Load Balancer Data on page 1543.

2. In the DTC Server Wizard, complete the following:

— Name: Enter the name of the DNS Traffic Control server.
— Host: Enter the host name or IP address for the DNS Traffic Control server. If you configure an IP address for
translation, the DNS record in the response will contain an A or AAAA record. If you configure a domain
name, the DNS record will contain a CNAME.
— Use Translation: Select the check box to enable translation. For more information, see Translating Server
Addresses on page 1016.
— Translation: This is enabled only when you select the Use Translation check box. Enter the IP address or
the FQDN that you want to use for translation.
— Comment: Enter additional information about the server.
— Disabled: Select this to disable the server.
3. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
4. Save the configuration.
To schedule this task, click the Schedule icon at the top of the wizard. In the Schedule Change panel, click Later, and
then specify a date, time, and time zone.

Translating Server Addresses

If you enable translation, then the translation value will be used for the DTC response. If you configure an IP address
for translation, the DNS record in the response will contain an A or AAAA record. If you configure a domain name, the
DNS record will contain a CNAME. When you disable translation, the same guidelines apply to the host value. Note
that when you use an FQDN hostname, you must configure a DNS name resolution.
The following table lists a few examples:

Host Translation Health Check DTC Querying Process

Results
1.1.1.1 none 1.1.1.1 IN A 1.1.1.1
1::1 none 1::1 IN AAAA 1::1

1016 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DNS Traffic Control Objects

DTC Querying Process

Host Translation Health Check
Results
www.xyz.com none www.xyz.com IN CNAME www.xyz.com
1.1.1.1 2.2.2.2 1.1.1.1 IN A 2.2.2.2
1.1.1.1 2::2 1.1.1.1 IN AAAA 2::2
1.1.1.1 www.abc.com 1.1.1.1 IN CNAME www.abc.com
www.xyz.com 1.1.1.1 www.xyz.com IN CNAME www.xyz.com

Managing DTC NAPTR Records

You can create NAPTR records in a DTC server similar to the NAPTR record in a DNS zone. A NAPTR (Name Authority
Pointer) record specifies a rule that uses a substitution expression to rewrite a string into a domain name or URI
(Uniform Resource Identifier). A URI is either a URL (Uniform Resource Locator) or URN (Uniform Resource Name) that
identifies a resource on the Internet. For information about NAPTR records, see Managing NAPTR Records on page
896. This section describes how to add, modify, and delete a NAPTR record in a DTC server. It includes the following
sections:
• Adding DTC NAPTR Records
• Viewing DTC NAPTR Records
• Modifying DTC NAPTR Records
• Deleting DTC NAPTR Records

Adding DTC NAPTR Records

To add a DTC NAPTR record:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab -> DTC server -> click
Add -> NAPTR Record.
2. Enter the information in the Add NAPTR Record wizard. For description of the fields, see the online Help or
Managing NAPTR Records on page 896.
3. Save the configuration and click Restart if it appears at the top of the screen.

Viewing DTC NAPTR Records

To view the NAPTR records associated with a DTC server, go to the Data Management tab, select the Traffic
Management tab -> Traffic Management tab -> DTC server. The Grid Manager displays the following for each DTC NAPTR
record:
• Type: The type of record. For example, the appliance displays NAPTR Record.
• Data: The data that the record contains. For NAPTR record, this field displays the following data: Order,
Preference, Flags, Services, REGEX, and Replacement.
• Comment: Comment that were entered for a NAPTR record.
• TTL: The TTL (time-to-live) value of the NAPTR record.
• Disabled: Indicates if the record is disabled.
You can do the following:
• Click the Add icon to add a NAPTR record.
• Select a NAPTR record and click the Edit icon to edit the configuration. You can also click the Action icon
next to the record and select Edit from the menu.
• Select a NAPTR record and click the Delete icon to delete it. You can also click the Action icon next to the
record and select Delete from the menu.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1017

Managing DNS Traffic Control

• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Click the Export icon to export the list of NAPTR records to a .csv file.
• Click the Print icon to print the list of NAPTR records.

Modifying DTC NAPTR Records

To modify a DTC NAPTR record:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab -> DTC server.
2. Select the DTC NAPTR record you want to modify, and click the Edit icon.
3. The NAPTR Record editor contains the following tabs from which you can modify information:
— General: You can change most of the information, except for the read-only fields, such as the DNS View. For
description of the fields, see the online Help or Managing NAPTR Records on page 896. You can also select
the Disable check box to disable the record.
— TTL: You can modify the TTL setting. For information, see About Time To Live Settings on page 753.
4. Save the configuration and click Restart if it appears at the top of the screen.

Deleting DTC NAPTR Records

To delete a DTC NAPTR record:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab -> DTC server.
2. Select the DTC NAPTR record you want to delete, and click the Delete icon.
3. When the confirmation dialog box displays, select Yes.
Grid Manager moves the DTC NAPTR record to the Recycle Bin, from which you can restore or permanently delete the
record.

Modifying DNS Traffic Control Servers

To modify a DNS Traffic Control server:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab, click the Action
icon next to the DTC Server and select Edit from the menu.
2. The DTC Server editor contains the following tabs from which you can modify the data. For information about how
to modify data, see Configuring DNS Traffic Control Servers on page 1016.
— General: This tab displays the DTC Server Name, Host and Translation Settings and Comment that you
entered while configuring the server. You can enable or disable the server. You can also enable or disable
translation. For more information, see Translating Server Addresses on page 1016.
— Extensible Attributes: Add and delete extensible attributes that are associated with the server. You can also
modify the values of extensible attributes. For information, see Using Extensible Attributes on page 427.
3. Save the configuration.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Configuring DNS Traffic Control Pools

A pool contains load balanced servers. You can define multiple servers for a pool. Each LBDN must have at least one
pool associated with it to be operational. For sites with a large amount of incoming traffic, you can configure DNS
Traffic Control to distribute client requests to multiple servers using a load balancing pool. An individual server can
belong to one or multiple load balancing pools, depending on how you want to manage your network traffic. You can
also set the order of servers in the pool and define a ratio on a server basis.

1018 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DNS Traffic Control Objects

A pool can contain preferred and alternative load balancing methods. You can define permissions on these pools and
associate extensible attributes with them. Each pool can contain one or more health monitors associated with it. You
can define TTLs at the LBDN level. These TTLs are valid for dynamic RRsets that are created by the querying process
for each query.

Note: You can configure a maximum of 256 DNS Traffic Control Pools.

To configure a pool:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab, and then click the
arrow next to the Add icon and select Pool -> DTC Pool from the drop-down list.

Note: You can see the Pool menu only when you install the DNS Traffic Control and Load Balancer licenses. For
example, if you have installed only the DNS Traffic Control license, you can only see the DTC Pool menu.
For more information about Global Load Balancers, see About Global Load Balancer Data on page 1543.

2. In the DTC Pool Wizard, complete the following:

— Name: Enter the name of the pool.
— Comment: Enter additional information about the pool.
— Disabled: Select this to disable the pool.
3. Click Next to associate health monitors with the pool:
— Health Monitors: Select the health monitor from the Available table, which you want to associate with the
pool, and click the right arrow to move the selected health monitor to the Active table. You can use
SHIFT+click and CTRL+click to select multiple health monitors. To dissociate the health monitor from the
pool, select it and click the left arrow to move it to the Available table from the Active table.
— Availability Requirements: Select a value from the drop-down list: All, Any, or At least. You can select All to
configure all the health monitors. Select Any to associate any number of health monitors. When you select
At least, you must specify at least one health monitor with the pool.
4. Click Next to associate a load balancing method:
— Preferred: The appliance displays Round Robin, by default. Select a load balancing method from the
drop-down list: All Available Records, Global Availability, Ratio, Round Robin, and Topology. For more
information, see Load Balancing Methods for DNS Traffic Control on page 1022.
— Topology Ruleset: This is displayed only when you select Topology as the preferred load balancing
method. Select a topology ruleset from the drop-down list.
— Alternate: The appliance displays None by default. Select a value from the drop-down list: All Available
Records, Global Availability, None, Ratio, Round Robin, and Topology. Note that the alternate method is
used to select a server from the pool if the preferred method does not return any result. For more
information, see Load Balancing Methods for DNS Traffic Control on page 1022.

Note: You can select an alternate load balancing method only if the primary load balancing method is Topology.

— Topology Ruleset: This is displayed only when you select Topology as the alternate load balancing
method. Select a topology ruleset from the drop-down list.
Note that the alternate and preferred methods must be different.
5. Click Next to associate servers with the pool. Click the Add icon, select a server from the DTC Server Selector
dialog box and click OK. You can use SHIFT+click and CTRL+click to associate multiple servers. The appliance
displays the following information:
— Server Name: The name of the DNS Traffic Control server is displayed.
— Host: The host address of the server is displayed.
— Ratio: The appliance displays the ratio as one, by default. You can modify the ratio value. Note that the
value must be greater than zero.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1019

Managing DNS Traffic Control

— Disabled: Indicates whether the server is disabled.

— Order: Displays the order of servers in the list.
To dissociate a server from the pool, select the check box next to the server name and click the Delete icon.
6. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
7. Save the configuration.
To schedule this task, click the Schedule icon at the top of the wizard. In the Schedule Change panel, click Later, and
then specify a date, time, and time zone.

Modifying DNS Traffic Control Pools

To modify a pool:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab, click the Action
icon next to the pool name and select Edit from the menu.
2. The DTC Pool editor contains the following basic tabs from which you can modify data. For information about how
to modify data, see Configuring DNS Traffic Control Pools on page 1018.
— General: This tab displays the pool Name and the Comment. You can edit the values and enable or disable
a pool.
— TTL: This tab displays the TTL value configured for the pool. The default value is inherited from the LBDNs
which are using the pool. There can be multiple inheritance. Click Override to override the value.
— Health Monitors: This tab displays health monitors that are associated with the pool. You can associate new
health monitors or dissociate the health monitors that are already associated with the pool.
— Load Balancing: This tab displays the load balancing methods that you have selected while configuring the
pool. You can select a new Preferred and Alternate load balancing methods.
— Pool Members: This tab displays the servers that are associated with the pool. You can add new servers or
delete servers that are associated with the pool.
— Extensible Attributes: Add and delete extensible attributes that are associated with the pool. You can also
modify the values of extensible attributes. For information, see Using Extensible Attributes on page 427.
3. Save the configuration.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a date,
time, and time zone. For information, see Scheduling Tasks on page 85.

Configuring DNS Traffic Control LBDNs

A DTC LBDN is a load balanced domain name object that is used by DNS Traffic Control to process DNS queries for
load balanced resources. You can define multiple LBDNs on the NIOS appliance. You can configure permissions on
the LBDN and associate extensible attributes with it.
You can also configure a load balancing method for each LBDN. A load balancing method is used to respond to the
query so that the clients are redirected in a load-balanced manner. You can assign multiple pools and a single load
balancing method to an LBDN. Note that zone transfers and incremental zone transfers ignore LBDNs.
Note that you cannot create multiple LBDNs with the same name. You will be able to edit an LBDN if you have DTC
Admin role permission. For more information, see License Requirements and Admin Permissions on page 1002. You
can associate or dissociate LBDNs with a zone and also associate extensible attributes with the LBDN.
On the appliance, the DNS Traffic Control querying process generates A, AAAA, or CNAME records for an LBDN, called
LBDN records. An LBDN record type is served by DNS Traffic Control servers. An LBDN record must be associated with
an authoritative zone. For more information about LBDN records, see Managing LBDN Records on page 1024.
When you enable persistence, cached results are not guaranteed to persist for the configured duration. The maximum
size of the persistence cache is limited globally by platform. When the limit exceeds the maximum size, the oldest
results are deleted. The appliance might discard persistence results if the relevant configuration changes. The
appliance might reset persistence cache on an HA failover.

1020 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DNS Traffic Control Objects

To configure an LBDN, complete the following:

1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab, and then click the
arrow next to the Add icon and select LBDN -> DTC LBDN from the drop-down list.
or
From the Data Management tab -> DNS tab -> Zones tab -> authoritative_zone -> Records tab, click the Add icon,
select Record -> LBDN -> DTC LBDN from the drop-down list.

Note: You can see the LBDN menu only when you install the DNS Traffic Control and Load Balancer licenses. For
example, if you have installed only the DNS Traffic Control license, you can only see the DTC LBDN menu.
For more information about Global Load Balancers, see About Global Load Balancer Data on page 1543.

2. In the DTC LBDN wizard, complete the following:

— Display Name: Enter a display name for the LBDN.
— Patterns: Click the Add icon to add an LBDN pattern. For more information, see Configuring LBDN Patterns
on page 1022.
To delete an LBDN pattern, select the check box next to the pattern and click the Delete icon.
— Load Balancing Method: From the drop-down list, select the method you want to use for load balancing. You
can select one of the following: Global Availability, Ratio, Round Robin, and Topology. The default is Round
Robin. For more information about the load balancing methods, see Load Balancing Methods for DNS
Traffic Control on page 1022.
— Topology Ruleset: This is displayed only when you select the Topology load balancing method. Select a
topology ruleset for load balancing method from the drop-down list. For more information, see Defining
Topology Rulesets on page 1003.
— Persistence: Select this check box and enter a value greater than zero seconds to enable persistence for the
LBDN. You can specify a period between one second to 30 minutes. If you specify zero, the appliance does
not cache the requests. When you enable persistence for an LBDN, the appliance stores the results for
specific LBDN responses in the DNS Traffic Control cache. When a request originates from the respective
FQDN or an IP address within the specified period, the DNS server directs the request to the same server.
— Comment: Enter additional information about the LBDN object.
— Disabled: Select this to disable the LBDN.
3. Click Next and complete the following:
— Return these record types for the associated zones: You can select any or all of the following LBDN record
types: A, AAAA, and NAPTR. By default, A and AAAA record types are selected. If you select A or AAAA record
type, the appliance returns the corresponding record and/or the CNAME record when the client queries for
the corresponding record type and if the server selected by the DNS Traffic Control has the required data. If
you select NAPTR record, the appliance returns the NAPTR record when the client queries for NAPTR record
and if the server selected by the DNS Traffic Control has the required data.

Note: You must select at least one record type for an LBDN. An LBDN is disabled if no record types are selected.
The patterns and the record types cannot overlap with any other LBDN that is linked to the same zone.

— Associated Zones: Click the Add icon to associate zones with the LBDN. Select a zone from the Zone
Selector dialog box and click OK. The appliance displays the following information:
— Zones: The name of the selected zone.
— DNS View: The DNS view associated with the selected zone (if there is more than one DNS view).
Note that the LBDN is active only when you associate zones with it. You can associate only authoritative
forward-mapping zones with the LBDN. To dissociate a zone from the LBDN, select the check box next to the
respective zone name and click the Delete icon. For more information, see Managing LBDN Records on page
1024.
4. Click Next and click the Add icon to associate pools with the LBDN. Select a pool from the DTC Pool Selector dialog
box and click OK. The appliance displays the following information:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1021

Managing DNS Traffic Control

— Name: The name of the selected pool.

— Ratio: The ratio of the associated server. You can edit this value.
— Comment: Displays information that you specified for the pool.
— Members: Displays the member associated with the pool.
— Order: Displays the order of the pools.
To dissociate a pool associated with an LBDN, select the check box next to the respective pool name and click
the Delete icon.
5. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
6. Save the configuration.
To schedule this task, click the Schedule icon at the top of the wizard. In the Schedule Change panel, click Later, and
then specify a date, time, and time zone.

Configuring LBDN Patterns

An LBDN pattern is a domain name. You can define a pattern with multiple * and ? in any position of the domain name.
Note the following about * and ?:
• A sequence of *s has the same effect as a single *.
• A sequence of ?s will match exactly as many octets as there are ?s.
• A * terminates on label boundaries and will not match a label separator. For example, *.com matches foo.com
but not www.foo.com.
• A ? does not match a label separator.
• An empty LBDN pattern will match the root and it is automatically changed to “.” when you save the LBDN.
• An LBDN pattern matches an FQDN if the entire FQDN matches.
• LBDN patterns may contain special characters. For example, a\032 b.com contains two adjacent spaces.
• LBDN patterns do not support IDN and they will not convert Unicode to punycode. You can enter punycode, but
note that the LBDN pattern matching does not support punycode.

Load Balancing Methods for DNS Traffic Control

You can define the following load balancing methods for an LBDN on the NIOS appliance: All Available Records,
Global Availability, Ratio, Round Robin, and Topology method.
• When you select the All Available Records method, the appliance responds to the query with all the available
servers in the DTC pool for the appropriate record type. The responses are returned in the same order in which
the servers are listed in the DTC pool, eliminating the unavailable servers.
Consider the following example for all available records load balancing method with an LBDN x.abc.com:
— Pool= Pool_1; load balancing method= all available records; health check= HTTPS
10.10.1.1; Availability = up
2001:db8:a22:a00::29; Availability = up
10.10.2.2; Availability = down
2001:db8:a22:a00::32; Availability = up
10.10.3.3; Availability = up
In this example, the appliance responds with 10.10.1.1, 10.10.3.3 for each A record query. For each AAAA
record query, NIOS responds with 2001:db8:a22:a00::29, 2001:db8:a22:a00::32. The unavailable servers are
eliminated. Note that the system considers only the order of the servers in the DTC pool and ignores the weight
of available servers.

1022 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DNS Traffic Control Objects

• When you select the Global Availability load balancing method, the appliance adjusts the response to the
query, so that the clients are directed to the first available server in the pool.
Consider the following example for global availability load balancing method with an LBDN x.abc.com:
— Pool= Pool_1; load balancing method= global availability; health check= HTTPS
10.10.1.1
10.10.2.2
10.10.3.3
— Pool= Pool_2; load balancing method = global availability; health check = HTTPS
10.10.4.4
10.10.5.5
10.10.5.5
In this example, the appliance always responds with 10.10.1.1 (A record) for all x.abc.com queries assuming
that all servers are available. The DNS Traffic Control LBDN determines which pool to use based on the health
check response and adjusts the response accordingly. The appliance responds with 10.10.4.4 from Pool_2 if
health check for all servers associated with Pool_1 fails.
• When you select the Ratio method, NIOS adjusts the response to the query so that the clients are directed to
servers in a pool or among pools. When multiple pools or servers are configured, the appliance uses the
weighted round robin method, a load-balancing pattern in which requests are distributed among several
servers based on a priority level or weight assigned to each pool or server. Note that the system considers the
weight of available servers only.
Consider the following example for ratio load balancing method with an LBDN x.abc.com, load balancing
method = Ratio and two linked pools: Pool_1 with weight = 70 and Pool_2 with weight = 30.
— Pool = Pool_1; load balancing method = ratio; health check = HTTPS
10.10.1.1; Weight = 50
10.10.2.2; Weight = 25
10.10.3.3; Weight = 25
— Pool = Pool_2; load balancing method = ratio; health check = HTTPS
10.10.4.4; Weight = 50
10.10.5.5; Weight = 25
10.10.5.5; Weight = 25
In this example, the appliance responds 70% of the time with a server associated with Pool_1. Within Pool_1, it
responds with 10.10.1.1 address 50% of the time.
• When you select the Round Robin method, the appliance randomizes the response to the query to select from
all available servers with each available option having an equal probability.
Consider the following example for round robin load balancing method with an LBDN x.abc.com where the load
balancing method is Round Robin:
— Pool = Pool_1; load balancing method = Round Robin; health check = HTTPS
10.10.1.1;
10.10.2.2;
10.10.3.3;
In this example, NIOS responds with a server associated with Pool_1. Within Pool_1, it responds randomly
with equal weight:
Time 1: Response = 10.10.1.1
Time 3: Response = 10.10.3.3
Time 2: Response = 10.10.2.2
Time 4: Response = 10.10.1.1

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1023

Managing DNS Traffic Control

• When you select the Topology method, the appliance uses a predefined geographic mapping method and
evaluates user-defined rules sequentially. The appliance supports the MaxMind GeoIp2 city or country
database. However, the ‘country’ version of the database does not support ‘subdivision’ labels and importing it
will invalidate all rules that use ‘subdivision’ labels. The topology method allows you to create, modify, or
delete one or more custom topology rules. For more information, see Configuring Topology Rules and Rulesets
on page 1003.

Managing LBDN Records

When your Grid has the DNS Traffic Control license, you can associate LBDNs with authoritative zones. The LBDNs will
create LBDN records for the associated zones. Note that you cannot add an LBDN if the zone is DNSSEC signed.
In order to manage an LBDN in an authoritative zone through Grid Manager, you must enable the authoritative zone
and associate it with the LBDN. When you define an LBDN on the NIOS appliance, one or more LBDN records are
created as proxies for the LBDN if there are zones associated with the patterns that match the name of the LBDN.
When you link an LBDN to a zone, the appliance creates LBDN records in that zone for each of the LBDN patterns that
match the zone.
Grid Manager displays LBDNs and LBDN records based on your configuration. All LBDNs appear in the Traffic
Management tab, but only the LBDN records that match a zone name appear in the DNS tab -> authoritative_zone ->
Records tab.
You cannot modify LBDN records. The appliance creates or deletes LBDN records based on the matched LBDN
patterns. When you delete an LBDN, the appliance automatically deletes linked zones associated with it and deletes
all LBDN records. You can edit the pattern that is associated with the respective LBDN record. The appliance displays
the DTC LBDN editor when you click the Edit icon next to the LBDN record. For more information about how to edit an
LBDN pattern, see Modifying DNS Traffic Control LBDNs on page 1024.
Note that an LBDN record is a separate object from the LBDN and each of these have separate permissions. For more
information, see License Requirements and Admin Permissions on page 1002.
You must associate at least one zone with the LBDN to activate it. These zones must be authoritative
forward-mapping zones, and the LBDN must contain at least one matching pattern for the zone. For example, an LBDN
with patterns “www.*.com” and “www.*.net” may be linked to a zone “foo.com”.
You can also associate multiple zones with an LBDN. To associate multiple zones with an LBDN, you must add
patterns that match the zones. For example, consider you have created three zones abc.com, xyz.org and lmn.net and
an LBDN where the LBDN pattern is “*.com”. You cannot associate zones xyz.org or lmn.net with this LBDN. The
appliance displays an error message when the patterns do not match the zones. You can only associate the zone
abc.com with this LBDN.
Note that you cannot link two different LBDNs to the same zone if their patterns and the record types overlap. For
example, an LBDN with “*.foo.com” and a different LBDN with “www.*.com” patterns cannot be linked to the same
zone “foo.com” at the same time. You can link a single LBDN with both patterns to a zone.
When you link an LBDN to a zone, the appliance creates LBDN records in the respective zone for each of the LBDN
patterns that match the zone. The record name is the zone-relative portion of the pattern, including wildcards.
For example, when you link an LBDN with patterns “www.*.com”, “www.a*z.*.com”, “*.com”, “bar.*.net” to zone
“foo.com”, the appliance creates three LBDN records with names "" (zone origin), “www”, and “www.a*z” in the zone.
These records will refer to their respective LBDN.

Modifying DNS Traffic Control LBDNs

To modify an LBDN:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab, click the Action
icon next to the LBDN name and select Edit from the menu.
2. The DTC LBDN editor contains the following tabs from which you can modify data. For information about how to
modify data, see Configuring DNS Traffic Control LBDNs on page 1020.
— General: This tab displays the Load Balancer Name, Patterns, Load Balancing Method, Persistence, and
Comment of the LBDN object. You can enable or disable an LBDN.

1024 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DNS Traffic Control Objects

— Associated Zones and Records: This tab displays the record types selected for the zone, the TTL value and
the Associated Zones. You can select any or all of the following record types: A, AAAA, and NAPTR. Note that
the default TTL value is 8 hours and is inherited from the associated zones. Note that the TTL value is
inherited from the associated zones. There can be multiple inheritance. You can override this value and
associate new zones with the LBDN or delete an associated zone.
— Pools: This tab displays the pools that are associated with the LBDN. You can delete an existing pool or add
new pools.
— Extensible Attributes: Add and delete extensible attributes that are associated with the LBDN. You can also
modify the values of extensible attributes. For information, see Using Extensible Attributes on page 427.
3. Save the configuration.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Testing DTC LBDNs

You can select an LBDN and test the DTC response for the respective LBDN. Note that you can test only an Infoblox
LBDN using this option.
To test an LBDN, complete the following:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab.
2. In the Traffic Management panel, select the LBDN object you want to test and click Test DTC LBDN in the Toolbar.
3. In the Test DTC LBDN dialog box, complete the following:
— Query Source: Enter the client IP address.
— Query Name: Enter the FQDN of the record that you are requesting.
— Member: Click Select to select the member which will return the response. The dialog box displays the list
of members that have a DTC license.
— Record Type: Select a record type, A, AAAA, or NAPTR from the drop-down list.
Click Start to test the selected LBDN. The appliance displays the response for the request in the text output area. Click
Clear to clear the responses from the text area.

Deleting DNS Traffic Control Objects

You can delete DNS Traffic Control objects, such as servers, pools or LBDNs, that you have defined. When you delete
an LBDN, the appliance automatically dissociates it from the zones. To delete an LBDN, you must either have a write
permission on the LBDN record or the LBDN. For more information, see License Requirements and Admin Permissions
on page 1002.
You cannot delete a DNS Traffic Control pool when it is in use. To delete a pool, you must first delete it from the
associated LBDNs. You cannot delete a DNS Traffic Control server when it is in use. You must first remove it from every
pool and topology ruleset before deleting the server.
To delete an object:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab, click the Action
icon next to the object name and select Delete from the menu or select an object and click the Delete icon.
2. In the Delete Confirmation dialog box, click Yes to delete or No to cancel.
You can click the Action icon and select Schedule Delete from the menu to schedule deletion. You can also select
Schedule Delete from the drop-down list in the Delete icon to schedule deletion. In the Schedule Deletion panel, enter
a date, time, and time zone. For information, see Scheduling Deletions on page 90.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1025

Managing DNS Traffic Control

Viewing DNS Traffic Control LBDNs and LBDN Records

Depending on your configuration, Grid Manager displays LBDNs in the following tabs:
• Data Management tab -> Traffic Management tab -> Traffic Management tab
Grid Manager displays all LBDNs in this tab. For more information, see Viewing DNS Traffic Control Objects on
page 1026.
• Data Management tab -> DNS tab -> Zones tab -> authoritative_zone or delegated_zone -> Records tab
Only LBDN records that match the domain name of a specific zone appear in this tab. For example, in an
authoritative zone named “com”, only LBDN records with names that contain “com”, such as “V11.com” or
“abc.com”, appear in the Records tab, if the LBDN pattern contains “*.com”. For more information about LBDN
patterns, see Configuring LBDN Patterns on page 1022. The appliance displays proxies for LBDN records in this
tab only when the zone is associated with the LBDN. To associate a zone with an LBDN, see Configuring DNS
Traffic Control LBDNs on page 1020. For more information about managing LBDN records, see Managing LBDN
Records on page 1024.

Viewing DNS Traffic Control Objects

Grid Manager lists all DNS Traffic Control objects in the Traffic Management tab. You can view the DNS Traffic Control
objects, such as servers, LBDNs, and pools that you have configured in the Grid. You can perform inline editing by
double-clicking the Name, Comment, and Site field values.
To view DNS Traffic Control objects:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab.
2. Based on the selected objects, Grid Manager displays the following for each DNS Traffic Control object:
— Name: The name of the object.
— Type: The object type.
— Vendor: The equipment manufacturer, either Infoblox or F5. This column is displayed only when you install
both DNS Traffic Control and Load Balancer licenses. For more information about global load balancer, see
About Global Load Balancer Data on page 1543.
— Status: Displays the timestamp for the last update and the connection status. You must hover your mouse
on the icon next to the status to view the last updated date and time. The tooltip also provides information
about load balancer methods and servers for LBDNs and pools. Status can be one of the following:
— Checking: The appliance is checking the status of the object.
— Unlicensed: The object does not have a license.
— Running: The object is running properly.
— None: The appliance cannot retrieve the status of the object.
— Error: The object has an error. You can check the syslog for any messages.
— Warning: The object has a warning message. You can check the syslog for any messages.
— IPv4 Address: The IPv4 address of the object, if applicable.
— IPv6 Address: The IPv6 address of the object, if applicable.
— Comment: Displays any comments that were entered for the object.
— Site: Displays any values that were entered for this pre-defined attribute.
You can do the following in the Traffic Management tab:
• Click the Add icon to add an object.
• Select an object and click the Edit icon to edit the configuration. You can also click the Action icon next to
the object and select Edit from the menu. You can edit an LBDN, pool or a server. For more information, see
Managing DNS Traffic Control Objects on page 1016.
• Select an object and click the Delete icon to delete it. You can also click the Action icon next to the object
and select Delete from the menu. For more information, see Deleting DNS Traffic Control Objects on page 1025.

1026 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DNS Traffic Control Objects

• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Click the Export icon to export the list of objects to a .csv file.
• Click the Print icon to print the list of objects.
• Click Extensible Attributes in the Toolbar to add and delete extensible attributes that are associated with the
objects. For information, see Using Extensible Attributes on page 427.
• Click Test DTC LBDN to test LBDNs. For more information, seeTesting DTC LBDNs on page 1025.
• Enable/Disable multiple traffic management objects. Note that you can use this dialog box to enable or disable
multiple objects that are associated with Infoblox appliances only. For more information, see Enabling or
Disabling Traffic Management Objects on page 1029.
• Use the IDN Converter from the Toolbar to convert IDNs into punycodes. For more information, see Decoding
IDNs and Encoding Punycode on page 113.
• Click Show Visualization: <LBDN name> to view the traffic management structure for the respective LBDN. This
link appears in the Traffic Management tab only when you minimize the Traffic Management Structure
visualization window for the respective LBDN using the minimize option. For more information, see Viewing
Traffic Management Structures on page 1027.
• Select the check box to view specific objects only:
— LBDN: Select the check box to edit LBDN objects only. For more information, see Configuring DNS Traffic
Control LBDNs on page 1020.
— Pool: Select the check box to edit pools only. For more information, see Configuring DNS Traffic Control
Pools on page 1018.
— Server: Select the check box to edit servers only. For more information, see Configuring DNS Traffic Control
Servers on page 1016.

Viewing Traffic Management Structures

Grid Manager provides a hierarchical map view that you can use to quickly capture an overall traffic management
structure of a selected DNS Traffic Control object. The map displays objects in hierarchical order of LBDN -> pool ->
servers. It starts with an LBDN as the central point and displays its relationship with other associated objects. The
objects are represented as nodes in the map. You can filter the values at the member level. Note that when a DTC
server is associated with multiple pools, the appliance displays the connection to the selected pool only. It does not
show the DTC servers for other pools. If a server is assigned to more than one pool, it is shown only for the selected
pool.
To view traffic management structures for objects:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab.
2. Click the Action icon next to an LBDN and select LBDN Visualization -> LBDN.
Grid Manager opens a separate dialog window and displays the hierarchical map in the Traffic Management
Structure panel. The map displays the selected object as the starting point and its connections and
relationships with other associated objects in the network. The map also contains legends that indicates the
status of the displayed objects and the nature of their paths to other objects. You can hover your mouse over
the node to display the tooltip that contains the following information:
— Name: The device name of the object.
— Status: The current status of the object.
— Type: The object type.
— Last Update: The timestamp when the object was last discovered.
— Health Monitors: This is displayed only for server objects. It displays the status value for each of the pool’s
health monitors when checking this server.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1027

Managing DNS Traffic Control

When you select an object, the map displays the selected object at the center and uses lines to represent its
connections with other associated objects. For example, if you start with an LBDN object that has associated servers,
the map displays connectors from the LBDN object to all the related objects in a hierarchical tree format. If an LBDN
has more than one pool, it will display the servers for only one pool at a time. Clicking on a pool will display the
servers for that pool.

Note: If your browser has a pop-up blocker enabled, you must turn off the pop-up blocker or configure your browser
to allow pop-ups in order to view the traffic management visualizer.

You can also do the following in the Traffic Management Structure panel:
• Click the arrow next to the Tree Configuration icon and select Tree Configuration from the drop-down list to
configure the number of nodes on each level. Enter the maximum number of nodes you want displayed for each
level and then click Submit.

Note: When there are more than 30 nodes in a tree for an LBDN, the appliance displays a warning message indicating
that you can drag the display to view the hidden nodes.

• Click the arrow next to the Tree Configuration icon and click Filter Node Status from the drop-down list to filter
the node status. The appliance displays the following values: All Members and Select Member. Select All
Members to select all members associated with the LBDN to display the status. When you select this option, the
appliance displays All Members above the LBDN. Click Select Member to launch the member selector and select
a specific member to view the status. When you select a member, the appliance displays the respective member
name above the LBDN. Note that the appliance displays members that have a DNS Traffic Control license only.
The Grid Master fetches the server status for each server. The results are cached and are updated periodically. It
may take a few minutes to update the status after a configuration change. The traffic management structure
status icon can be one of the following:

Color Meaning
None Status is unknown. DNS Traffic Control object is disabled for the selected
object or it is not linked to a pool or an LBDN, or IPv4/IPv6 interfaces are not
configured.
Gray Grid member does not have DNS Traffic Control license.
Green All DNS Traffic Control servers are operating normally in a “Running” state or
monitors are not associated.
Blue Data is not available for the respective object.
Yellow The health monitor marks the status as a mix of up and down states for the
respective object.
Red The DNS Traffic Control object has an error or it is not reachable.

• Change the map orientation by clicking the Change Tree Orientation icon. The default orientation is from top to
bottom.
• Click the Refresh icon to refresh the map. You can also click Turn Auto-Refresh On to turn on auto-refresh and
Turn Auto-Refresh Off to turn it off.
• Click anywhere in the tree map and hold your mouse to drag the map to a desired location in the panel.

1028 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DNS Traffic Control Objects

Enabling or Disabling Traffic Management Objects

You can enable or disable multiple traffic management objects simultaneously. Note that the dialog box for
performing a multiple enable or disable can only enable or disable objects where the vendor is Infoblox. For more
information about F5 objects, see Viewing F5 Global Load Balancer Objects on page 1544.
To enable or disable traffic management objects:
1. From the Data Management tab, select the Traffic Management tab -> Traffic Management tab.
2. In the Traffic Management panel, select the object you want to enable or disable and click the arrow beside
Enable/Disable.
To enable the selected objects, select Enable from the drop-down list and click Yes in the confirmation dialog box to
enable or select Disable from the drop-down list and click Yes in the confirmation dialog box to disable the selected
objects. Click No to cancel the operation.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1029

Managing DNS Traffic Control

1030 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 24 Configuring IP Routing Options
You can configure multiple IP addresses and enable anycast addressing on the loopback interface of the NIOS
appliance, allowing the appliance to function in different network deployments.
Configuring non-anycast IP addresses on the loopback interface assists in server migration and network address
change. Configuring anycast addresses on the appliance allows you to add redundancy and improve reliability for
DNS services. You can use OSPF (Open Shortest Path First), BGP (Border Gateway Protocol), or both, as the routing
protocol for anycast advertising.
This chapter contains the following sections:
• Using the Loopback Interface on page 1032
• Configuring IP Addresses on the Loopback Interface on page 1032
— Advertising Loopback Addresses to the Network on page 1034
• About Anycast Addressing for DNS on page 1035
— Configuring Anycast Addresses on page 1036
• IP Routing Options on page 1038
— About OSPF on page 1039
— Configuring OSPF on the NIOS Appliance on page 1041
— Anycast and BGP4 on page 1043
— Configuring BGP in the NIOS Appliance on page 1045

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1031

Configuring IP Routing Options

Using the Loopback Interface

The loopback interface is a virtual network interface on the appliance. You can do the following on the loopback
interface:
• Configure IP addresses to consolidate DNS servers for migration purposes. For information, see Configuring IP
Addresses on the Loopback Interface on page 1032.
• Add anycast addresses to improve the reliability and performance of DNS services in multiple locations. For
information, see About Anycast Addressing for DNS on page 1035.
• Separate DNS traffic by assigning an IP address as the source port for DNS queries. For information, see
Specifying Source Ports on page 760.
When you use the loopback interface for anycast addressing, the upstream and neighboring routers can continue to
advertise anycast addresses without being affected by hardware malfunctions.
To configure non-anycast addresses on the loopback interface, complete the following:
1. Add IP addresses to the loopback interface. For information, see Configuring IP Addresses on the Loopback
Interface on page 1032.
2. Enable DNS services on the loopback addresses. For information, see Specifying Port Settings for DNS on page
760 and its subtopic, Specifying Source Ports.
To configure DNS anycast addresses and their advertising protocols, complete the following:
1. Add anycast addresses to the loopback interface. For information, see Configuring Anycast Addresses on page
1036.
2. Configure anycast addressing protocols. For information, see Configuring OSPF on the NIOS Appliance on page
1041 and Configuring BGP in the NIOS Appliance on page 1045. This is the primary application for routing
protocols in the NIOS appliance.
3. Enable the DNS anycast addresses. For information, see Specifying Port Settings for DNS on page 760 and its
subtopic, Specifying Source Ports.
To separate DNS queries from DNS transfers and notify messages, complete the following:
1. Add an IP address of the source port for DNS queries. For information, see Configuring IP Addresses on the
Loopback Interface on page 1032.
2. Select the source IP for DNS queries. For information, see Specifying Source Ports on page 760.

Configuring IP Addresses on the Loopback Interface

You can configure IP addresses on the loopback interface to minimize service downtime during a server migration. As
illustrated in Figure 24.1, you have two existing DNS servers (ns1.corp100.com 192.204.18.11 and
ns2.corp100.com 192.204.18.12) and you want to replace these servers with a new one (ns3.corp100.com
192.204.18.88). The migration takes a few weeks and you want DNS services to be available on all three addresses
during the migration. You can add all three IP addresses to the loopback interface of a NIOS appliance, and then
configure the appliance to provide DNS services on all addresses. After the server migration, you can shut down the
old servers and use the new one for services.

1032 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IP Addresses on the Loopback Interface

Figure 24.1 DNS Server Migration Using the Loopback Interface

Old Configuration Migration New Configuration

ns1.corp100.com
192.204.18.11

ns1.corp100.com
192.204.18.12
NIOS Appliance You can configure
Configure the an IP address for
appliance with the DNS queries and
following IP select another
addresses on the physical port for
loopback interface: DNS transfers and
192.204.18.11 ns3.corp100.com ns3.corp100.com notify messages.
192.204.18.12 192.204.18.88 192.204.18.88
192.204.18.88

You can also add an IP address that is used solely for DNS queries, to separate the DNS traffic. You first add an IP
address you want to use for DNS queries on the loopback interface. You then configure the appliance to listen for DNS
queries solely on this address. For information, see Specifying Source Ports on page 760.
When you configure non-anycast addresses on the loopback interface, ensure that you establish a static route
between the appliance and the router so queries to these addresses are routed correctly. For information, see
Advertising Loopback Addresses to the Network on page 1034.

Note: You can configure multiple interfaces on the Infoblox-4030 appliance only. To configure LAN1, LAN2 and MGMT
interfaces to the same IPv4 or IPv6 subnet, provide the same netmask for IPv4, or a CIDR prefix for IPv6, as the
LAN1 interface. Alternatively, you can use a /32 netmask (255.255.255.255) for IPv4, or /128 CIDR prefix for
IPv6 with the same subnet as LAN1 interface to configure multiple interfaces. An Infoblox-4030 can replace
three DNS cache servers that are active on the same network. When you configure multiple interfaces on the
same subnet, the outgoing traffic from NIOS host which is received through LAN2 and MGMT is directed to the
LAN1 router for all interfaces on the LAN1 subnet, irrespective of the destination IP. However, if the LAN1
interface fails, the outgoing traffic will not be re-directed to any other interface and access to LAN2 and MGMT
also fails.

To configure an IP address on the loopback interface:

1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box -> Edit icon.
2. In the Grid Member Properties Editor, select the Network tab -> Basic tab.
You can add an IPv4 or IPv6 address on the loopback. You define each type in their own table.
3. Click the Add icon in the Additional Ports and Addresses table and select Additional Address (loopback) (IPv4)
or Additional Address (loopback) (IPv6) from the drop-down list.

Note: You cannot configure Additional Address (loopback) (IPv4) interface for an IPv6 Grid member and
Additional Address (loopback) (IPv6) interface for an IPv4 Grid member. You can only enter the IP address
you want to add to the loopback interface. You cannot configure the subnet mask, prefix length, gateway,
or port settings.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1033

Configuring IP Routing Options

The appliance adds a row to the table. Complete the following:

— Interface: Displays Additional Address (loopback). You cannot modify this.
— Address: Enter the IP address you want to add to the loopback interface. An IPv6 address is a 128-bit
number in colon hexadecimal notation. It consists of eight 16-bit groups of hexadecimal digits separated
by colons (example: 2001:db8:0000:0123:4567:89ab:0000:cdef or 2001:db8::123:4567:89ab:0:cdef).
For Infoblox-4030 appliance, use a /128 CIDR for IPv6 while configuring multiple interfaces.
— Subnet Mask (IPv4) or Prefix Length (IPv6): You cannot change the netmask of the loopback interface. It is
set to 255.255.255.255, or /32. For an IPv6 address, the mask is set to 128 and cannot be modified.

Note: You cannot configure the gateway address and port settings.

4. Save the configuration and click Restart if it appears at the top of the screen.
To add multiple IP addresses on the loopback interface, repeat the steps for each IP address.

Note: If you are configuring the loopback interface on a Grid Master, the Grid is temporarily disrupted upon saving
the configuration and restarting services on the appliance. The Grid reconnects automatically and the
appliance regains the role as Grid Master after a short delay.

Advertising Loopback Addresses to the Network

Advertising IP addresses on the loopback interface relies on the upstream router to populate routes to the loopback
interface. As illustrated in Figure 24.2, when a client on a different subnet queries an IP address on the loopback
interface, it sends the request to the router. If the IP address on the loopback interface is not advertised to the router,
the request cannot reach the appliance. Therefore, when you configure non-anycast addresses on the loopback
interface, or if OSPF or BGP is not configured within your network, you must configure the upstream router to reach
the NIOS appliance through a static route on the LAN1 interface.
Note that when an appliance is configured for both authoritative and recursive queries, you should connect your
internet interface through the LAN1 port to allow for maximum flexibility while using auxiliary LAN2 and MGMT ports.
Consult with your network administrator for information about configuring static routes from the router to the
additional IP addresses on the loopback interface.

Figure 24.2 Static Route for Loopback IP Addresses

The query is sent to

the router, which has The appliance
a static route to the responds to the
appliance. query.

A client on the
Router
10.34.0.0 subnet Appliance
queries 10.0.0.246 10.0.0.123
on the loopback Loopback IP
interface of the Static Route 10.0.0.246
appliance. (on LAN1 port)
Client
10.34.1.1

When you configure DNS anycast addresses on the loopback interface, you can select OSPF, BGP, or both, to advertise
the addresses to upstream and neighboring routers, without establishing a static route. For information, see About
Anycast Addressing for DNS on page 1035.

1034 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Anycast Addressing for DNS

About Anycast Addressing for DNS

Note: This feature is not supported on vNIOS appliances for Riverbed.

Four types of communications are utilized within an IP network:

• Unicast describes a one-to-one network communication between a single sender and a single recipient. The
routing protocol determines the path through the network from the sender to the recipient based on the specific
protocol or routing scheme. Unicast also describes the address type assigned to the recipient.
• Multicast describes a one-to-many network communication between a single sender and a specific group of
recipients. All members within the group are intended recipients and each member receives a copy of the data
from the sender. Multicast also describes the address type assigned to a group of recipients, used by the
routing protocol to determine the path to the group.
• Broadcast is similar to multicast, the exception being that data is sent to every possible destination regardless
of the groups or subnetwork. There is no specific group of recipients.
• Anycast describes a one-to-nearest communication between a single sender and the nearest recipient within a
group. The routing protocol chooses one recipient within a target group based on the routing algorithm for the
specific protocol, and sends data to that recipient only.
The NIOS appliance provides the following support for DNS anycast addressing:
• You can configure up to 20 anycast IP addresses on the loopback interface of each Grid member.
• Anycast IP addresses can be in IPv4 or IPv6 format. For all anycast IP addresses, the subnet mask value is
always set to /32 for an IPv4 anycast IP or 128 for a 128-bit IPv6 address. These values are separate and
distinct from the IP configuration on the NIOS appliance LAN port.
• The appliance advertises routing information of the anycast addresses through OSPF or BGP, or (seldom) both,
depending on the deployment. Routers use the configured routing protocols to determine the best path to the
nearest server. The appliance advertises the route information to the upstream or neighboring router, a router
that forwards data on the network link and determines the forwarding path to destinations. For information, see
IP Routing Options on page 1038.
• The appliance advertises and withdraws route information based on reachability information to DNS servers
sent by the IP route advertisements.
• When you configure DNS anycast addressing on an appliance and use it as an NTP server, the appliance can
answer NTP requests through the anycast IP address. For information about how to configure an appliance as an
NTP server, see Configuring a NIOS Appliance as an NTP Server on page 414.
Anycast addressing for DNS provides the following benefits:
• Improved Reliability: Anycast provides improved reliability because DNS queries are sent to an anycast IP
address that is defined on multiple DNS servers in the NIOS Grid. If the nearest server somehow goes offline,
then the router forwards the request to the next nearest DNS server advertising the target anycast IP address
(see Figure 24.4 for an example).
• Load Distribution: Anycast distributes the load across multiple DNS servers based on network topology.
• Improved Performance: The NIOS appliance uses OSPF or BGP, depending on your configuration, to advertise
anycast routing information to the upstream and neighboring routers. The routers determine the best route to
the nearest DNS server. Anycast enables the queries to reach the nearest server more quickly, providing faster
responses to DNS queries.

Note: For more information about anycast addressing, refer to RFC 1546 “Host Anycasting Service”.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1035

Configuring IP Routing Options

Configuring Anycast Addresses

Note: Anycast addressing is supported on loopback interfaces on the NIOS appliance.

IP configuration must be defined on the LAN1 interface before configuring DNS anycast addresses. Before creating
IPv6 anycast IPs on the loopback interface, IPv6 must be enabled and configured on the LAN1 interface for the NIOS
appliance, including the correct IPv6 gateway IP address.
To enable and configure anycast addressing:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box -> Edit icon.
2. In the Grid Member Properties editor, Click Toggle Advanced Mode.
3. When the additional tabs appear, click the Anycast tab.
4. Click the Add icon and choose IPv4 Address or IPv6 Address.
5. In the Anycast Interfaces list, enter the values or select the options for the new entry:
— Anycast Interface: Anycast addressing is supported on the loopback only. This value is filled in
automatically.
— Address: Enter the IP address you want to assign as the anycast address to the loopback interface. Specify
an IPv4 Address or an IPv6 Address based on the chosen type of address.
Subnet Mask: You cannot change the subnet mask of a loopback interface. The netmask is automatically
set to 255.255.255.255, or /32; or 128 for IPv6.
— OSPF: Select if you want the appliance to use OSPF to advertise the anycast address, and if necessary
configure the OSPF settings. For information, see Configuring OSPF on the NIOS Appliance on page 1041.
IPv4 and IPv6 options are configurable for this protocol. This is supported only for IPv4 and dual mode
appliances, but not for IPv6 appliances.
— BGP: Select this if you want the appliance to use BGP to advertise the anycast address, and then configure
the BGP settings. This is supported only for IPv4 and dual mode appliances, but not for IPv6 appliances.

Note: You must configure at least one routing method for DNS anycast. You can configure OSPF, BGP, or both (in
most cases only one protocol will be used). The appliance cannot save the anycast address if you do not
complete at least one routing configuration. Anycast cannot be used without dynamic routing.

— Comments: Enter a text string to help identify this interface and IP address.
6. If using OSPF for the current appliance: Under OSPF Area Configuration, click the Add icon. A new configuration
block appears in the properties editor.
— Enter the values for the OSPF configuration as described in the section Configuring OSPF on the NIOS
Appliance.
— Click the Add down arrow icon in the OSPF Area Configuration section. The new OSPF configuration is saved
into a table.
7. If using BGP for the current appliance: In the properties editor, scroll down to the configuration block for BGP
Configuration. For information, see Configuring BGP in the NIOS Appliance on page 1045.
— In the ASN field, enter the Autonomous System ID number in which the NIOS appliance resides.
— If necessary, modify the BGP Timer Keep Alive and Hold Down values. In most circumstances these values
should be left at their defaults. Check your network’s defined policies for the desired values if necessary.
— Click the Add icon.
— Enter the Neighbor Router IP address. This can be an IPv4 address or an IPv6 address.
— Enter the Remote ASN (Autonomous System ID number) for the adjacent router.
8. Save the configuration. The system will warn that you must restart the appliance services in order to use the new
configuration.
9. Log back in to the appliance.

1036 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Anycast Addressing for DNS

10. From the Data Management tab, select the DNS tab -> Members/Servers tab -> Grid_member check box -> Edit
icon.
11. Select Toggle Advanced Mode (if necessary), click General and the Advanced tab.
12. Under Listen on these additional IP addresses, click the Add button. The list of one or more previously created
IPv4 and IPv6 addresses for the loopback interfaces (created in Step 4) appear in this table. (If the Add button is
not active here, this indicates that you have not configured any loopback interfaces with their IP addresses.)

Note: Should you need to configure other DNS properties on this page, see the topics in Configuring DNS
Services.

13. Click Save and Close.

Configured anycast interfaces are now enabled to carry DNS traffic. For further information, see Specifying Source
Ports on page 760.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1037

Configuring IP Routing Options

Best Practices for Configuring Anycast Addresses

Infoblox highly recommends that you do the following before you configure an Anycast address:
• Enable the Anycast feature in the NIOS application.
• Install a valid DNS license, enable DNS and ensure that the DNS service is active.
• When you configure OSPF or OSPFv6, ensure that the OSPF monitor runs every four seconds.
• You must configure an IP address on the loopback interface.

IP Routing Options
IP routing is a set of protocols that determine the path IP packets follow in order to travel across multiple networks
from the source to the destination. When information travels through a series of routers and across multiple
networks, IP routing protocols enable the routers to build up a forwarding table that correlates the final destination
with the next upstream routers.
For routing purposes, the internet is divided into ASs (Autonomous Systems). Data is routed within an AS using an
IGP (Interior Gateway Protocol) and routed between different ASs using an EGP (Exterior Gateway Protocol). NIOS
appliances support OSPFv2 (for IPv4) and OSPFv3 (for IPv6) for a routing IGP, and BGP4 to advertise DNS anycast
addresses in the larger internetwork.
As noted in the section Configuring Anycast Addresses, you configure OSPF or BGP4 to advertise anycast addresses,
which configured on the loopback interface of NIOS appliances. Use of either protocol depends on the network
topology, based on whether the advertisements will propagate only within a single AS or between more than one AS.
Figure 24.3 shows a simplified example.

Figure 24.3 OSPF and BGP Routing Example

The NIOS appliance supports

OSPF OSPF as the advertising
Multihomed AS protocol for anycast DNS
addresses within a single AS.
NIOS also supports BGP
among different ASs.
Other ASs BGP

BGP

BGP
BGP OSPF
Stub AS
OSPF
Multihomed AS

Within each AS, OSPF is the protocol used to forward anycast advertisements. Between ASs, BGP is the protocol
selected to advertise anycast addresses. Using this technique, DNS servers in diverse locations can operate together
to ensure continuous service.

1038 NIOS Administrator Guide (Rev. A) NIOS 7.3

 IP Routing Options

About OSPF
OSPF is a link-state protocol based on the Dijkstra algorithm used to calculate the shortest path to a destination
address within an internetwork. This protocol uses a link-state database created using routing information advertised
from neighbors and peers, each with costs based on the state of that link to the destination.
OSPF network topologies consist of administrative domains called OSPF areas. An area is a logical collection of OSPF
routers, servers and other network devices that have the same area identifier. A router within an area keeps an OSPF
database for its OSPF area only, reducing the size of the database that is maintained.

Anycast and OSPF

NIOS appliances can use the OSPF routing protocol to advertise routes for DNS anycast addresses to an upstream
router within the autonomous system. The upstream router uses the OSPF advertisement to determine the nearest
DNS server from a group of servers within the internetwork. In practice, the NIOS appliance relies upon OSPF to
determine the best route for DNS queries to take to the nearest DNS server. The upstream router then forwards the
query to the chosen DNS server.
As illustrated in Figure 24.4, to enable anycast for DNS queries, you configure two or more DNS servers within the AS
routing domain with the same anycast address on their loopback interfaces. When you select OSPF as the routing
protocol, the upstream router determines the nearest server within the group of servers configured with that anycast
address. (The “nearest” DNS server may not necessarily be the geographically closest DNS server; it is the DNS server
with the lowest cost associated with its reachability from the current node. This is calculated through the OSPF routing
algorithm, a discussion of which is far beyond the scope of this manual.) The nearest DNS server configured with the
correct anycast address then responds to the DNS query. In the case where the nearest server becomes unavailable,
the next nearest server responds to the query. OSPF anycast provides a dynamically routed failover to ensure that
DNS can always resolve client requests within the AS. From the client perspective, anycasting is transparent and the
group of DNS servers with the anycast address appears to be a single DNS server.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1039

Configuring IP Routing Options

Figure 24.4 Anycast Addressing for DNS Using OSPF

DNS Server europe.corp100.com

OSPF determines the nearest server

within the intranet/enterprise network.
In this example, europe.corp100.com
10.128.1.12
is the nearest DNS server. ery
Qu 2001:db8::256:180:c223:214e
S
DN
DNS Server us.corp100.com

DNS Query
(example: nslookup)
10.128.1.12
2001:db8::256:180:c223:214e
Intranet
Client
europe.corp100.com
DNS Server asiapac.corp100.com

DNS anycast in this example: The desktop sends a

DNS query to 10.128.1.12, the anycast address. (The 10.128.1.12
2001:db8::256:180:c223:214e
example also shows a configured IPv6 Anycast address.)
Many servers can possess the anycast address.
The routing protocol selects the ‘nearest’ server DNS Server australia.corp100.com
(based on metrics generated from the routing algorithm);
that server receives and processes the query and
sends back the response.
10.128.1.12
2001:db8::256:180:c223:214e

After you configure or change DNS anycast settings, you must restart the DNS services for the settings to take effect.
When you enter any OSPF command and wait for the interface to return more information, the appliance disconnects
your CLI session after you restart services or make other OSPF configuration changes through Grid Manager. Re-enter
your credentials to log back in to the CLI. (For information, refer to the Infoblox CLI Guide.)
To enable the appliance to support OSPF and advertising anycast addresses on OSPF from the loopback, you must
first configure the LAN1 or LAN1 (VLAN) interface as an OSPF advertising interface. For information about VLAN, see
About Virtual LANs on page 444.
You can also configure authentication for OSPF advertisements to ensure that the routing information received from
a neighbor is authentic and the reachability information is accurate. This process can be implemented for OSPF over
IPv4 networks but is not supported for IPv6/OSPFv3. For information, see Configuring OSPF on the NIOS Appliance.

Note: For more information about the OSPF routing protocol, refer to RFC 2328 “OSPFv2” and RFC 5340 “OSPF for
IPv6”.

1040 NIOS Administrator Guide (Rev. A) NIOS 7.3

 IP Routing Options

Configuring OSPF on the NIOS Appliance

Note: Use the CLI command show ospf or show ipv6_ospf to display configuration and statistical information
about the OSPF protocol running on the appliance. You can also use the set ospf or set ipv6_ospf
command to write OSPF statistical information to the syslog. In the NIOS appliance, configuration of OSPF is
limited to Syslog and the DNS anycast application.

To support DNS anycast and other routing-dependent applications on NIOS appliances, you must first configure the 
LAN1, LAN1 (VLAN), or HA (for HA pairs only) interface as an OSPF advertising interface, and then assign an area ID
on the interface to associate it with a specific OSPF area. The interface advertises the OSPF routing information to the
network so that routers can determine the best server to query. For anycasting, the advertising interface sends out
routing advertisements about the anycast address into the network out to upstream routers.
To configure the LAN(HA) or LAN1(VLAN) interface to be an OSPF advertising interface, perform the following tasks:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.
2. Select the Anycast tab in the Grid Member Properties editor.
The Anycast Interfaces appear in a table. You can add new anycast interfaces when needed.
3. Click the Add icon of the OSPF Area Configuration table and choose IPv4 Configuration or IPv6 Configuration to
define a new OSPF Area. The OSPF Area Configuration will show a similar set of Add (IPv4/IPv6) OSPF Area
configuration settings based on the protocol type. Enter the following information to configure the LAN1, 
LAN1 (VLAN), or HA interface as the OSPF advertising interface:
— Advertising Interface: Displays the interface that sends out OSPF routing advertisements. OSPF
advertisements are supported on the LAN1, LAN1(VLAN), and the HA interface, depending on whether the
appliance is an HA pair.
— Area ID: Enter the OSPF area identifier of the network containing the upstream routers, in either an IP
address format or a decimal format. All network devices configured with the same OSPF area ID belong to
the same OSPF area. The area ID configured on the Grid member must match the area ID of the upstream
router configuration. Area ID numbers are defined in the same format for IPv6 and IPv4.
— Area Type: Select the type of OSPF area to associate with the advertising interface from the drop-down list.
The area type configured on the Grid member must match the area type of the upstream router
configuration. The supported area types are described as follows:
— Standard: A standard area has no restrictions on routing advertisements, and connects to the
backbone area (Area 0) and accepts both internal and external link-state advertisements.
— Stub: A stub area is an area that does not receive external routes.
— Not-so-stubby: A not-so-stubby area (NSSA) imports autonomous system (AS) external routes and
sends them to the backbone, but cannot receive AS external routes from the backbone or other areas.

Note: OSPF for IPv6 (known as OSPFv3) configuration does not support OSPF authentication options.

— Authentication Type: Select the authentication method to use to verify OSPF routing advertisements on the
interface. The authentication type configured on the Grid member must match the authentication type of
the upstream router configuration. The supported authentication types are described as follows:
— None: No authentication for OSPF advertisement.
— Simple: A simple password for OSPF advertisement authentication, in clear text.
— MD5: An MD5 hash algorithm to authenticate OSPF advertisements. This is the most secure option.
— Authentication Key ID: Enter the key identifier to use to specify the correct hash algorithm after you select
MD as your OSPF authentication type. The authentication key ID configured on the Grid member must
match the authentication key ID of the upstream router configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1041

Configuring IP Routing Options

— Authentication Key: Enter the authentication password to use to verify OSPF advertisements after you select
Simple or MD as your OSPF authentication type. Specify a key string between 1 to 8 characters for Simple
authentication, and a string between 1 to 16 characters for MD5 authentication. The authentication key
configured on the Grid member must match the authentication key of the upstream router configuration.
— Cost: Select one of the following:
— Calculate Automatically: Select this check box to auto generate the cost to associate with the
advertising OSPF interface to the appliance. If this check box is not selected, then you specify the cost
value explicitly. Calculate the cost as 100,000,000 (reference bandwidth) divided by the interface
bandwidth. For example, a 100Mb interface has a cost of 1, and a 10Mb interface has a cost of 10.
— Fixed Metric: Enter the cost to associate with the advertising OSPF interface to the appliance.
— Hello Interval: Specify how often to send OSPF hello advertisements out from the appliance interface, in
seconds. Specify any number from 1 through 65,535. The default value is 10 seconds. The hello interval
configured on the Grid member must match the hello interval of the upstream router configuration.
— Dead Interval: Specify how long to wait before declaring that the NIOS appliance is unavailable and down,
in seconds. Specify any number from 1 through 65,535. The default value is 40 seconds. The dead interval
configured on the Grid member must match the dead interval of the upstream router configuration.
— Retransmit Interval: Specify how long to wait before retransmitting OSPF advertisements from the interface,
in seconds. Specify any number from 1 through 65,535. The default value is 5 seconds. The retransmit
interval configured on the Grid member must match the retransmit interval of the upstream router
configuration.
— Transmit Delay: Specify how long to wait before sending an advertisement from the interface, in seconds.
Specify any number from 1 through 65,535. The default value is 1 second. The transmit interval configured
on the Grid member must match the transmit interval of the upstream router configuration.
— Click Add to add the interface to the table.
The Cost, Hello Interval, Dead Interval, Retransmit Interval and Transmit Delay settings can be configured for
IPv6 deployments. OPSF authentication is not supported for IPv6 on the NIOS platform.
4. Save the configuration and click Restart if it appears at the top of the screen.

Managing OSPF
• OSPF advertises the route when the DNS service starts. The start DNS command creates an interface and
starts the OSPF daemon.
• OSPF stops advertising the route when the DNS service stops. The stop DNS command stops the OSPF daemon
and deletes the interface.
• The NIOS application does not support a route flap. For example, temporary DNS downtime such as restart,
does not stop or re-instate the OSPF advertisement.
• The OSPF advertisement stops if DNS service is down for more than 40 seconds.

1042 NIOS Administrator Guide (Rev. A) NIOS 7.3

 IP Routing Options

Anycast and BGP4

Note: Use the CLI command show bgp or show ipv6_bgp to display configuration and statistical information about
the Border Gateway Protocol running on the appliance. You can also use the set bgp command to write OSPF
statistical information to the syslog. In the NIOS appliance, configuration of BGP is limited to Syslog and the
DNS anycast application.

BGP4 (henceforth referred to as BGP) is designed to distribute routing information among ASs and exchange routing
and reachability information with other BGP systems using a destination-based forwarding paradigm. Unlike OSPF,
which calculates routes within a single AS, BGP is a vector routing protocol that distributes routing information among
different ASs. A unique ASN (autonomous system number) is allocated to each AS to identify the individual network
in BGP routing. A BGP session between two BGP peers is an eBGP (external BGP) session if the BGP peers are in
different ASs. A BGP session between two BGP peers is an iBGP (internal BGP) session if the BGP peers are in the
same AS.
BGP configuration enables large enterprises using BGP as the internetworking protocol to provide resilient DNS
services using the Infoblox solution. While BGP is mostly used by ISPs, it is also used in larger enterprise
environments that must interconnect networks that span geographical and administrative boundaries. In these
environments, it is required to use BGP to advertise anycast routes. Using BGP allows the appliance to advertise DNS
anycast addresses to neighboring routers across multiple ASs that also use BGP as their routing protocols.
As illustrated in Figure 24.5, to enable anycast for DNS queries among three different networks that span different
geographical regions, you can configure two DNS servers with the same DNS anycast addresses in the AS 65497
network. Since other network routers in AS 65498 and AS 65499 also use BGP as the routing protocol, the DNS
anycast addresses can be advertised across these networks.

Figure 24.5 Anycast Addressing for DNS using BGP

Europe
Enterprise network AS America
65497 uses Infoblox DNS BGP
servers to provide DNS Neighboring AS 65498
services. Anycast DNS Router
addresses and BGP are
configured on the
appliances so the AS 65497
anycast addresses can
be advertised to the BGP
enterprise networks AS
65498 and AS 65499, AS 65499
which contains BGP BGP
configured routers.
Asia

To enable DNS anycast addressing across different ASs, you configure BGP as the routing protocol on the NIOS
appliance. (As illustrated in Figure 24.6, the AS 65497 network contains the Infoblox DNS anycast servers, and the
AS 65499 network contains Router 1 and 2. The routers use BGP and are peered with the DNS servers. You can
configure anycast addressing on the loopback interface of the DNS servers and select BGP as the protocol to
advertise the anycast addresses to Router 1 and 2 in AS 65499. For information, see Configuring Anycast Addresses
on page 1036. Once you have configured the DNS servers, the appliances automatically add filters on the advertising
interfaces to limit the advertisements to the configured anycast IP addresses. Similarly, BGP filters are applied to
ensure that the DNS servers only receive default route advertisements from the neighboring routers.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1043

Configuring IP Routing Options

Figure 24.6 Anycast and BGP Configuration on Infoblox Appliances

Configure the following AS 65497

anycast addresses on the
appliances:
192.193.214.1/32
192.193.214.2/32
192.168.50.10/32
192.168.50.20/32 BGP 10.0.1.10 BGP 10.0.2.10
192.168.50.30/32
Select BGP as the routing
protocol, and then
configure the following:
Timers:
Keep Alive: 5 Router 2
Hold Down: 20 BGP Router 1 BGP
10.40.51.82 10.40.51.83
Router IP: 10.40.51.82
ASN: 65499
Both routers are configured with BGP and peered
Router IP: 10.40.51.83 with the Infoblox DNS servers. Admins can
ASN: 65499 configure filters on the routers to limit
advertisements received from the DNS servers.
AS 65499

BGP uses timers to determine how often the appliance sends keepalive and update messages, and when to declare
a neighboring router out of service. You can configure the time intervals for these timers. For information, see
Configuring BGP in the NIOS Appliance on page 1045.
The BGP protocol service is automatically configured to send SNMP queries about BGP runtime data. The appliance
sends SNMP traps to its neighboring routers when it encounters issues with the protocol. BGP is configured to send
SNMP traps as defined in RFC4273 Definitions of Managed Objects for BGP-4. You must enable and configure the
SNMP trap receiver on the Grid member for the member to send SNMP traps. For information, see SNMP MIB Hierarchy
on page 1376.
You can use the set bgp command to set the verbosity levels of the BGP routing service. The appliance writes BGP
statistical information to the syslog. After you configure the settings, you must restart the DNS services for the
settings to take effect. For information, refer to the Infoblox CLI Guide. Note that when you enter any BGP command
and wait for the interface to return more information, the appliance disconnects your CLI session if you restart
services or make other BGP configuration changes through Grid Manager. You must re-enter your credentials to log
back in to the CLI.
You can configure BGP on any interface to advertise anycast addresses across multiple ASs.

Note: NIOS selects the interface for BGP advertisement based on the routing configuration.

The appliance supports BGP version 4. For more information about BGP, refer to RFC4271, A Border Gateway Protocol
4 (BGP-4).

1044 NIOS Administrator Guide (Rev. A) NIOS 7.3

 IP Routing Options

Configuring BGP in the NIOS Appliance

You can configure the appliance as a BGP advertising interface for anycast addresses. The NIOS appliance advertises
the BGP routing information to the network so routers can determine the nearest server to query. The NIOS appliance
does not perform dynamic routing itself; it can use dynamic routing protocols to advertise its DNS anycast availability.
You must define the ASN of the interface and list any neighboring routers that will receive the BGP announcements.
On an HA pair, BGP runs only on the active node. In an HA failover, the BGP service resumes on the new active node.

Note: If you encounter Malformed AS_PATH error, then remove the dont-capability-negotiate option. Infoblox doesn't
provide an option to create confederation of autonomous systems if the BGP peer is configured by enabling
the dont-capability-negotiate option.

Authenticating BGP Neighbors

You can configure authentication for BGP advertisements to avoid any malicious interference by ASs. This ensures
that the routing information exchanged between BGP peers is authentic, and it is accepted only if the authentication
is successful. BGP authentication must be configured with the same password on both BGP peers. Otherwise, the
connection between them is not established. The Infoblox BGP authentication fully conforms to RFC 2385. For
information about BGP authentication, refer to RFC 2385, Protection of BGP Sessions via the TCP MD5 Signature
Option.

Note: If you upgrade from a previous NIOS version to NIOS 6.11.0 or later, BGP authentication is disabled for existing
BGP neighbors.

The BGP service restarts automatically when any of the following authentication changes are made:
• MD5 authentication is enabled or disabled for a BGP neighbor.
• Change the authentication password of a BGP neighbor, for which MD5 authentication is enabled.
To configure BGP for anycast addresses:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then click the Edit
icon.
2. In the Grid Member Properties editor, select the Anycast tab.
3. In the BGP Configuration section, complete the following:
— Interface Link Detection: Select this check box to enable link detection when the default connection fails.
This enables the router to track the next available route. For example, if LAN1 is set as the default gateway
when both LAN1 and LAN2 are working, and LAN1 later fails, the router will switch to LAN2. When LAN1
reconnects, the router will then switch back to LAN1.
— ASN: Enter the autonomous system number of the interface. Enter a number from 1 to 65535. You can
configure only one ASN on each Grid member.
— BGP Timers: BGP uses timers to control how often the interface sends KEEPALIVE messages and how long it
waits before declaring a neighboring router out of service. The keepalive timer determines the time interval
at which the interface sends KEEPALIVE messages to a neighboring router to inform the neighbor that the
appliance is alive. The hold down timer determines how long the interface waits to hear a KEEPALIVE or
UPDATE message before it assumes its neighbor is out of service. If a neighboring router is down, the
interface terminates the BGP session and withdraws all the BGP routing information to the neighbor.
— Keep Alive: Enter the time interval in seconds when the interface sends keepalive messages. You can
enter a time from 1 to 21845 seconds. The default is four seconds.
— Hold Down: Enter the time in seconds that the interface waits to hear a keepalive message from its
neighbor before declaring the neighbor out of service. You can enter a time from 3 to 65535 seconds.
The default is 16 seconds.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1045

Configuring IP Routing Options

Click the Add icon to add a neighboring router to receive BGP advertisements from the NIOS appliance. The
appliance adds a new row to the table. Complete the following:
— Neighbor Router IP: Enter the IP address (IPv4 or IPv6) of the neighboring BGP router. The neighboring
router can be within the same AS (the most likely case) or from a router in an external AS.
— Remote ASN: Enter the ASN of the neighboring router. You can enter an ASN number from 1 to 65535.
— MD5 Authentication: Select this check box to enable MD5 authentication for the BGP neighbor. When you
enable MD5 authentication, you must enter the authentication password in the Password field.
— Password: Enter the authentication password that the NIOS appliance uses to connect to the BGP neighbor.
You can enter up to 80 printable ASCII characters. The password configured on the Grid member must
match the password of the BGP neighbor.

Note: When you enter the password for a BGP neighbor, it will be preserved even if you disable MD5
authentication for the BGP neighbor later. But if you change the IP address for any existing BGP neighbor,
you must re-enter the authentication password for the BGP neighbor, even if the authentication password
remains the same.

— Comment: Enter useful information about this neighboring router.

Click the Add icon again to add another neighboring router. You can add up to 10 neighboring routers.
4. Save the configuration and click Restart if it appears at the top of the screen.
5. Anycast configuration is complete. To activate anycast, see Specifying Port Settings for DNS on page 760 and its
subtopic, Specifying Source Ports.

1046 NIOS Administrator Guide (Rev. A) NIOS 7.3

Part 5 DHCP
This section describes how to configure the Grid to provide DHCP services. It includes the following chapters:
• Chapter 25, Infoblox DHCP Services, on page 1049
• Chapter 26, Configuring DHCP Properties, on page 1069
• Chapter 28, Managing DHCP Templates, on page 1141
• Chapter 27, Managing IPv4 DHCP Data, on page 1107
• Chapter 29, Managing IPv6 DHCP Data, on page 1159
• Chapter 30, DHCP Failover, on page 1177
• Chapter 31, Configuring IPv4 DHCP Filters, on page 1187
• Chapter 32, Authenticated DHCP, on page 1213
• Chapter 33, Managing Leases, on page 1243

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1047

1048 NIOS Administrator Guide (Rev. A) NIOS 7.3
Chapter 25 Infoblox DHCP Services
This chapter provides an overview of the Infoblox DHCP services for IPv4 and IPv6. It contains the following sections:
• About Infoblox DHCP Services on page 1050
• IPv4 DHCP Protocol Overview on page 1050
• IPv6 DHCP Protocol Overview on page 1051
— IPv6 Address Structure on page 1052
• Configuring DHCP Overview on page 1053
• Managing DHCP Data on page 1055
— About Networks on page 1055
— About Shared Networks on page 1055
— About DHCP Ranges on page 1056
— About Fixed Addresses on page 1056
— About Hosts on page 1056
• About DHCP Inheritance on page 1058
— Overriding DHCP Properties on page 1059
— Viewing Inherited Values on page 1059
• About Network Views on page 1063
— Adding Network Views on page 1065
— Modifying Network Views on page 1066
— Deleting Network Views on page 1066

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1049

Infoblox DHCP Services

About Infoblox DHCP Services

DHCP (Dynamic Host Configuration Protocol) is a network application protocol that automates the assignment of IP
addresses and network parameters to DHCP-configured network devices (DHCP clients). When a DHCP client
connects to a network, it sends a request to obtain an IP address and configuration information from the DHCP server.
The DHCP server manages a pool of IP addresses and configuration information such as default gateway, domain
name, and DNS server. Depending on the configuration, the DHCP server either assigns or denies an IP address to a
client request. It also sends network configuration parameters to the client.
You can configure a NIOS appliance to provide DHCP service for IPv4 and IPv6. The Infoblox DHCP server complies
with a number of DHCP and DHCPv6 RFCs (see Appendix A Product Compliance). Limited-access admin groups can
access certain DHCP resources only if their administrative permissions are defined. For information on setting
permissions for admin groups, see Chapter 4, Managing Administrators, on page 183.

IPv4 DHCP Protocol Overview

As illustrated inFigure 25.1, when a DHCP client requests an IP address, it sends a DHCPDISCOVER message to the
router, which can act as a relay agent. The router forwards the message to the DHCP server. When the DHCP server
receives the DHCPDISCOVER message, it determines the network segment to which the client belongs and assigns
an IP address. The DHCP server then sends a DHCPOFFER message that includes the IP address and other network
configuration information. When the router receives the DHCPOFFER message, it broadcasts the message to the client
that sent the DHCPDISCOVER message.

Figure 25.1 IP Address Allocation Process

DHCP client sends a When the router (relay When the DHCP server receives
1 DHCPDISCOVER 2 3 the DHCPDISCOVER message,
agent) receives the
message for an IP DHCPDISCOVER message, it determines the network
address. it forwards the message to segment to which the client
the DHCP server. belongs, and then assigns an IP
DHCPDISCOVER address accordingly. It then
sends a DHCPOFFER message
with the IP address and other
network information.
DHCP Client
requesting an 10.1.1.1
IP address DHCP Server
DHCPOFFER (NIOS appliance)
Router
(Relay Agent)
10.1.1.0/24

4 When the router receives Address Range

the DHCPOFFER 10.1.1.20 -
message, it broadcasts 10.1.1.200
the message to the DHCP
client.

1050 NIOS Administrator Guide (Rev. A) NIOS 7.3

 IPv6 DHCP Protocol Overview

IPv6 DHCP Protocol Overview

You can configure NIOS appliances to support DHCP for IPv6 (DHCPv6), the protocol for providing DHCP services for
IPv6 networks.
The DHCPv6 client-server model is similar to that of IPv4. DHCP clients and servers use a reserved, link-scoped
multicast address to exchange DHCP messages. When a DHCP client needs to send messages to a DHCP server that
is not attached to the same link, a DHCP relay agent can be used to relay messages between the client and server.
Each IPv6 DHCP server and client has a unique DHCP unique identifier (DUID). DHCP servers use DUIDs to identify
clients when providing configuration parameters, and clients use DUIDs to identify the source of the DHCP messages
from servers.
As illustrated in Figure 25.2, a DHCP client that needs an IPv6 address sends a Solicit message to the well-known
multicast address. DHCPv6 servers then send Advertise messages to the client to indicate that they are available. The
client sends a Request message to a specific DHCPv6 server to request IP addresses and configuration parameters.
The DHCPv6 server responds with a Reply message that contains the IP addresses and configuration parameters. You
can view statistics about the IPv6 messages on the Dashboard.

Figure 25.2 Client DHCPv6 Configuration Workflow

DHCP client sends a

1 Solicit message to 3 The DHCP server sends
2 The relay agent (router)
the multicast receives the Solicit
All_
the client an Advertise
address. message and forwards it message that indicates it
to the DHCP server. is available for DHCP
service.
Solicit

DHCP server
Advertise

Request
2001:db8:1::/48
4 The client sends a Address Range
Reply
Request for IP addresses
and configuration 2001:db8:1::a -
5 The DHCP server responds with a 2001:db8:1::6d
parameters.
Reply message that includes the
IP addresses and configuration
parameters.

Infoblox DHCP servers also supports stateless configuration in which a DHCP client does not need IP addresses, but
needs configuration information only. The DHCP client sends an Information-Request packet to obtain configuration
information, and the server sends a Reply message with the requested information. For more information, refer to RFC
2462, IPv6 Stateless Address Autoconfiguration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1051

Infoblox DHCP Services

IPv6 Address Structure

An IPv6 address consists of the following:
• Global Routing Prefix—Global routing prefix is a (typically hierarchically-structured) value assigned to a site. For
example, an ISP can delegate a prefix to your site, which you can then divide into subnets.
• Subnet ID—Subnet ID is an identifier of a link within the site.
• Interface ID—Interface Identifier. This portion of the address identifies the interface on the subnet. This is
equivalent to the host identifier for IPv4 addresses.

Figure 25.3 IPv6 Address Structure

n bits m bits 128-n-m bits

Global Routing Prefix Subnet ID Interface ID

Network Prefix Interface ID

When you enter an IPv6 address in Grid Manager, you can use double colons to compress a contiguous sequence of
zeros. You can also omit any leading zeros in a four-hexadecimal group. For example, the complete IPv6 address
2006:0000:0000:0123:4567:89ab:0000:cdef can be shortened to 2006::123:4567:89ab:0:cdef. Note that if there
are multiple noncontiguous groups of zeros, the double colon can only be used for one group to avoid ambiguity. The
NIOS appliance displays an IPv6 address in its shortened form, regardless of its form when it was entered.

1052 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DHCP Overview

Configuring DHCP Overview

An overview of the complete DHCP configuration process is outlined in the following diagram (and continued on the
next page), illustrating the main steps for preparing a NIOS appliance for use. Note that the process for configuring
the DHCP server is the same for IPv4 and IPv6 networks, except that failover associations are not supported in IPv6
networks.

Begin initial configuration of DHCP for a NIOS appliance.

Use the default

network view or
create one.

Configure the Grid-level

DHCP properties.

* Do not start DHCP

services when Do you want to
configuring members configure
until the configuration member-level DHCP
is complete. properties?

Yes
No
Do you want to
2 configure DHCP Configure the member-level
properties on another DHCP properties.
member?

DHCP is now configured on (to be) enabled DHCP members.

* You cannot use

DHCP failover
associations in IPv6 Will DHCP failover
networks. be used?
Yes
No
Decide how the - Create failover associations
network will be - Configure the DHCP failover
1 used. properties

Assign Member(s)

Specify the network address and netmask. - Select the member(s) that provide DHCP
services for this network.
- Specify the network address and netmask.

Define network-level
DHCP properties.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1053

Infoblox DHCP Services

… continued from previous page.

Yes

No Do you want to define fixed Configure the network-level

addresses for this network? DHCP properties.

Yes

No
Define DHCP address Configure the fixed addresses.
ranges for this network.

Do you want to add

more ranges?

No

See 1 in the previous diagram Yes Do you want to add

to repeat the process of adding more networks?
more networks on additional
members.
No

See 2 in the previous diagram Yes Do you have

to repeat the process of No Initial configuration of DHCP
additional members to
enabling the DHCP services configure for DHCP? networks is complete.
on additional members.

Start the DHCP and DHCPv6

services on members.

1054 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DHCP Data

Configuring the Connecting Switch

To ensure that VRRP (Virtual Router Redundancy Protocol) works properly, configure the following settings at the port
level for all the connecting switch ports (HA, LAN1, and LAN2):
• Spanning Tree Protocol: Disable. For vendor specific information, search for “HA” in the Infoblox Knowledge
Base system at https://support.infoblox.com.
• Trunking: Disable
• EtherChannel: Disable
• IGMP Snooping: Disable
• DHCP Snooping: Disable or Enable Trust Interface

Note: You must disable DHCP Snooping to successfully run DHCP services on the Grid. For more information about
DHCP services, see About Infoblox DHCP Services on page 1050.

• Port Channeling: Disable

• Speed and Duplex settings: Match these settings on both the Infoblox appliance and switch
• Disable other dynamic and proprietary protocols that might interrupt the forwarding of packets

Note: By default, a NIOS appliance automatically negotiates the optimal connection speed and transmission type
(full or half duplex) on the physical links between its LAN1 or LAN1 (VLAN), HA, and MGMT ports and the
Ethernet ports on the connecting switch. If the two appliances fail to auto-negotiate the optimal settings, see
Modifying Ethernet Port Settings on page 456 for steps you can take to resolve the problem.

Managing DHCP Data

You can configure a NIOS appliance to provide DHCP service for IPv4 and IPv6, and manage both IPv4 and IPv6
objects. When you define DHCP objects, you can track specific information about a network device by defining
extensible attributes. Extensible attributes are fields that you define to track properties such as network locations or
device models. For more information, see About Extensible Attributes on page 417.

About Networks
You can configure DHCP IPv4 and IPv6 properties for the Grid and its members, and then define the IPv4 and IPv6
networks that they serve.
All networks, both IPv4 and IPv6, must belong to a network view. The appliance has one default network view and
unless you create additional network views, all networks belong to the default view. Note that because network views
are mutually exclusive, you can create networks with overlapping IP address spaces in two different network views.
For more information, see About Network Views on page 1063.

Note: The 255.255.255.255 limited broadcast address is reserved. The appliance does not automatically create
glue A records for this address. You can however create an NS record without the associated glue records. For
more information, see Changing the Interface IP Address on page 819.

About Shared Networks

A shared network is a network segment to which you assign two or more subnets. When subnets in a shared network
contain IP addresses that are available for dynamic allocation, the addresses are put into a common pool for
allocation when client requests arise. When you create a shared network, the DHCP server can assign IP addresses
to client requests from any subnet (that resides on the same network interface) in the shared network. For example,

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1055

Infoblox DHCP Services

when you have networks A, B, and C on the same network interface and you assign them to a shared network, the
DHCP server can allocate available IP addresses from any DHCP range within networks A, B, and C even when all the
client requests originate from network A. When adding subnets to a shared network, ensure that the subnets are
assigned to the same members to avoid DHCP inconsistencies.
Before creating a shared network, you must first create the subnets. For example, you must first create the IPv4
networks 10.32.1.0 and 10.30.0.0 before designating them to a shared network or create the IPv6 networks
2001:db8:1::/48 and 2001:db8:2::/48 before designating them to a shared network.
After you create a network, you can define their DHCP resources such as DHCP ranges, fixed addresses, reservations,
host records, and roaming hosts. IPv4 and IPv6 support most of the same DHCP objects, except that IPv6 does not
support reservations.

About DHCP Ranges

A DHCP range is a pool of IP addresses from which the appliance allocates IP addresses. You must add a DHCP
address range in your network so the appliance can assign IP addresses to DHCP clients within the specified range.
IPv6 DHCP ranges can also contain a range of IPv6 prefixes that it delegates to DHCP clients that request them.
You must assign a DHCP range to a Grid member. Note that you can only assign DHCP ranges to members and
networks that are in the same network view. If the server is an independent appliance, you must specify this
appliance as the member that serves the DHCP range. In addition, you can also assign IPv4 DHCP ranges to failover
associations.

About Exclusion Ranges

You can define an exclusion range within a DHCP range. Creating an exclusion range prevents the appliance from
assigning the addresses in the exclusion range to clients. IP addresses in an exclusion range are excluded from the
pool of IP addresses. You can use exclusions to split a DHCP range into multiple blocks of ranges. You can also use
addresses in the exclusion ranges as static IP addresses for network devices such as legacy printers that do not
support DHCP. An exclusion in a range can help prevent address conflicts between statically configured devices and
dynamically configured devices.

About Fixed Addresses

You can configure fixed addresses for network devices, such as routers and printers, that are not frequently moved
from network to network. By creating fixed addresses for network devices, clients can reliably reach them by their
domain names. Some network devices, such as web or FTP servers, can benefit from having fixed addresses for this
reason. In IPv4 networks, you can also reserve an IP address that is not part of a DHCP range by defining a reservation.
For information about creating reservations, see Configuring IPv4 Reservations on page 1131.

About Hosts
Infoblox hosts are data objects that contain DNS, DHCP, and IPAM data of the assigned addresses. You can assign
multiple IPv4 and IPv6 addresses to a host. When you create a host, you are specifying the name-to-address and
address-to-name mappings for the IP addresses that you assign to the host. For information about Infoblox hosts, see
About Host Records on page 578.

DHCP Configuration Checklists

After you complete the appliance configuration for each member in the Grid, as described in Chapter 8, Managing
Appliance Operations, on page 395, you can configure DHCP services.
The following checklist includes the major steps for configuring DHCP service for IPv4:

1056 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DHCP Data

Table 25.1 IPv4 DHCP Configuration Checklist

Step For more information

Configure DHCP properties for the Grid and • Configuring IPv4 DHCP Properties on page 1071
members. • Chapter 21, Configuring DDNS Updates, on page 909
• Configuring DHCP IPv4 and IPv6 Common Properties on
page 1092
• Configuring the Lease Logging Member on page 1096
Decide if you want to configure a DHCP failover • Configuring Failover Associations on page 1179
association.
Configure networks based on your network • Configuring IPv4 Networks on page 1111
requirements and decide if you want to override • Configuring IPv4 Shared Networks on page 1119
the Grid or member DHCP configuration for the
networks.
Decide if you want to configure fixed addresses • Configuring IPv4 Fixed Addresses on page 1125
and reservations, and whether to override the • Configuring IPv4 Reservations on page 1131
upper level DHCP properties for the fixed
addresses and reservations.
Define DHCP ranges and decide whether to • Configuring IPv4 Address Ranges on page 1121
override the upper level DHCP properties for the
ranges.
Enable DHCP services on the member. • Starting DHCP Services on a Member on page 1103

The following checklist includes the major steps for configuring DHCP service for IPv6:

Table 25.2 IPv6 DHCP Configuration Checklist

Step For more information

Configure DHCP properties for the Grid and • Configuring DHCPv6 Properties on page 1089
members. • Chapter 21, Configuring DDNS Updates, on page 909
• Configuring DHCP IPv4 and IPv6 Common Properties on
page 1092
• Configuring the Lease Logging Member on page 1096
Configure networks based on your network • Configuring IPv6 Networks on page 1160
requirements and decide if you want to override • About IPv6 Shared Networks on page 1166
the Grid or member DHCP configuration for the
networks.
Decide if you want to configure fixed addresses • Configuring IPv6 Fixed Addresses on page 1171
and reservations, and whether to override the
upper level DHCP properties for the fixed
addresses and reservations.
Define DHCP ranges and decide whether to • Configuring IPv6 Address Ranges on page 1168
override the upper level DHCP properties for the
ranges.
Enable DHCP services on the member. • Starting DHCP Services on a Member on page 1103

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1057

Infoblox DHCP Services

About DHCP Inheritance

When you configure DHCP properties for the Grid, members, networks, shared networks, DHCP ranges, fixed
addresses, reservations, host addresses, and roaming hosts, the appliance applies the configured properties
hierarchically. In addition, IPv4 DHCP objects inherit IPv4 specific properties and IPv6 objects inherit IPv6 specific
properties. For example, when you set DHCP IPv4 properties for the Grid, all DHCP IPv4 objects inherit the properties
from the Grid unless you override them at a specific level, and the same applies for IPv6 properties and objects.
Properties set at the member level override Grid-level settings and apply to the objects that the member serves.
Properties set at the network level override member-level settings and apply to the objects within the network.
Properties set for a DHCP range override those set at higher levels. You can also set specific properties that apply only
to fixed addresses, reservations, host addresses, and roaming hosts.
Figure 25.4 illustrates some inheritance scenarios that can occur in a Grid. As shown in the figure, the authoritative
server configuration set for the Grid is inherited by the members. Since Member 1 has no overrides and Member 2
overrides the authoritative server configuration, they have different DHCP configurations. Grid Manager applies DHCP
properties hierarchically from the Grid down. Therefore, a DHCP object below the member level can inherit DHCP
properties with multiple values from multiple sources. In Figure 25.4, network 10.1.1.0/24 inherits multiple values
(True and False) from the members for the authoritative server configuration. The shared network, which includes
10.1.1.0/24, inherits DHCP properties from both members. For DHCP range 10.1.1.11 - 10.1.1.50, since Member 1
is the assigned member, it inherits properties from Member 1 and the network. The fixed address 10.1.1.2 overrides
the BOOTP settings and inherits the authoritative server configuration from both members and the network.

Figure 25.4 Inheritance Hierarchy in a Grid

{ } = DHCP Properties
Grid Setting

{ Authoritative = True
}
Override
No override Authoritative = False

{ Authoritative = True
} { Authoritative = False
}
Member 1 Member 2

No override Set Deny BOOTP = True

{ Authoritative =
True & False } Shared
Network
10.1.1.0/24
{ Authoritative = True & False
Deny BOOTP = True }

Override Set Threshold = True

Deny BOOTP = False Authoritative = True

{ Authoritative = True & False

Deny BOOTP = False } 10.1.1.11-10.1.1.50
{ Deny BOOTP = True
Threshold = True
}
10.1.1.2

When a DHCP property contains inherited values from different sources, the appliance displays the corresponding
information when you create or modify an object. Based on the information provided, you can then decide whether
to override or keep the inherited values. You must have read/write permissions to the DHCP resources to override
inherited values. You can only view inherited values and paths if you have read-only permissions.

1058 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DHCP Inheritance

Overriding DHCP Properties

DHCP properties configured at the Grid level apply to the entire Grid. You can choose to keep the inherited properties
or override them when you configure the properties for a member, network, shared network, DHCP range, fixed
address, host address, or roaming host. For example, you can override the values of DHCP properties inherited from
a member and enter unique values for a network that is configured for DHCP.
To override an inherited value:
1. In a wizard or editor, click Override next to a property to enable the configuration. The Override button changes
to Inherit.
2. Enter a new value to override the inherited value.

Viewing Inherited Values

When you configure DHCP properties that contain inherited values, the appliance displays the information based on
the inheritance sources. The following table summaries what the appliance can display:

When you see... it means... For details, see...

Inherited From <object> the DHCP property has a definite value Simple Inheritance.
from an inheritance source.
Inherited From Upper Level the appliance cannot determine the Unknown Inheritance on page
inherited value or inheritance source for 1060.
the DHCP property.
Inherited From Multiple the DHCP property has the same value Multiple Inheritance on page 1061.
that it inherits from multiple sources.
Settings Inherited from Multiple the DHCP property has multiple values Multiple Inheritance on page 1061.
Ancestors, View Multiple that it inherits from multiple sources,
Inheritance Scenarios and you can view the values and their
corresponding sources by clicking the
View Multiple Inheritance Scenarios link.

Simple Inheritance
When a DHCP property has an inherited value from a specific source, the appliance displays the value. It also displays
Inherited From <object> (where <object> can be the Grid, member, network, shared network, or DHCP range) to indicate
the source from which the value is inherited.
For example, when you set DHCP properties at the Grid level and do not override the properties at any level, the
members, networks, shared networks, DHCP ranges, fixed addresses, reservations, host addresses, and roaming
hosts inherit these properties from the Grid. The appliance displays the property value and Inherited From Grid
Infoblox for each configured DHCP property, as shown in Figure 25.5.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1059

Infoblox DHCP Services

Figure 25.5 Simple Inheritance

Unknown Inheritance
In some cases, DHCP properties may not have definite inherited values and inheritance sources. The following are
examples of unknown inheritance:
• The appliance cannot determine the inheritance sources of the DHCP properties in a template until you use the
template to create an object.
• When a network or a DHCP range does not have an assigned member, it does not have a clear definition of an
inheritance source because a network or a DHCP range inherits properties from a member.
• When individual networks in a shared network do not have member assignments, the shared network has
unknown inheritance because the shared network inherits DHCP properties from a member and its networks.
• All roaming hosts have unknown inheritance because the DHCP properties can be inherited from different DHCP
ranges within a network view.
In cases where the source of the inheritance is unknown, the appliance displays Inherited From Upper Level as the
inheritance source. As shown in Figure 25.6, network 10.1.1.0 has unknown lease time value because it does not
have any assigned member.

Figure 25.6 Unknown Inheritance

1060 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DHCP Inheritance

Multiple Inheritance
As illustrated in Figure 25.7, a network can have multiple inherited values and inheritance sources for DHCP
properties when it is served by multiple members. When an object inherits a DHCP property from different sources,
the property value can be the same from all sources or it can be different. When the value is the same, the appliance
displays the value in the property field. When there are multiple values inherited from multiple paths, the appliance
displays the information to indicate so.
In a Grid, when two members serve the same network, the network inherits DHCP properties from both associated
members. If both members have the same configured DHCP property, the network inherits the same value from both
members. For example, when DHCP network 10.1.1.0 has two associated members and both members have the
lease time set for 20 hours, the appliance displays the lease time value and Inherited From Multiple to indicate the
value is inherited from multiple sources, as shown in Figure 25.7.

Figure 25.7 Multiple Inherited Paths with the Same Inherited Value

In the same Grid with the two members serving the same network, the network inherits different values for the same
properties if you override the Grid configuration on one member but not on the other. For example, you can configure
different PXE lease times for the members and configure a member as an authoritative DHCP server for the domain
and the other not. In this case, the appliance displays Settings inherited from multiple ancestors and provides a View
Multiple Inheritance Scenarios link so you can view the inherited values and paths, as shown in Figure 25.8.

Figure 25.8 Multiple Inheritance Sources with Multiple Values

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1061

Infoblox DHCP Services

For example, to view the multiple inherited values of the Authoritative field, click View Multiple Inheritance Scenarios,
and the Multiple Inheritance Viewer displays the inherited values from the two members. Since member1.foo.net
does not have a configured value for this field, the viewer displays Not Set, as shown in Figure 25.10. You can use
this information to determine whether you want to keep the inherited values or configure new ones.

Figure 25.9 Multiple Inheritance Viewer

Another scenario of multiple inherited levels is when you have multiple DHCP properties that can inherit the same or
multiple values from different sources. For example, when you configure multiple DHCP custom options, each of the
options can inherit the same or multiple values from multiple paths. You can override the inherited options and
configure new ones at a specific level other than the Grid level. Though these options are grouped under DHCP
Custom Options, the appliance treats each of them as a separate property. The appliance groups the inherited
options at the top, as shown in Figure 25.10. You can override these options but you cannot delete them. For multiple
values inherited from multiple sources, you can view the values in the Multiple Inheritance Viewer by clicking View
Inheritance, as shown in Figure 25.11.

Figure 25.10 DHCP Custom Options with Multiple Inheritance Sources

Figure 25.11 Multiple Inheritance Viewers for Options

When you configure email notification for the Grid or Grid member from the Data Management tab -> Grid tab, the
email address you enter there is inherited by the DHCP configuration for the Grid, members, networks, and DHCP
ranges unless you override it at a specific level. The appliance uses this email address to send notification for a DHCP
range when the DHCP usage crosses either the effective watermark threshold. For information, see Configuring
Thresholds for DHCP Ranges on page 1087.

1062 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Network Views

About DHCP Option Inheritance

A network container inherits DHCP options from its parent and grandparent network containers. A network container
does not inherit DHCP options defined at the Grid or member level.
Note the following about the DHCP option inheritance:
• For networks and shared networks, you can override an inherited DHCP option defined at the Grid or Member
level.
• A shared network without a parent network container continues to inherit DHCP options from its parent Grid or
member. The parent object is derived from the first network within the shared network.
• A network inherits DHCP option from its parent object. For example, if a network has a parent network container
parent and parent shared network parent, if a DHCP option is overridden on the shared network, then this
overridden value gets inherited. If the DHCP option is overridden on a network container, then this overridden
value gets inherited. Otherwise, the network continues to inherit from its parent Grid or member.

About Network Views

A network view is a single routing domain with its own networks and shared networks. A network view can contain
both IPv4 and IPv6 networks. All networks must belong to a network view.
You can manage the networks in one network view independently of the other network views. Changes in one network
view are not reflected in other network views. Because network views are mutually exclusive, the networks in each
view can have overlapping address spaces with multiple duplicate IP addresses without impacting network integrity.
For example, two corporations, Corp 100 and Corp 200, merge. They each have their own networks and DNS domains.
They also have their own private IP address spaces in the 10.0.0.0/24 network. Both corporations have DHCP and
DNS servers, and use dynamic DNS updates. The DHCP servers of each corporation serve IP addresses for networks
in their respective corporations. The DHCP clients in each corporation update DNS zones within their DNS domains.
They plan to migrate the networks and hosts in Corp 200 to the Corp 100 address space and the corp100.com
domain. To support both networks in the meantime and to facilitate the migration, you can configure an Infoblox Grid
to centrally manage the networks and domains of both corporations. As shown in Figure 25.12, you can configure
network views for each corporation and manage their networks independently of the other.
Member 1 serves DNS and DHCP to Corp 100. The networks of Corp 100 are contained in the corp 100 network view,
which is associated with both the internal and external DNS views of the corp100.com domain. Member 2 serves DNS
and DHCP to Corp 200. The networks of Corp 200 are in the corp 200 network view, which is associated with both the
internal and external DNS views of the corp200.com domain The two corporations have one overlapping network,
10.1.1.0/24.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1063

Infoblox DHCP Services

Figure 25.12 Two Network Views Managed by a Grid

eng.corp100.com
10.1.1.0/24
sales.corp100.com
110.10.0.0/16 corp 100 internal DNS view

34.10.2.0/24 marketing.corp100.com

corp 100 network view

sales.corp100.com
corp 100 external DNS view
Member 1
Corp 100

Grid Master eng.corp200.com

10.1.1.0/24
Member 2 sales.corp200.com

120.10.0.0/16 corp 200 internal DNS view

35.10.2.0/24 marketing.corp200.com

corp 200 network view

sales.corp200.com
corp 200 external DNS view
Corp 200

A Grid member can serve one network view only, but a network view can be served by multiple Grid members. DHCP
failover associations must be defined within a single network view, and both the primary and secondary peer must
serve the same network view.
The NIOS appliance provides one default network view. You can rename the default view and change its settings, but
you cannot delete it. There must always be at least one network view in the appliance. If you do not need to manage
overlapping IP address spaces in your organization, you can use the system-defined network view for all your
networks. You do not need to create additional network views. But if there are overlapping IP address spaces and you
need more than one network view, you can create up to 1000 network views.
Each network view must be associated with at least one DNS view. The default network view is always associated with
the default DNS view, which also cannot be deleted. When you create a network view, the appliance automatically
creates a corresponding DNS view with the same name as the network view, but with “default” prepended to the
name. You can then rename that system-defined DNS view, but you cannot delete it.
A network view can be associated with multiple DNS views (as shown in Figure 25.12), but a DNS view cannot be
associated with more than one network view. Each network view must be associated with a unique set of DNS views.
You can initiate a network discovery in only one network view at a time. When you run a discovery task, the appliance
sends updates to all DNS views associated with the network view. (For information about network discoveries, see
Chapter 14, IP Discovery and vDiscovery, on page 617.)

1064 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Network Views

Adding Network Views

All networks must belong to a network view. You can use the default network view on the appliance and create
additional network views, as needed. If you plan to enable DDNS (dynamic DNS) updates on any of the networks,
DHCP ranges and fixed addresses in the network view, you must set parameters that specify which DNS view is
updated for each network view.

Note: If there are more than 20 network views, the appliance lists the available network views in the Network View
Selector dialog box. If there are 20 or less than 20 network views, the appliance displays them in the
drop-down list.

To create a network view:

1. From the Administration tab, select the Network Views tab, and then click the Add icon.
2. In the Network View wizard, do the following:
— Name: Enter the name of the network view.
— Comment: Enter useful information about the network view.
The Cloud section displays if the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361.
Delegate authority from the Grid Master
— Delegate To: This field indicates whether the authority for the network view you want to create has already
been delegated to a Cloud Platform Appliance. Click Select to choose the Cloud Platform Appliance to which
you want to delegate authority. The Member Selector displays only Cloud Platform Appliances in the Grid.
Click the member, and Grid Manager displays the member name next to this field. This cloud member now
assumes authority for this network view, and the Grid Master does not have authority any more. You can
also click Clear to remove authority delegation from the selected Cloud Platform Appliance and return
authority back to the Grid Master.
3. Click Next to enter values for required extensible attributes or add optional extensible attributes for the network
view. For information, see About Extensible Attributes on page 417.
4. Click Next, and then save the configuration or select:
Configure DDNS Properties: Configure the DNS zones that are associated with the network view to receive DDNS
updates. When you select this option, the Configure DDNS Properties dialog box appears. The appliance saves
the network view entry before it opens the Configure DDNS Properties dialog box. For information, see
Configuring DDNS Updates on page 909.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1065

Infoblox DHCP Services

Modifying Network Views

1. From the Administration tab, select the Network Views tab -> network_view check box, and then click the Edit
icon.
2. The Network View editor provides the following tabs from which you can edit data:
— General: You can modify Name and Comments in this tab. When the Cloud Network Automation license is
installed on the Grid Master, Grid Manager displays the following in the Cloud section:
You see the following when Cloud Network Automation is deployed (For information, see Deploying Cloud
Network Automation on page 361.):
— Cloud Usage: This field indicates whether this object is associated with any specific cloud extensible
attributes or within a scope of delegation. It can be one of the following:
• Cloud from adapter: Indicates that this object has been created by a cloud adapter and it may or
may not be within a scope of delegation at the moment.
• Cloud from delegation: Indicates that this object is within the scope of delegation or the object
itself defines a scope of authority delegation, and it is not created by a cloud adapter.
• Used by cloud: Indicates that this network or network container is associated with the extensible
attribute Is External or Is Shared and the value is set to True, which implies the network is a private
or shared network managed by the CMP, and it is not Cloud from adapter or Cloud from delegation.
• Non-cloud: The object is a regular NIOS object and is not within the scope of any authority
delegation nor is it associated with any of these extensible attributes: Cloud API Owned, Is External
or Is Shared. NIOS admin users can modify this object based on their permissions.
— Owned By: A cloud object can be owned by the Grid Master or the cloud adapter. When the object is
created by the Cloud Platform member, this shows Grid. If the object is created by the cloud adapter,
this shows Adapter.
— Delegated To: This tells you whether a cloud object has been delegated to a Cloud Platform Appliance
or not. If the cloud object has a parent object and the parent has been delegated, this field shows the
parent delegation and you cannot modify the field.
— Members: This tab displays the members that provide DHCP services for the networks in this network view.
You cannot modify information in this tab. It displays the following:
— Name: The name of the DHCP member.
— IP Address: The IP address of the DHCP member.
— Failover Association: The name of the failover association to which the DHCP member belongs. If there
are multiple failover associations, only the first one is displayed.
— Comment: The information that you entered for the DHCP member.
You can sort the information in the table by column. You can also print and export the information.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific network view.
You can also modify the values of extensible attributes. For information, see About Extensible Attributes on
page 417.
— Permissions: This tab displays only if you belong to a superuser admin group. For information, see
Administrative Permissions for DHCP Resources on page 253.

Deleting Network Views

You can delete any network view, except for the default network view. You can delete a network view that has only
one DNS view associated with it. You cannot delete a network view that has more than one DNS view associated with
it. When you delete a network view, the appliance deletes all the networks and records within the network view.
To delete a network view:
1. From the Administration tab, select the Network Views tab -> network_view check box, and then click the Delete
icon.
2. In the Delete Confirmation dialog box, click Yes.

1066 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Network Views

The appliance removes the network view and its associated DNS views. You can restore the network view from
the Recycle Bin, if enabled. If you restore a network view, the appliance restores the associated DNS views as
well. For information about the Recycle Bin, see Using the Recycle Bin on page 73.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1067

Infoblox DHCP Services

1068 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 26 Configuring DHCP Properties
This chapter explains how to configure DHCP IPv4 and IPv6 properties. It contains the following sections:
• About DHCP Properties on page 1071
• Configuring IPv4 DHCP Properties on page 1071
• Configuring General IPv4 DHCP Properties on page 1071
— Specifying Authoritative on page 1072
— Defining Lease Times on page 1072
— Configuring Fixed Addresses without Restarting DHCP Service on page 1073
• Configuring Ping Settings on page 1073
• Configuring One Lease per Client on page 1075
• Configuring IPv4 BOOTP and PXE Properties on page 1076
• About IPv4 DHCP Options on page 1078
— DHCP Option Data Types on page 1080
— Configuring IPv4 DHCP Options on page 1081
— Defining IPv4 DHCP Options on page 1082
— Defining IPv4 Option Spaces on page 1082
— Configuring Custom DHCP Options on page 1083
— Applying DHCP Options on page 1083
— Configuration Example: Defining a Custom Option on page 1084
— Defining Option 60 Match Rules on page 1085
— About the DHCP Relay Agent Option (Option 82) on page 1085
• Configuring Thresholds for DHCP Ranges on page 1087
• Configuring DHCPv6 Properties on page 1089
— Defining General IPv6 Properties on page 1089
• About DHCPv6 Options on page 1090
— Configuring DHCPv6 Options on page 1090
— Defining IPv6 Option Spaces on page 1091
— Configuring Custom IPv6 DHCP Options on page 1091
— Applying DHCPv6 Options on page 1091
• Configuring DHCP IPv4 and IPv6 Common Properties on page 1092
— Configuring UTF-8 Encoding for Hostnames on page 1092
— Associating Networks with Zones on page 1093

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1069

Configuring DHCP Properties

— Keeping Leases in Deleted IPv4 and IPv6 Networks and Ranges on page 1094
— Configuring Fixed Address Leases For Display on page 1095
— Scavenging Leases on page 1095
• Configuring DHCP Logging on page 1096
— Configuring the Lease Logging Member on page 1096
• About IF-MAP on page 1098
— Configuring a Grid to Support IF-MAP on page 1099
— Validating the IF-MAP Server Certificate on page 1099
— Configuring Members as IF-MAP Clients on page 1099
— Creating IF-MAP Client Certificates on page 1100
— Overriding IF-MAP Publishing Settings on page 1102
— Deleting Data from the IF-MAP Server on page 1102
• Starting DHCP Services on a Member on page 1103
• Viewing DHCP Member Status on page 1104
— Viewing DHCP Configuration Files on page 1105

1070 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DHCP Properties

About DHCP Properties

When you configure a NIOS appliance to function as a DHCP server, you can set DHCP properties that control how the
appliance operates and enable DHCP service for IPv4 and IPv6.
You can also specify configuration information the appliance includes in its IPv4 and IPv6 DHCP messages. When a
DHCP server assigns an IP address to a client, it can include information the client needs to connect to the network
and communicate with other hosts and devices on the network. You can set these properties at the Grid level and
override them for a member, network, shared network, DHCP range, fixed address, IPv4 reservation, host address, or
roaming host.
When you configure a DHCP object that has inherited DHCP properties, you can either keep the inherited properties
or override them. The appliance displays the inherited values and the levels from which the DHCP properties are
inherited. For information, see About DHCP Inheritance on page 1058.

Configuring IPv4 DHCP Properties

The following sections describe how to configure properties that apply to IPv4 DHCP objects only. You can configure
and define the following DHCP properties:
• General properties, as described in Configuring General IPv4 DHCP Properties on page 1071.
• Ping settings, as described in Configuring Ping Settings on page 1073.
• One-lease-per-client settings, as described in Configuring One Lease per Client on page 1075.
• BOOTP and PXE properties, as described in Configuring IPv4 BOOTP and PXE Properties on page 1076.
• Custom DHCP options, as described in About IPv4 DHCP Options on page 1078.
• DDNS settings, as described in Chapter 21, Configuring DDNS Updates, on page 909.
• Ignore DHCP client identifiers, as described in Ignoring DHCP Client Identifiers on page 1075.
• Thresholds for DHCP ranges, as described in Configuring Thresholds for DHCP Ranges on page 1087.
For information on configuring properties that apply to IPv4 and IPv6 DHCP objects, see Configuring DHCP IPv4 and
IPv6 Common Properties on page 1092.

Note: Limited-access admin groups can access certain DHCP resources only if their administrative permissions are
defined. For information on setting permissions for admin groups, see Administrative Permissions for DHCP
Resources on page 253.

Configuring General IPv4 DHCP Properties

When you configure general IPv4 DHCP properties at the Grid level, the configuration applies to the entire Grid.
Though you can set DHCP properties at the Grid level, you can enable DHCP services at the member level only.
Infoblox recommends that you configure the DHCP properties before you enable DHCP on the appliance. Depending
on the properties, you can override some of them for the members, networks, DHCP ranges, fixed addresses,
reservations, host addresses, and roaming hosts. To override an inherited DHCP property, click Override next to the
property to enable the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1071

Configuring DHCP Properties

Specifying Authoritative
Only authoritative DHCP servers can send clients DHCPNAK messages when they request invalid IP addresses. For
example, a client moves to a new subnet and broadcasts a DHCPREQUEST message for its old IP address. An
authoritative DHCP server responds with a DHCPNAK, causing the client to move to the INIT state and to send a
DHCPDISCOVER message for a new IP address. Authoritative servers also respond to DHCPINFORM messages from
clients that receive their IP addresses from the DHCP server and require additional options after the initial leases
have been granted.

Defining Lease Times

When you configure DHCP general properties, you can specify the length of time the DHCP server leases an IP address
to a client. The default on the appliance is 12 hours, and you can change this default according to your network
requirements. There are a number of factors to consider when setting the lease time for IP addresses, such as the
types of resources and clients on the network, and impact to traffic and performance. With NIOS appliances, you can
set lease times at different levels, based on these factors. You can also select the Unlimited Lease Time check box to
grant unlimited lease time to IP addresses.

WARNING: Inadvertently selecting the Unlimited Lease Time check box could cause a network outage when the
address range runs out of IP addresses.

You can set a default lease time at the Grid level and then override this setting for specific members, network
containers, networks, IP address ranges or fixed addresses when appropriate.

Configuring General IPv4 Properties

To configure general IPv4 DHCP properties:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon.
DHCP Range: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
addr_range check box, and then click the Edit icon.
Fixed Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
fixed_address check box, and then click the Edit icon.
Reservation: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
reservation check box, and then click the Edit icon.
2. In the DHCP Properties editor of a Grid or member, select the General Basic tab. For all other objects, click Toggle
Advanced Mode if the editor is in basic mode. When the additional tabs appear, select the IPv4 DHCP Options
Advanced tab.
3. Complete the following:
— Authoritative: Select DHCP server is authoritative to set the DHCP server as authoritative for the domain.
This can be set for the Grid, member, network container, network and range.
— Lease Time: Enter the lease time and select the time unit from the drop-down list. The default is 12 hours.
— Unlimited Lease Time: Select this option to set an infinite lease time for all IP addresses.

WARNING: Inadvertently selecting the Unlimited Lease Time check box could cause a network outage when
the address range runs out of IP addresses.

1072 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Ping Settings

To set all other properties for a Grid or member, toggle to the advanced mode and select the General Advanced
tab to complete the following:
— Ignore Optionlist: Select Ignore optionlist requested by client and return all defined options if you want the
appliance to ignore the requested list of options in the DHCPREQUEST messages it receives from DHCP
clients, and to include all the configured options in the DHCPACK and DHCPOFFER messages it sends back
to the clients.
— LEASEQUERY: Select Allow LEASEQUERY to enable the DHCP server to respond to DHCPLEASEQUERY
messages.
4. Save the configuration and click Restart if it appears at the top of the screen.

Configuring Fixed Addresses without Restarting DHCP Service

When you configure or modify a fixed address, a DHCP service restart is required by default in order for the new
configuration to take effect. You can override this default behavior by enabling the appliance to take immediate
action when you configure or modify a fixed address outside a DHCP range without restarting DHCP service. You can
enable this feature at the Grid or member level. Note that when you enable this feature, you cannot use the CLI
command set dhcp_expert_mode.
For Cloud Network Automation deployment, this feature is automatically enabled on the Cloud Platform Appliance
that has a valid Cloud Platform license installed. For information about Cloud Network Automation, see Deploying
Cloud Network Automation on page 361.
To enable immediate fixed address configuration:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> member check box, and then
click the Edit icon.
2. In the DHCP Properties editor, click Toggle Advanced Mode if the editor is in basic mode. When the additional
tabs appear, click the General tab -> Advanced tab and complete the following:
— Immediate FA Configuration: Select this check box to enable the new configuration immediately without
restarting DHCP service when you modify or delete a fixed address.
3. Save the configuration and restart DHCP service.

Configuring Ping Settings

When a DHCP client first tries to connect to a network, it broadcasts its request for an IP address. When the appliance
receives such a request, it checks its record of assigned IP addresses and leases. Because there are a limited number
of IP addresses available, the appliance reassigns IP addresses whose leases might have expired. Therefore, once
the appliance selects a candidate IP address for lease, it sends an ICMP echo request (or ping) to the IP address to
verify that it is not in use.
If the appliance receives a response, this indicates that the IP address is still in use. Note that the lease status for this
IP address is Abandoned. The appliance then selects another candidate IP address and sends it a ping. The appliance
continues this process until it finds an IP address that does not respond to the ping. The appliance then sends a
DHCPOFFER message with the unused IP address to the DHCP client.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1073

Configuring DHCP Properties

Figure 26.1 Ping Overview

1 Client broadcasts a
DHCPDISCOVER
message.

2 When the NIOS appliance

receives the DHCPDISCOVER
message, it checks its record IP Addresses
of IP addresses and selects an
IP address for lease.
ICMP Echo
3 The appliance sends the Requests
configured number of pings
to the selected IP address.
The appliance receives a ICMP Echo
reply, indicating that the IP Replies
address is in use.

4 The appliance selects another

IP address and sends it the
IP Addresses
configured number of pings.

The appliance does not receive

a response within the specified ICMP Echo
timeout, and assumes the Requests
address is not in use.

5 The appliance sends the client

a DHCPOFFER message with
the selected IP address.

By default, the appliance pings the candidate IP address once and waits one second for the response. You can change
these default settings to better suit your environment. Though you can increase the ping or timeout value to
accommodate delays caused by problems in the network, increasing any of these values increases the delay a client
experiences when acquiring a lease. You can also disable the appliance from sending pings by changing the number
of pings to 0.
You can define ping settings for an entire Grid, and when necessary, define different ping settings for a member.
Settings at the member level override settings at the Grid level.
To configure ping settings:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
2. In the DHCP Properties editor, click Toggle Advanced Mode if the editor is in basic mode. When the additional
tabs appear, click the General tab -> Advanced tab and complete the following:
— Number of Ping Requests: Enter the number of pings the appliance sends to an IP address to verify that it is
not in use. The range is 0 to 10, inclusive. Enter 0 to disable DHCP pings.
— Ping Timeout: Select the ping timeout value from the drop-down list.
3. Save the configuration and click Restart if it appears at the top of the screen.

1074 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring One Lease per Client

Configuring One Lease per Client

You can enable one-lease-per-client to ensure that each DHCP IPv4 client receives only one lease at any given time.
When you enable one-lease-per-client and a DHCP client sends a DHCPREQUEST for a particular lease, the appliance
releases other leases that the client holds, on the interface that the client is currently using. Note that this feature
supports only DHCP IPv4 clients.
Enabling one-lease-per-client is useful when you want to control the number of leases on your subnets and ensure
that each DHCP client receives only one lease at a time. Typically, you enable one-lease-per-client for a DHCP client
that moves around a lot within different subnets and uses long leases.
When you enable one-lease-per-client at the Grid level, all members inherit the setting. You can override the Grid
setting for each member. By default, one-lease-per-client is disabled.

Note: This feature enables a single lease per client on a per member basis, not on a Grid wide basis. Lease
information is not replicated among members.

To configure one-lease-per-client:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
2. In the DHCP Properties editor, click Toggle Advanced Mode if the editor is in basic mode. Click the General tab ->
Advanced tab and complete the following:
— One Lease Per Client: Select this check box to enable one-lease-per-client. By default, this check box is not
selected.
3. Save the configuration and click Restart if it appears at the top of the screen.

Ignoring DHCP Client Identifiers

You can set the DHCP server to ignore the UID (unique client identifier) and MAC address (hardware address) of a
DHCP client when it places a request to the DHCP server for a new lease. When you configure the appliance to ignore
the MAC address of a DHCP client, you can specify the list of MAC addresses. You can enter up to 10 MAC addresses
to be ignored. The appliance ignores all the MAC addresses if you do not specify any MAC addresses. If the Ignore
Hardware Address option is enabled and a DHCP client makes a request without a client UID for a new lease, then the
appliance drops this request. This option is disabled by default. When you enable “Ignore DHCP Client ID” and a
DHCP client sends a DHCPREQUEST for a lease, the DHCP server identifies the DHCP client using the physical MAC
address of the appliance while the UID is ignored. The DHCP server then allocates an IP address based on the MAC
address of the DHCP client.
For example, when a DHCP client places a request for a new lease, the DHCP server identifies the DHCP client with
the MAC address and allocates the same IP address that was previously allocated for that MAC address.
You can define this feature at the Grid level, which is inherited at the member, shared network, IPv4 network and
range level. This feature is disabled by default.

Note: This feature is applicable only to dynamic leases and does not have any effect on the static lease generated
for fixed addresses or roaming hosts.

To ignore the client identifier of DHCP clients:

1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> and click the Members tab -> member check
box -> Edit icon.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1075

Configuring DHCP Properties

Standalone DHCP: From the Data Management tab, select the DHCP tab, and then click System DHCP
Properties.
Shared Network Editor: From the Data Management tab, select the DHCP tab -> Networks tab -> Shared Networks
section -> shared_network check box, and then click the Edit icon.
IPv4 Network Editor: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section ->
network check box, and then click the Edit icon.
IPv4 Range Editor: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section ->
click on the network address. Select the IP address range check box, and then click the Edit icon.
2. In the DHCP Properties editor, select the General tab -> Advanced tab (or click Toggle Advanced Mode) and then
complete the following:
— Accept Client Identifier and MAC Address: Select this check box to instruct the DHCP server to recognize
MAC address and client UID of a DHCP client when it requests for a new lease.
— Ignore Client Identifier: By default, this check box is not selected at the Grid level. Select this check box to
ignore the client identifier of a DHCP client while placing a request to the DHCP server for a new lease. The
DHCP server will only identify the MAC address and ignores the client identifier. DHCP clients requesting
leases with different client UIDs receive the same IP address based on the MAC address. The initial default
state is inherited from the Grid level. Click Override to modify the inherited setting. To inherit the Grid
settings, click Inherit at the member, IPv4 network and range, or shared network level.
— Ignore MAC Address: By default, this check box is not selected at the Grid level. Select this check box to
ignore MAC address of a DHCP client while placing a request to the DHCP server for a new lease. To override
the value that has been inherited from the Grid, click Override. Click the Add icon, the appliance adds a row
to the table. Click the row and enter the MAC address to be ignored. You can also select a check box and
click the Delete icon to delete the MAC address. To inherit the Grid settings, click Inherit at the member,
IPv4 network and range, or shared network level.
3. Save the configuration and click Restart at the top of the screen.

Limitations of the Ignore Client ID Feature on DHCP Failover Associations

• You cannot assign a DHCP range that has the ignore DHCP client ID feature enabled to a DHCP failover
association if:
— one of the members is an external DHCP server in the failover association.
— one of the members is running a NIOS version earlier than 6.12.
• The DHCP failover association does not work if a DHCP range having multiple inherited values has the
ignore DHCP client ID feature enabled on one server and disabled on the other.
• The range assigned to a DHCP failover association and the member (failover peer) must have the same
DHCP range setting. The DHCP failover association does not work if a range associated with it does not have
the same ignore DHCP client ID setting as the member.

Configuring IPv4 BOOTP and PXE Properties

You can configure the DHCP server to support IPv4 clients that use BOOTP (bootstrap protocol) or that include the
TFTP server name option and boot file name option in their DHCPREQUEST messages. You can specify the name or IP
address of the boot server and the name of the file the host needs to boot.
In addition, you can configure the DHCP server to support hosts that use PXE (Preboot Execution Environment) to boot
remotely from a server. When such a host starts up, it first requests an IP address so it can connect to a server on the
network and download the file it needs to boot. After it downloads the file, the host reboots and sends another IP
address request. To better manage your IP resources, set a different lease time for PXE boot requests. You can
configure the DHCP server to allocate an IP address with a shorter lease time to hosts that send PXE boot requests,
so IP addresses are not leased longer than necessary.

1076 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 BOOTP and PXE Properties

You can configure BOOTP and PXE properties at the Grid level and override them for members, IPv4 network
containers, IPv4 networks, DHCP ranges, fixed addresses, and reservations, host addresses, and roaming hosts. You
cannot configure BOOTP and PXE properties for IPv6 DHCP objects.
To configure or override BOOTP and PXE properties:
1. Grid Level: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the
Toolbar.
Member Level: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member
check box, and then click the Edit icon.
Network Level: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network
check box, and then click the Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon.
DHCP Range Level: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
addr_range check box, and then click the Edit icon.
Fixed Address Level: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network
-> fixed_address check box, and then click the Edit icon.
Reservation: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
reservation check box, and then click the Edit icon.
2. In the DHCP Properties editor, select the BOOTP/PXE tab and complete the following:
— PXE Lease Time: Click Override and select Enable PXE Lease Time if you want the DHCP server to use a
different lease time for PXE clients. You can specify the duration of time it takes a host to connect to a boot
server, such as a TFTP server, and download the file it needs to boot. For example, set a longer lease time if
the client downloads an OS (operating system) or configuration file, or set a shorter lease time if the client
downloads only configuration changes. Enter the lease time for the preboot execution environment for
hosts to boot remotely from a server.
— Deny BOOTP Requests: Select Deny BOOTP Requests to disable the BOOTP settings and deny BOOTP boot
requests.
— Complete the following in the BOOTP Settings section:
— Boot File: Enter the name of the boot file the client must download.
— Next Server: Enter the IP address or hostname of the boot file server where the boot file is stored.
Complete this field if the hosts in your network send requests for the IP address of the boot server. If
the TFTP server is the NIOS appliance that is also serving DHCP, enter the IP address of the appliance.
— Boot Server: Enter the name of the server on which the boot file is stored. Clients can request for either
the boot server name or IP address. Complete this field if the hosts in your network send requests for
the boot server name. If the TFTP server is the appliance that is also serving DHCP, enter the name of
the appliance.

Note: Enter values in both the Next Server and Boot Server fields if some hosts on your network require the boot
server name and others require the boot server IP address.

3. Save the configuration and click Restart if it appears at the top of the screen.
Note that a few characters need manual escaping when you configure a DHCP boot file name, in order to keep the
dhcpd.conf file consistent. If you do not use appropriate escape characters, then it might lead to a non working boot
file name. The following characters require manual escaping:
• '\t'- Tabulation character
• '\r'- Carriage return
• '\n'- New line
• '\b'- Bell
• '\xYY'- YY hex-number (a-f, 0-9)
For example, if you set the ‘Boot File’ to:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1077

Configuring DHCP Properties

'\x86\topdir\subdir\file.img'
You might need to enter \x and \t as the manual escape characters:
'\\x86\\topdir\subdir\file.img'
You can also specify all \ as the manual escape character:
'\\x86\\topdir\\subdir\\file.img'
The above commands result in the underlying dhcpd.conf file:
'\x5cx86\x5ctopdir\\subdir\\file.img'
or
'\x5cx86\x5ctopdir\x5csubdir\x5cfile.img'

About IPv4 DHCP Options

DHCP options provide specific configuration and service information to DHCP clients. These options appear as
variable-length fields at the end of the DHCP messages that DHCP servers and clients exchange. For example, DHCP
option 3 is used to list the available routers in the network of the client and option 6 is used to list the available DNS
servers.
An option space is a collection of options. ISC (Internet Systems Consortium) DHCP has five predefined option
spaces: dhcp, agent, server, nwip, and fqdn. The NIOS appliance supports only the predefined DHCP option space,
which contains the industry standard options as well as additional options you can configure as needed:
• Predefined options: These are option codes 1 to 125. They are allocated by the IANA and defined by IETF
standards. The DHCP server knows these standard options, and they are predefined on the server. You cannot
redefine these options or delete them from the DHCP option space.
• Custom options: These are option codes 126 to 254. They are not defined by IETF standards and are available
for private use. You can use these option codes to provide configuration or service information that none of the
predefined options provide.
You can also create option spaces to define new groups of options. For example, you can create additional option
spaces to define vendor specific options, which are encapsulated in option 43. When a DHCP client requests vendor
specific options, it makes a request using the vendor identifier set in option 60 and a list of requested vendor specific
options (option 43). The DHCP server then responds with the list of replies for the various options encapsulated into
option 43.
Note that custom options defined in the DHCP option space are included in the options section of the DHCP messages
that DHCP servers and clients exchange. Custom options defined in a user-defined option space are always
encapsulated in option 43 in DHCP messages.
You can apply options globally at the Grid level, or more specifically at the member, network, network container,
range, host and roaming host levels.
A network inherits DHCP options from its parent object. You can override the inherited DHCP options configured at
the Grid or Member level for the networks and shared networks. If a network has a parent network container and
parent shared network and if you override the DHCP options on the shared network, then the network inherits the
shared network values. If you override the DHCP options at the network container level, then the network inherits the
network container values. Otherwise, the network continues to inherit DHCP options from its parent Grid or member.
A shared network without a parent network container continues to inherit DHCP options from its parent Grid or
member. The parent object is derived from the first network within the shared network. A network container inherits
DHCP options from its parent and grandparent network containers. A network container does not inherit DHCP
options defined at the Grid or member level.
To override an inherited value, click Override next to it and complete the appropriate fields. When you click Override,
the appliance displays the value inherited from its parent object (if any). If you do not set any value at the higher level,
the appliance displays the default DHCP options. The following table lists the default DHCP Options:

1078 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Options

Table 26.1 Default DHCP Options

Name Default Value

IPV4 Common DHCP Options Enable PXE Lease Time Disabled
Lease Time 43200
Routers Empty List
Domain Name Empty
DNS Servers Empty List
Broadcast Address 127.0.0.1
Custom DHCP Options “”
Lease Scavenging Disabled
Authoritative (Advanced) Disabled
Lease Deletion (Advanced) Disabled
Ignore Optionlist (Advanced) Disabled

IPv4 DDNS Enable DDNS Updates Disabled

DDNS Domain Name “”
DDNS Update TTL 0
Generate Hostname Disabled
Fixed Address Updates Disabled
Option 81 Support Disabled
Lease Renewal Update Disabled

IPv4 Threshold Options Enable DHCP Thresholds Disabled

High - Trigger 95
High - Reset 85
Low - Trigger 0
Low - Reset 10
Enable SNMP Warnings Disabled
Enable Email Warnings Disabled
Email Addresses Empty List

IPv4 BOOTP/PXE Enable PXE Lease Time Disabled

Lease Time (Value) 0
Deny-BOOTP-Requests Disabled
Boot File “”

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1079

Configuring DHCP Properties

Name Default Value

Next Server “”
Boot Server “”

IPv6 DHCP Options Valid Lifetime 43200

Preferred Lifetime 27000
Domain Name “”
DNS Servers
Custom DHCP Options
Lease Deletion Enabled
Lease Scavenging Disabled

IPv6 DDNS Options Enable DDNS Updates

DDNS Domain Name “”
DDNS Update TTL 0
Generate Hostname Disabled
FQDN Support Disabled
• DHCP server always
updates DNS
• DHCP server updates
DNS if requested by
client
Lease Renewal Update Disabled

You can also create an option filter the appliance uses to filter address requests by the DHCP options of requesting
hosts. The filter instructs the appliance to either grant or deny an address request if the requesting host matches the
filter. For information, see Defining Option Filters on page 1198.
The DHCP option configuration conforms to the following RFCs:
• RFC 2132, DHCP Options and BOOTP Vendor Extension
• RFC 3046, DHCP Relay Agent Information Option. The supported options include option 60 (Client Identifier), 21
(Policy Filter), 22 (Maximum Datagram Reassembly Size), 23 (Default IP Time-to-Live), and 82 (Support for
Routed Bridge Encapsulation).
• RFC 3925, Vendor-Identifying Vendor Options for Dynamic Host Configuration Protocol version 4 (DHCPv4)
• RFC 2939, Procedures and IANA Guidelines for Definition of New DHCP Options and Message Types

DHCP Option Data Types

Each DHCP option is identified by a name and an option code number, and specifies a data type. The data type for
some options is predefined. For example, in the DHCP option space, the data type for option 1: subnet-mask is an IP
address. You cannot change the data type for this option. The data type for some options is user-defined and can be
in one of the formats shown in Table 26.2.

1080 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Options

Table 26.2 DHCP Option Data Types

Data type Specifies

String An ASCII text string (the same as the text data type) or a list of
hexadecimal characters separated by colons
Formatting to distinguish an ASCII text string from a hexadecimal string
is important. For details, see the following section
Boolean A flag with a value of either true or false (or on or off )
IP address A single IP address
Array of IP addresses A series of IP addresses, separated by commas
You can optionally include a space after each comma
Text An ASCII text string
8-, 16-, or 32-bit unsigned integer A numeric range of the following possible values
8-bit unsigned integer: from 0 to 255
16-bit unsigned integer: from 0 to 65,535
32-bit unsigned integer: from 0 to 4,294,967,295
8-, 16-, or 32-bit signed integer A numeric range of the following possible values
8-bit signed integer: from -128 to 127
16-bit signed integer: from -32,768 to 32,767
32-bit signed integer: from -2,147,483,648 to 2,147,483,647
Domain name A list of domain names, separated by spaces

When defining a hexadecimal string for a DHCP option (such as option 43, vendor encapsulated options), use only
hexadecimal characters (0-9, a-f, or A-F) without spaces and separated by colons. The accepted form for a
hexadecimal string, as presented in a regular expression, is [0-9a-fA-F]{1,2}(:[0-9a-fA-F]{1,2})*
Two examples of correctly written hexadecimal strings:
• aa:de:89:1b:34
• 1C:8:22:A3 (Note that the DHCP module treats a single hexadecimal character, such as “8” as “08”.)
A few examples of incorrectly written hexadecimal strings:
• :bb:45:d2:1f – Problem: The string erroneously begins with a colon.
• bb:45:d2:1f: – Problem: The string erroneously ends with a colon.
• bb:4 5:d2:1f – Problem: The string erroneously includes a space between two characters (“4” and “5”).
• bb:45:d2:1g – Problem: The string erroneously includes a nonhexadecimal character (“g”).
The DHCP module treats incorrectly written hexadecimal strings as simple text strings, not hexadecimal strings. If the
string appears in quotes, it is a text string.

Configuring IPv4 DHCP Options

To use DHCP options, you can do the following:
• Define basic DHCP options, as described in Defining IPv4 DHCP Options on page 1082.
• Configure one or more option spaces, as described in the next section Defining IPv4 Option Spaces.
• Define custom options in the predefined DHCP option space or add options to an option space that you
configured. For more information, see Configuring Custom DHCP Options on page 1083.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1081

Configuring DHCP Properties

• Specify values for the options and apply them to the Grid, or to a member, network, range, fixed address,
reservation, host, or roaming host. For more information, see Applying DHCP Options on page 1083.

Defining IPv4 DHCP Options

You can define basic DHCP options that the DHCP server uses to provide configuration information to DHCP clients.
The server includes these options in its DHCP messages.
To define DHCP options:
1. Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon.
DHCP Range: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
DHCP_range check box, and then click the Edit icon.
Fixed Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
fixed_address check box, and then click the Edit icon.
Reservation: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
reservation check box, and then click the Edit icon.
Host Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
host_record check box, and then click the Edit icon. Select the host IP address, and then click the Edit icon.
Roaming Host: From the Data Management tab, select the DHCP tab -> Networks tab -> Roaming Hosts ->
roaming_host check box, and then click the Edit icon.
2. In the DHCP Properties editor, select the IPv4 DHCP Options tab and complete the following:
— Routers: Click the Add icon. Grid Manager adds a row to the table. In the table, enter the IP address of the
router that is connected to the same network as the DHCP client. When configuring this for a template, enter
the offset value of the IP address of the router. The DHCP server includes this information in its DHCPOFFER
and DHCPACK messages.
— Domain Name: Enter the name of the domain for which the Grid serves DHCP data. The DHCP server
includes this domain name in Option 15 when it responds with a DHCPOFFER packet to a DHCPDISCOVER
packet from a client. If DDNS is enabled on the DHCP server, it combines the host name from the client and
this domain name to create the FQDN (fully-qualified domain name) that it uses to update DNS. For
information about DDNS, see Chapter 21, Configuring DDNS Updates, on page 909.
When overriding the domain name already set by a parent object, enter the new value for the selected
option or use “” to clear the value.
— DNS Servers: Click the Add icon. Grid Manager adds a row to the table. In the table, enter the IP address of
the DNS server to which the DHCP client sends name resolution requests. The DHCP server includes this
information in the DHCPOFFER and DHCPACK messages.
— Broadcast Address: Enter the broadcast IP address of the network to which the DHCP server is attached.
When configuring this for a template, enter the offset value of the broadcast IP address of the network.
3. Save the configuration and click Restart if it appears at the top of the screen.

Defining IPv4 Option Spaces

DHCP members support the DHCP option space by default. You can create additional option spaces to provide
additional configuration or service information. Note that custom options defined in a user-defined option space are
always encapsulated in option 43 in DHCP messages
To add a custom option space:
1. From the Data Management tab, select the DHCP tab -> Option Spaces tab.
2. Click the Add icon -> IPv4 Option Space.
3. In the Option Space wizard, do the following:

1082 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Options

— Name: Enter the name of the option space.

— Comment: Enter useful information about the option space.
— Options: Click the Add icon to add options. For additional information, see the next section, Configuring
Custom DHCP Options on page 1083.
4. Save the configuration and click Restart if it appears at the top of the screen.
After you create an option space and add options to it, you can apply the options as described in Applying DHCP
Options on page 1083.

Configuring Custom DHCP Options

You can define custom options in the DHCP option space or in an option space that you configured, as follows:
1. From the Data Management tab, select the DHCP tab -> Option Spaces tab.
2. Select either the DHCP option space or an IPv4 option space that you configured, and then click the Edit icon.
3. In the Option Space editor, click the Add icon to add a custom option. In the new row, complete the following:
— Name: Enter the name of the custom DHCP option.
— Code: Select an option code from the drop-down list. Select a number between 126 and 254 if you are
adding custom options to the DHCP option space. If you are adding custom options to an IPv4 option
space you configured, you can enter a number between 1 and 254.
— Type: Select the option type (such as ip-address, text, boolean, and string as described in Table 26.2).
For example, to create an option that defines the IP addresses of Solaris root servers, enter the name
SrootIP4, select option code 126, and then select the type as ip-address.
Click the Add icon to add more options.
4. Save the configuration.

Applying DHCP Options

Some options may apply to all networks and some may apply to specific ranges and even hosts. When you apply an
option, you select the object to which the option is applied, such as the Grid member, or network, and then specify
a value for the option.
Use the following guidelines when specifying option values:
• Enter false or true for a Boolean Flag type value.
• Enter an ASCII text string, or enter a series of octets specified in hex, separated by colons.
• Separate multiple values by commas. For example, to enter multiple IP addresses for netbios-name-servers,
enter a comma between each IP address.
Here are some examples of option names and correctly formatted values:

Option name Value Comment

option 61 MyPC Double quotes are no longer needed for string type
dhcp-client-identifier values
dhcp-client-identifier 43:4c:49:45:54:2d:46:4f:4f Series of octets specified in hex, separated by colons
for a Data-string type value
netbios-name-servers 10.1.1.5,10.1.1.10 Multiple IP addresses separated by commas
option-80 ABC123 Custom option number 80 set to the string ABC123.




NIOS 7.3 NIOS Administrator Guide (Rev. A) 1083

Configuring DHCP Properties

To apply DHCP options:

1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon.
DHCP Range: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
addr_range check box, and then click the Edit icon.
Fixed Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
fixed_address check box, and then click the Edit icon.
Reservation: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
reservation check box, and then click the Edit icon.
Host Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
host_record check box, and then click the Edit icon. Select the host IP address, and then click the Edit icon.
Roaming Host: From the Data Management tab, select the DHCP tab -> Networks tab -> Roaming Hosts ->
roaming_host check box, and then click the Edit icon.
2. In the DHCP Properties editor, select the IPv4 DHCP Options and complete the following:
— The Custom DHCP Options section displays two fields. The first field displays Choose option. Click the arrow
and select an option from the list. In the second field, enter a value for the selected option. Note that
certain options have predefined data types and their values must be entered in a specific format. For
information about the data types, see DHCP Option Data Types on page 1080.
Click + to add another option, or click - to delete a previously specified option. When overriding an option
already set by a parent object, enter the new value for the selected option or use “” to clear the value.
Note that if you created an option space as described in Defining IPv4 Option Spaces on page 1082, this
section displays a list of option spaces in the first drop-down menu, so you can select the option space of
the option you want to define.
3. Save the configuration and click Restart if it appears at the top of the screen.

Configuration Example: Defining a Custom Option

In this example, you configure two custom options in the DHCP option space, and apply them to a DHCP range in the
network 192.168.2.0/24.
Add the custom options to the DHCP options space:
1. From the Data Management tab, select the DHCP tab -> Option Spaces tab.
2. Select the DHCP check box, and click the Edit icon.
3. In the DHCP (Option Space) editor, click the Add icon. In the new row, complete the following:
— Name: Enter tftp-server.
— Code: Enter 150.
— Type: Select array of ip-address.
4. Click the Add icon to add another option.In the new row, complete the following:
— Name: Enter pxe-configfile.
— Code: Enter 209.
— Type: Select text.
5. Click Save & Close.
Enter values for the newly defined custom options and apply them to a DHCP range:

1084 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Options

1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks subtab, and click the
192.168.2.0/24 network.
2. Click the 192.168.2.10 - 100 check box, and then click the Edit icon.
3. In the DHCP Properties editor, select the DHCP tab and complete the following in the Custom DHCP Options
section:
— From the drop-down list of options, select tftp-server (150) array of address. In the second field, enter
192.168.1.2.
Click + to add another option.
— From the drop-down list of options, select pxe-configfile (209) text. In the second field, enter pxe.config,
which is the file name of the boot image.
4. Save the configuration and click Restart if it appears at the top of the screen.
The member then includes options 150 and 209 in its DHCP messages to clients that are allocated IP addresses from
the DHCP range 192.168.2.10 - 100.

Defining Option 60 Match Rules

The appliance uses option 60 (vendor-class-identifier) to forward client requests to the DHCP server for services that
the clients require. You can define option 60 match rules and filter on these rules. You can set these rules for the Grid
and override for a member.
To define option 60 for the Grid or member:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
2. In the DHCP Properties editor, click Toggle Advanced Mode if the editor is in basic mode. When the additional
tabs appear, click the DHCP Options tab -> Advanced tab and complete the following:
To override the Grid configuration for a member, click Override next to the property. Grid Manager hides the Grid
configuration. You can then add new values for the member.
— Option 60 (Vendor Class Identifier) Match Rules: Click the Add icon if you want to add a match rule to a
vendor class option. The appliance adds a row to the table. Complete the following:
— Option Space: Select an option space from the drop-down list. This field appears only when you have
custom option spaces. The appliance uses the default DHCP option space if you do not have custom
option spaces.
— Match Value: Enter the value you want the appliance to use when matching vendor class options.
— Is Substring: Select this check box if the match value is a substring of the option data.
— Substring Offset: Enter the number of characters at which the match value substring starts in the option
data. Enter 0 to start at the beginning of the option data, enter 1 for the second position, and so on. For
example, when you enter 2 here and have a match value of RAS, the appliance matches the value RAS
starting at the third character of the option data.
— Substring length: Enter the length of the match value. For example, if the match value is SUNW, the
length is 4.
3. Save the configuration and click Restart if it appears at the top of the screen.

About the DHCP Relay Agent Option (Option 82)

A typical relationship between a DHCP client, relay agent, and the NIOS appliance on a network is as follows:
1. A DHCP client broadcasts a DHCPDISCOVER message on its network segment.
2. A DHCP relay agent on that segment receives the message and forwards it as a unicast message to one or more
DHCP servers (such as NIOS appliances).

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1085

Configuring DHCP Properties

3. If the NIOS appliance accepts the address request, it responds to the relay agent with a DHCPOFFER message. If
the appliance denies the request, it does not send any response in case other DHCP servers that might be
involved respond instead.
4. The relay agent forwards the response to the client, usually as a broadcast message.
The situation is different for individual hosts connecting to the Internet through an ISP, usually over a circuit-switched
data network.
1. A host connects to its ISP’s circuit access concentration point, authenticates itself, and requests an IP address.
2. The circuit access unit relays the address request to a DHCP server, which responds with a DHCPOFFER message.
To avoid broadcasting the DHCPOFFER over the network segment on which the host made the request, the relay agent
sends the response directly to the host over the established circuit.
Option 82 assists the agent in forwarding address assignments across the proper circuit. When a relay agent receives
a DHCPDISCOVER message, it can add one or two agent IDs in the DHCP option 82 suboption fields to the message.
The two relay agent IDs are:
• Circuit ID: This identifies the circuit between the remote host and the relay agent. For example, the identifier can
be the ingress interface number of the circuit access unit (perhaps concatenated with the unit ID number and
slot number). The circuit ID can also be an ATM virtual circuit ID or cable data virtual circuit ID.
• Remote ID: This identifies the remote host. The ID can be the caller ID telephone number for a dial-up
connection, a user name for logging in to the ISP, a modem ID, and so on. Because the remote ID is defined on
the relay agent, which is presumed to have a trusted relationship with the DHCP server, and not on the
untrusted DHCP client, the remote ID is also presumably a trusted identifier.

Note: For information about the relay agent option, refer to RFC3046, DHCP Relay Agent Information Option.

On the NIOS appliance, you can do the following with option 82:
• Screen address requests through a relay agent filter you set up using option 82. For more information, see
About Relay Agent Filters on page 1195.
• Use the relay agent information (circuit ID or remote ID) as a host identifier when configuring a fixed address,
though you cannot do so in a host record. For information about how to configure a circuit ID or remote ID as an
identifier, see Adding IPv4 Fixed Addresses on page 1126.
• Define how Grid Manager displays the relay agent ID, circuit ID, and remote ID (when applicable) in the detailed
lease information panel. For information about how to configure the logging format for option 82, see Defining
Logging Format for DHCP Option 82.

Defining Logging Format for DHCP Option 82

When you define the circuit ID or remote ID of the relay agent as a host identifier, you can choose the logging format
Grid Manager uses to display the IDs in the detailed lease information panel. For information about viewing lease
information, see Viewing Detailed Lease Information on page 1246.
To define logging format for the agent ID, circuit ID and remote ID, complete the following:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Independent Appliance: From the Data Management tab, select the DHCP tab, and then click System DHCP
Properties.
2. In the Grid DHCP Properties or System DHCP Properties editor, select the General tab -> Advanced tab.
3. Select one of the following for Logging format for Option 82:
— Hexadecimal: When you select this, Grid Manager displays the agent ID, circuit ID, and remote ID in
hexadecimal format in the detailed lease information. This is the default format.
— Plain text: When you select this, Grid Manager displays the agent ID, circuit ID, and remote ID in plain text in
the detailed lease information.

1086 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Thresholds for DHCP Ranges

Note: You cannot override this Grid setting at the member level. Also, changing the logging format requires a
DHCP service restart.

Configuring Thresholds for DHCP Ranges

Grid Manager can provide a view of the current overall DHCP range usage for the DHCP ranges defined on each Grid
member. The view is in the form of a percent: address leases in use/total addresses for each network. Such
information can indicate if there is a sufficient number of available addresses at each of these levels. It can also
provide information about the distribution of address resources, indicating if there are too many unused addresses
in one location while all the addresses in another are in use.
In addition to viewing the percent of addresses in use, you can also apply high and low thresholds for each DHCP
range. These watermarks represent thresholds above or below which DHCP range usage is unexpected and might
warrant your attention. For example, usage falling below a low threshold might indicate network issues preventing
the renewal of leases. When usage for a DHCP range crosses a threshold, the appliance makes a syslog entry and—
if configured to do so—sends the administrator alerts as SNMP traps and email notifications. Figure 26.2 illustrates
the relationship of allocated and available addresses to high and low watermarks in a DHCP range.

Figure 26.2 Overall DHCP Address Usage for a DHCP Range

100% If usage crosses thresholds in either direction,

Available Leases the appliance can send email and SNMP
80% High Watermark warnings to the administrator.
70%
Allocated Leases

20% Low Watermark

Administrator
0%
DHCP Range
70% of the DHCP
range is in use. Available
Leases

High
Watermark

Allocated
Low Leases
Watermark
You can define watermarks at the Grid, member, network, and DHCP range levels, but the appliance applies them
solely to DHCP ranges. Because the appliance applies settings hierarchically in a parent-child structure, by defining
watermarks once at a higher level, DHCP ranges can then inherit these settings without your needing to redefine them
for each range. For example, if you set high and low watermarks for a Grid, then each Grid member, each network, and
each DHCP range inherits these settings. However, if you override these settings at the member level, then the
network and DHCP ranges for that member inherit its settings. If you override the Grid member settings at the network
level, then that network and any DHCP ranges within that network inherit the network-level settings. Finally, you can
set high and low watermarks for an individual DHCP range, which override anything set at a higher level.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1087

Configuring DHCP Properties

Figure 26.3 shows different high and low watermark settings at different levels. Although you can set thresholds at
four levels (Grid, Grid member, network, and DHCP range), the NIOS appliance applies them to DHCP ranges.

Figure 26.3 High and Low Watermarks

Watermarks at Grid
Different Levels
80%
You can set DHCP range
usage thresholds (watermarks) 65%
for Grids, Grid members, Grid Member
networks, and DHCP ranges.
The thresholds that you set at 75%
more narrowly defined levels 20%
override thresholds set at the
more generic levels that 50% Network
contain them. For example, if 90%
address usage exceeds the 25%
70% high watermark or dips
below the 30% low watermark
for the DHCP range shown DHCP Range
40%
here, the NIOS appliance generates email and
SNMP alerts, even though address usage is Available Leases
70% High Watermark
within acceptable ranges at all higher levels. 10%
There is a parent-child relationship among different levels. 50%
If you do not set a watermark at a more specific level, it
inherits the setting from a higher level that contains it. 30% Allocated Leases
Low Watermark
Note: You can set watermarks at different levels, but the appliance
applies only watermarks that are set or inherited at the DHCP range.

Address usage in a DHCP range can trigger an event and an email notification when it crosses a watermark. You must
enable DHCP threshold and email warnings to receive events and notifications. The following are actions that do and
do not trigger an address usage event and notification:
Address usage triggers an event and the appliance sends a notification when the percentage of the allocated
addresses in the DHCP range:
— Exceeds the high watermark
— Drops below or equals to the high watermark after exceeding it
— Drops below the low watermark
— Exceeds the low watermark after dropping below it
Address usage does not trigger an event when the percentage of the allocated addresses in the DHCP range:
— Never exceeds the low watermark
— Initially exceeds the low watermark
— Reaches a watermark but does not cross it

Note: You can effectively disable address usage events for a DHCP range by setting its high watermark at 100% and
the low watermark at 0% (default setting for the low watermark). Because address usage cannot cross these
watermarks, no events can occur.

You can configure the threshold settings at the Grid level and override them at the member, network, and DHCP range
levels. To override an inherited DHCP property, click Override next to the property to enable the configuration. For
information, see Overriding DHCP Properties on page 1059.
To configure thresholds:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.

1088 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DHCPv6 Properties

Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon.
DHCP Range: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
addr_range check box, and then click the Edit icon.
2. In the editor, select the IPv4 DHCP Thresholds tab and complete the following:
— DHCP Thresholds: Specify the following:
— Enable DHCP Thresholds: Select Enable DHCP Thresholds to enable the DHCP threshold feature.
• High: Enter a number between 0 and 100. Enter Trigger and Reset values. If the percentage of
allocated addresses in a DHCP range exceeds the Trigger value, the appliance makes a syslog entry
and—if configured to do so—sends an SNMP trap and an email notification to a designated
destination. When the percentage first reaches the Reset value after it hit the Trigger value, the
appliance sends an SNMP trap and an email notification to a designated destination. The default
Trigger value is 95, and the default Reset value is 85.
• Low: Enter a number between 0 and 100. If the percentage of allocated addresses in a DHCP range
drops below the Trigger value, the appliance makes a syslog entry and—if configured to do so—
sends an SNMP trap and an email notification to a designated destination. When the percentage
first reaches the Reset value after it hit the Trigger value, the appliance sends an SNMP trap. The
default Trigger value is 0 and the default Reset value is 10.
— Enable SNMP Warnings: Select this for the appliance to send an SNMP trap to the trap receiver that you
define for the Grid when the address usage in a DHCP range crosses a high or low mark threshold.
— Enable Email Warnings: Select this for the appliance to send an email notification to an administrator if
the address usage in a DHCP range crosses a high or low mark threshold.
— Email Addresses: Click Override to override the Grid administrator email address configured in the Data
Management tab -> Grid tab. This address is not hierarchically inherited from the Grid DHCP configuration.
Click the Add icon, and then enter an email address to which you want the appliance to send email
notifications when the DHCP range for the network crosses a threshold. You can create a list of email
addresses.
3. Save the configuration and click Restart if it appears at the top of the screen.

Configuring DHCPv6 Properties

The following sections describe how to configure properties and options that apply to DHCPv6 objects only. You can
configure and define the following DHCP properties:
• General properties, as described in the next section, Defining General IPv6 Properties.
• DHCP options, as described in About DHCPv6 Options on page 1090.

Defining General IPv6 Properties

You can configure general DHCPv6 properties at the Grid level and override them at the member and lower levels.
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1089

Configuring DHCP Properties

Fixed Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
Fixed address check box, and then click the Edit icon.
2. In the DHCP Properties editor, select the IPv6 DHCP Options tab, and complete the following:
— Valid Lifetime: Specify the length of time addresses that are assigned to DHCP clients remain in the valid
state. When this time expires, an address becomes invalid and can be assigned to another interface.
— Preferred Lifetime: Specify the length of time that a valid address is preferred. A preferred address can be
used with no restrictions. When this time expires, the address becomes deprecated.
— Domain Name: Enter the name of the domain for which the Grid serves DHCP data.
— DNS Servers: Click the Add icon. Grid Manager adds a row to the table. In the table, enter the IPv6
addresses of DNS recursive name servers to which the DHCP client can send name resolution requests. The
DHCP server includes this information in the DNS Recursive Name Server option in Advertise, Rebind,
Information-Request, and Reply messages.
3. Save the configuration.

About DHCPv6 Options

DHCPv6 options provide configuration and service information to IPv6 clients. Just like IPv4 options, IPv6 options
appear as variable length fields at the end of the DHCPv6 messages.
Just as in IPv4, the NIOS appliance supports the following options in the DHCPv6 options space:
• Predefined options: These are the option codes defined in RFC 3315. You cannot redefine these options or
delete them from the DHCP option space. Option codes 1-48 are reserved and cannot be used to define custom
options.
• Custom options: These are option codes 49 to 254. They are not defined by IETF standards and are available for
private use. You can use these option codes to provide configuration or service information that none of the
predefined options provide.
You can also create option spaces to define new groups of options. For example, you can create additional option
spaces to define vendor specific options, which are encapsulated in DHCPv6 option 17. When an IPv6 client requests
vendor specific options, it makes a request using the vendor specific options (option 17). The DHCP server then
responds with the list of replies for the various options encapsulated into option 17.
Note that custom options defined in the DHCP option space are included in the options section of the DHCP messages
that DHCP servers and clients exchange.
You can apply options globally at the Grid level, or more specifically at the member, network, range, host and roaming
host levels.

Configuring DHCPv6 Options

To use DHCPv6 options, you can do the following:
• Configure one or more option spaces, as described in the next section Defining IPv6 Option Spaces.
• Define custom options in the predefined DHCPv6 option space or add options to an option space that you
configured. For more information, see Configuring Custom IPv6 DHCP Options on page 1091.
• Specify values for the options and apply them to the Grid, or to a member, network, fixed address, host, or
roaming host. For more information, see Applying DHCPv6 Options on page 1091.

1090 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DHCPv6 Options

Defining IPv6 Option Spaces

DHCP members support the DHCPv6 option space by default. You can create additional option spaces to provide
additional configuration or service information.
To add a custom option space:
1. From the Data Management tab, select the DHCP tab -> Option Spaces tab.
2. Click the Add icon -> IPv6 Option Space.
3. In the IPv6 Option Space wizard, do the following:
— Name: Enter the name of the option space.
— Enterprise Number: Enter the vendor’s Enterprise Number that is registered with IANA.
— Comment: Enter useful information about the option space.
— Options: Click the Add icon to add options. For additional information, see the next section, Configuring
Custom DHCP Options on page 1083.
4. Save the configuration and click Restart if it appears at the top of the screen.
After you create an option space and add options to it, you can apply the options as described in Applying DHCP
Options on page 1083.

Configuring Custom IPv6 DHCP Options

You can define custom options in the DHCP option space or in an option space that you configured, as follows:
1. From the Data Management tab, select the DHCP tab -> Option Spaces tab.
2. Select either the DHCPv6 option space or an IPv6 option space that you configured, and then click the Edit icon.
3. In the Option Space editor, click the Add icon to add a custom option. In the new row, complete the following:
— Name: Enter the name of the custom DHCP option.
— Code: Enter a number from 1 to 65535 to add a custom option in the DHCP option space or in an IPv6
option space that you have configured.
— Type: Select the option type (such as ipv6-address, text, boolean, and string as described in
Table 26.2).
Click the Add icon to add more options.
4. Save the configuration.

Applying DHCPv6 Options

You can apply some options at the Grid or member level, and some options to specific networks, shared networks,
fixed addresses and roaming hosts. When you apply an option, you select the object to which the option is applied,
such as the Grid, member, or network, and then specify a value for the option.
Use the following guidelines when specifying option values:
• Enter false or true for a Boolean Flag type value.
• Enter an ASCII text string, or enter a series of octets specified in hex, separated by colons.
• Separate multiple values by commas. For example, to enter multiple IP addresses for netbios-name-servers,
enter a comma between each IP address.
DHCPv6 options support the same data types as DHCP IPv4 options. For more information about the data types, see
DHCP Option Data Types on page 1080.
To apply DHCP options:
1. Grid: From the Data Management tab, select the DHCP tab, and then select Grid DHCP Properties from the
Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1091

Configuring DHCP Properties

Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon.
Fixed Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
fixed_address check box, and then click the Edit icon.
Host Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
host_record check box, and then click the Edit icon. Select the host IP address, and then click the Edit icon.
Roaming Host: From the Data Management tab, select the DHCP tab -> Networks tab -> Roaming Hosts ->
roaming_host check box, and then click the Edit icon.
2. In the DHCP Properties editor, select the IPv6 DHCP Options and complete the following:
— Custom IPv6 DHCP Options: In the first field, select one of the following from the drop-down list:
— DHCPv6: Select this to apply DHCPv6 options.
— DHCP: Select this to apply DHCP options (dhcp-renewal-time or dhcp-rebinding-time).
In the second field, click the Choose option arrow and select an option from the list. In the third field, enter a
value for the selected option. Note that certain options have predefined data types and their values must be
entered in a specific format. For information about the data types, see DHCP Option Data Types on page 1080.
Click + to add another option, or click - to delete a previously specified option. When overriding an option, enter
the new value for the selected option.
Note that if you created an option space, this section displays a list of option spaces in the first drop-down
menu, so you can select the option space of the option you want to define.
3. Save the configuration and click Restart if it appears at the top of the screen.

Configuring DHCP IPv4 and IPv6 Common Properties

This section describes DHCP properties that apply to both IPv4 and IPv6. It includes the following sections:
• Configuring UTF-8 Encoding for Hostnames
• Associating Networks with Zones on page 1093
• Keeping Leases in Deleted IPv4 and IPv6 Networks and Ranges on page 1094
• Configuring Fixed Address Leases For Display on page 1095
• Scavenging Leases on page 1095

Configuring UTF-8 Encoding for Hostnames

When you configure the appliance as a DHCP server, the appliance supports UTF-8 encoding of hostnames that are
encoded with Microsoft Windows code pages. You can configure the DHCP services on the appliance to convert these
client hostnames to UTF-8 characters. The appliance stores the UTF-8 encoded hostnames in the database. If you also
configure the DHCP services on the appliance to perform DDNS updates, the appliance sends the UTF-8 encoded host
names in the DDNS updates. You can configure the UTF-8 encoding of host names at the Grid DHCP service and
member DHCP service levels. For information on UTF-8 encoding, see Printing from Grid Manager on page 111.
The appliance displays the host names in their original characters in the following:
• DHCP lease history
• DHCP lease details
• IP address management
• Syslog
• Audit log
To configure UTF-8 encoding for hostnames:

1092 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DHCP IPv4 and IPv6 Common Properties

1. Grid: From the Data Management tab, select the DHCP tab, and then select Grid DHCP Properties from the
Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
2. In the DHCP Properties editor, select the General Basic tab and complete the following:
— IPv4 Properties
— Microsoft Clients Code Page: From the drop-down list, select the code page with which the host names
are encoded when the appliance converts the Microsoft code page encoded host names to UTF-8
characters.
— IPv6 Properties
— Microsoft Clients Code Page: From the drop-down list, select the code page with which the host names
are encoded when the appliance converts the Microsoft code page encoded host names to UTF-8
characters.
3. Save the configuration and click Restart if it appears at the top of the screen.

Associating Networks with Zones

You can associate IPv4 and IPv6 networks with DNS zones to limit the zones that admins can use when they create
DNS records for IP addresses in the networks. When a network is associated with one or more zones and an admin
creates a DNS record for one of its IP addresses, Grid Manager allows the admin to create the DNS record in the
associated zones only. For example, if you associate the 10.1.0.0/16 network with the corp100.com zone, admins
are allowed to create DNS records in the corp100.com zone only for IP addresses in the 10.1.0.0/16 network; or if
you associate the 2001:db8:1::/48 network with the corp200.com zone, admins are allowed to create DNS records
in the corp200.com zone only for IP addresses in the 2001:db8:1::/48 network.
This feature applies to A, AAAA and host records only. It does not apply to records in a shared record group. If you are
creating a host record with multiple IP addresses in different networks, the networks must be associated with the
zone of the host record.
If a network is not associated with a zone, admins can create DNS records for its IP addresses only in zones with no
network associations as well.
You can associate a network with any authoritative zone whose primary server is a Grid member or a Microsoft server,
or is unassigned. You cannot associate networks with zones that have external primary servers.
You can associate a network with multiple zones, and associate a zone with more than one network. You can
associate IPv4 and IPv6 network containers and networks with zones. When you associate a network container with
zones, its networks inherit the zone associations. You can override the zone associations at the network level.
If you split a network, the resulting subnets inherit the zone associations. If you join networks, the resulting network
retains the zone associations of the network that you selected when you performed the join operation. You can
override the inherited zone associations of individual networks. Subzones do not inherit the network associations of
their parent zones.
When you import data into a zone that is associated with a list of networks, the imported A, AAAA and host records
must have IP addresses in the associated networks. Grid Manager does not allow you to import A, AAAA and host
records with IP addresses in unassociated networks.
When you associate a network with a zone, the DNS records created before the association are not affected. But if
you edit an A, AAAA or host record after the association, Grid Manager does not allow you to save the record if its IP
address is not in an associated network.
To associate an IPv4 or IPv6 network with a zone:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box, and then
click the Edit icon.
2. In the DHCP Network editor, click Toggle Advanced Mode if the editor is in basic mode.
3. When the additional tabs appear, click the Advanced subtab of the General tab.
4. Click the Add icon and select the zone you want to associate with the network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1093

Configuring DHCP Properties

— Optionally, select a default zone. When you create or edit an A, AAAA or host record from a network in the
IPAM tab, Grid Manager automatically selects the default zone that is assigned to the network.
5. Save the configuration or click the Schedule icon at the top of the wizard to schedule this task. In the Schedule
Change panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.

Viewing the Networks Associated with a Zone

You can view the IPv4 or IPv6 networks associated with a zone from the zone editor. The tab to display network
associations in zone editors is visible only if the primary server is a Grid member, a Microsoft server, or unassigned.
To view the network associations of a zone:
1. From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and then click the Edit icon.
2. In the Authoritative Zone editor, click Toggle Advanced Mode if the editor is in basic mode.
3. When the additional tabs appear, click the Advanced subtab of the General tab.
The Network Associations table lists the networks and their corresponding comments. You cannot change the
network associations in this editor. Navigate to the DHCP Network editor of the network, to change the zone
associations.

Keeping Leases in Deleted IPv4 and IPv6 Networks and Ranges

You can configure the DHCP server to store leases in a deleted DHCP range for up to one week after the leases expire.
When you add a new DHCP range that includes the IP addresses of these leases or assign the DHCP range to another
member within the Grid, the appliance automatically restores the active leases. You can configure this feature for the
Grid, and override the configuration for members, networks, and DHCP ranges.
To keep active leases in a deleted DHCP range:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon.
Range: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> range
check box, and then click the Edit icon.
2. In the DHCP Properties editor of the Grid or member, click Toggle Advanced Mode if the editor is in basic mode,
and then click the General tab -> Advanced tab. In the Network editor or Range editor, click Toggle Advanced Mode
if the editor is in basic mode, and then click IPv4 DHCP Options -> Advanced or IPv6 DHCP Options -> Advanced.
Complete the following:
— IPv4 Properties
— Lease Deletion: When you select Keep leases from deleted range until one week after expiration and
delete a DHCP range with active leases, the appliance stores these leases for up to one week after they
expire.
— IPv6 Properties
— Lease Deletion: When you select Keep leases from deleted range until one week after expiration and
delete a DHCP range with active leases, the appliance stores these leases for up to one week after they
expire.
3. Save the configuration and click Restart if it appears at the top of the screen.

1094 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DHCP IPv4 and IPv6 Common Properties

Configuring Fixed Address Leases For Display

You can configure the DHCP server to capture the hostname and lease time of a fixed address when you assign an
IPv4 or IPv6 fixed address to a client. The appliance displays the hostname, and the start and end time of each fixed
address lease in the Current Leases panel in Grid Manager.
You can set this at the Grid level only for IPv4 and IPv6 leases.
1. From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
2. In the Grid DHCP Properties editor, click Toggle Advanced Mode if the editor is in basic mode. When the
additional tabs appear, click the General tab -> Advanced tab and complete the following:
— IPv4 Properties
— Fixed Address Lease: Select Capture hostname and lease time when assigning Fixed Addresses. The
appliance displays the host name, and the start and end time of each fixed address lease in the Current
Leases panel. If there are multiple records (A, host, and lease) for the IP address, it also displays the
information for the records. This option is available in the Grid Properties editor only.)
— IPv6 Properties
— Fixed Address Lease: Select Capture hostname and lease time when assigning Fixed Addresses. The
appliance displays the host name, and the start and end time of each fixed address lease in the Current
Leases panel. If there are multiple records (AAAA, host, and lease) for the IP address, it also displays
the information for the records. This option is available in the Grid Properties editor only.)
3. Save the configuration.

Scavenging Leases
The accumulation of free and backup DHCPv4 leases; and free, expired, and released DHCPv6 leases results in
unnecessary growth of database objects. The DHCP lease scavenging feature enables member DHCP servers to
automatically delete free and backup IPv4 leases; and free, expired, and released IPv6 leases that remain in the
database beyond the specified period of time, thus reducing the number of database objects.
When you enable this feature for DHCPv4 leases, the appliance permanently deletes the free and backup IPv4 leases,
and you can no longer view or retrieve the lease information. This option can be enabled globally at the Grid level,
and more specifically for a member, shared network, network, network container, DHCP range, network template,
DHCP range template.
When you enable this feature for DHCPv6 leases, the appliance permanently deletes the free, expired, and released
IPv6 leases, and you can no longer view or retrieve the lease information. This option can be enabled at the Grid level,
and overridden at the member level.
The period of time that you specify is the duration after the expiration date of a lease, not its release date. For
example, you specify a time period of 5 days when you enable this feature. If the lease time of an IP address is 10
days, but the lease is released after five days, the appliance still deletes the lease from the database after 15 days
because the IP address has been leased.

Note: If you plan to enable this feature after upgrading from a previous NIOS version, Infoblox recommends that you
enable it during off-peak hours, as it may impact DHCP services.

To enable scavenging of IPv4 and IPv6 leases:

1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon. This is applicable for IPv4 lease scavenging only.
Network Container: From the Data Management tab, select the IPAM tab -> network_container check box, and
then click the Edit icon. This is applicable for IPv4 lease scavenging only.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1095

Configuring DHCP Properties

DHCP Range: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
addr_range check box, and then click the Edit icon. This is applicable for IPv4 lease scavenging only.
2. In the editor, click Toggle Advanced Mode if the editor is in basic mode, and then click the General tab ->
Advanced tab.
In the Network editor for IPv4 lease scavenging, click Toggle Advanced Mode if the editor is in basic mode, and
then click IPv4 DHCP Options -> Advanced.
Complete the following:
— IPv4 Properties
— Lease Scavenging: This is disabled by default. Select the Scavenge free and backup leases after check
box and specify the number of days or weeks that free and backup IPv4 leases remain in the database
before they are automatically deleted. This can be set for the Grid, member, network, and network
container.
— IPv6 Properties
— Lease Scavenging: This is disabled by default. Select the Scavenge free, expired and released leases
after check box and specify the number of hours, days, or weeks that free, expired, and released IPv6
leases remain in the database before they are automatically deleted. The minimum is 6 hours and the
maximum is 180 days. The default is one week. This can be set at the Grid and member level.
3. Save the configuration.

Configuring DHCP Logging

If you have a syslog server operating on your network, you can specify in which facility you want the server to display
the DHCP logging messages. You can also select the Grid member on which you want to store the DHCP lease history
log, as described in the next section Configuring the Lease Logging Member. You can configure DHCP and lease
logging only on the Grid and member levels.
To specify DHCP logging for the Grid or member:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
2. In the DHCP Properties editor, select the Logging Basic tab and complete the following:
— Syslog Facility: From the drop-down list, select the facility that is used to tag syslog messages from the
DHCP server. This facility can be used to filter messages on a central syslog server.
3. Save the configuration and click Restart if it appears at the top of the screen.

Configuring the Lease Logging Member

Logging DHCP lease events makes significant CPU demands, especially when there is heavy DHCP activity. Therefore,
Infoblox strongly recommends that you designate a Grid member other than the master as a logging member
whenever possible. Another way to manage the increased load that logging introduces is to log selectively per Grid
member. For example, you might want to log DHCP leases for members serving critical parts of your network and not
keep historical logs for members serving other parts.

1096 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DHCP Logging

Figure 26.4 DHCP Lease History Logging with Member Overrides

Grid
You can enable DHCP lease logging at the Grid level, and then
disable it for selected members. In this Grid, four members send
DHCP lease events to the master, which forwards them to a
designated logging member. Two Grid members do not log
DHCP lease events.

Grid Members Grid Master Lease Logging

Disabled

Lease Logging
Disabled

Logging Member

To specify lease logging for a member:

1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
2. In the Logging tab, complete the following:
— Lease Logging: Select Enable Lease History (for Grid) or Log Lease Events from DHCP Server (for member) to
enable DHCP lease logging. To disable DHCP lease logging, clear the check box. You can set member
overrides if you want to enable or disable lease logging per member.
— Send leases to: For Grid only. Click Select. In the Select Member dialog box, select the Grid member on
which you want to store the DHCP lease history log. Infoblox recommends that you dedicate a member
other than the Grid Master as a logging member. If possible, use this member solely for storing the DHCP
lease history log. If you do not select a member, no logging can occur. You can click Clear to remove the
selected Grid member and select a new one.
3. Save the configuration and click Restart if it appears at the top of the screen.

Note: You cannot configure vNIOS Grid members on Riverbed as DHCP lease history logging members.

4. For information about viewing current leases, see Viewing Current Leases on page 1244

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1097

Configuring DHCP Properties

About IF-MAP
You can configure Infoblox DHCP servers to publish DHCP data to an IF-MAP server. The IF-MAP server takes real-time
information from different sources and stores it in a shared database from which clients can retrieve information
about network devices, their status and activities. For details about the IF-MAP protocol, refer to
http://www.trustedcomputinggroup.org. For information about the Infoblox IF-MAP server, refer to the Infoblox
Administrator Guide for Infoblox Orchestration Server.
Each Infoblox DHCP server in a Grid can function as an IF-MAP client, with the ability to publish lease information to
an IF-MAP server. For information about how to configure an IF-MAP client, see Configuring Members as IF-MAP Clients
on page 1099. You can configure the client to publish ip-mac and ip-duid (for DHCPv6 leases) metadata at the Grid
and member levels. You can also configure the client to publish metadata for specific leases by overriding the Grid or
member publishing settings at the network (IPv4 and IPv6) or range (IPv4 only) level. The DHCP server sends updates
to the IF-MAP server using the XML format and SOAP/HTTPS bindings specified in IF-MAP v1.1r5 and v2.0r26. The
DHCP server supports the IF-MAP 2.0 protocol by default. You can also enable the support for IF-MAP 1.1, as
described in Configuring a Grid to Support IF-MAP.
When the DHCP server grants an IPv4 lease and sends the DHCPACK packet to the DHCP client, it updates the link in
the IF-MAP server between the leased IP address and client MAC address with ip-mac metadata with the following
attributes: start-time, end-time, and dhcp-server. The dhcp-server attribute contains the DHCP server hostname. The
ip-mac metadata is attached to a link with:
• An ip-address identifier with the type attribute set to IPv4, a value attribute that contains the leased IP address,
and the administrative-domain attribute set to the network view to which the IP address belongs.
• A mac-address identifier with a value attribute that contains the client MAC address. It does not have the
administrative-domain attribute.
When the DHCP server grants an IPv6 lease and sends the Reply message to the DHCP client, it updates the link in
the IF-MAP server between the leased IP address and client DHCP Unique Identifier (DUID) with ip-duid metadata that
contains the following attributes: start-time, end-time, and dhcp-server. The dhcp-server attribute contains the DHCP
server hostname. The ip-duid metadata is attached to a link with:
• An ip-address identifier with the type attribute set to IPv6, a value attribute that contains the leased IP address,
and the administrative-domain attribute set to the network view to which the IP address belongs.
• A duid identifier with a value attribute that contains the client DUID. It does not have the administrative-domain
attribute.
The Infoblox DHCP server also publishes data when an IPv4 or IPv6 lease changes. When a lease is released or when
an active lease expires, the DHCP server sends a “publish delete” request to the IF-MAP server.
You can define how the IF-MAP server handles the existing ip-mac and ip-duid information before the DHCP client
sends the next update. For example, you can specify the IF-MAP server to always delete existing ip-mac and ip-duid
information before the next update. For information, see Deleting Existing Data Before Publishing on page 1102.
Following are the tasks to enable DHCP servers in a Grid to function as IF-MAP clients:
1. Enable IF-MAP in the Grid and specify the URL and port of the IF-MAP server, as described in Configuring a Grid
to Support IF-MAP on page 1099.
2. Optionally, enable the validation of the IF-MAP server certificate and import the CA certificate, as described in
Validating the IF-MAP Server Certificate on page 1099.
3. Enable IF-MAP on each Grid member and specify an authentication method the member uses to connect to the
IF-MAP server, as described in Configuring Members as IF-MAP Clients on page 1099.
4. Optionally, override publishing settings at the member, network, or range level, as described in Overriding
IF-MAP Publishing Settings on page 1102.
You can also delete DHCP data published by a specific member, or define how the IF-MAP server deletes existing
DHCP data before a client publishes an update. For information, see Deleting Data from the IF-MAP Server on page
1102.

1098 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IF-MAP

Configuring a Grid to Support IF-MAP

1. From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
2. In the Grid DHCP Properties editor, click Toggle Advanced Mode.
3. Click the IF-MAP tab, and then complete the following:
— Enable IF-MAP: Select this check box to enable the IF-MAP service for the Grid. Note that you must enable
the IF-MAP service in order to enable or disable publishing at the Grid, member, network, or range level.
— IF-MAP Server URL: Enter the URL of the IF-MAP server to which the Grid members publish DHCP data. The
URL must begin with https://. For example, https://<server_ip_addr>/ifmap.
— IF-MAP Server Port: The default HTTP port is 80 and the default HTTPS port is 443. Optionally, you can
specify a different port on the IF-MAP server.
— Enable IF-MAP publishing: Select this check box to enable IF-MAP publishing for the Grid. When you select
this, IF-MAP publishing is enabled for all members, networks (IPv4 and IPv6), and DHCP ranges (IPv4 only).
You can override the Grid property at a specific level to control the ip-mac and ip-duid metadata you want
the client to publish for specific leases. For information, see Overriding IF-MAP Publishing Settings on page
1102.
— IF-MAP Protocol Version: Select the IF-MAP protocol version you want the IF-MAP client to use to connect to
the IF-MAP server. The default is IF-MAP 2.0.
4. Save the configuration and click Restart if it appears at the top of the screen.
5. You can also configure how the IF-MAP server deletes existing metadata before the IF-MAP client publishes
another update. For information, see Deleting Data from the IF-MAP Server on page 1102.

Validating the IF-MAP Server Certificate

You can configure the IF-MAP client to validate the IF-MAP server certificate before the client establishes a connection
or performs IF-MAP transactions. To validate an IF-MAP server certificate, you must first import the certificate of the
CA that signs the IF-MAP server certificate.
To configure the IF-MAP client to validate the IF-MAP server certificate:
1. From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
2. In the Grid DHCP Properties editor, click Toggle Advanced Mode.
3. Click the IF-MAP tab and complete the following:
— Enable IF-MAP: Select this check box to enable the IF-MAP service for the Grid.
— Enable IF-MAP server certificate validation: Select this check box to enable the validation of the IF-MAP
server certificate, and then click Import to import the CA certificate. In the Upload dialog box, click Select to
navigate to the certificate, and then click Upload. You can also copy and paste the CA certificate here.
4. Save the configuration and click Restart if it appears at the top of the screen.

Configuring Members as IF-MAP Clients

To configure a member to be an IF-MAP client, you must first enable IF-MAP on the member and then configure a client
authentication method. The IF-MAP client can authenticate itself to the IF-MAP server through user name and
password credentials or digital certificate. Note that each member must have unique credentials or certificates. You
cannot use the same credentials or certificates on multiple members. The appliance supports only one CA-signed
certificate on each member. If you want to use a roll-over certificate, you must replace the existing certificate and
restart services on the member.
To enable an appliance to function as an IF-MAP client:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box, and then click the Edit
icon.
2. In the Member DHCP Properties dialog box, click Toggle Advanced Mode.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1099

Configuring DHCP Properties

3. Click the IF-MAP tab and complete the following:

— Enable IF-MAP: Select this check box to enable the IF-MAP service on the member. Note that you must
enable the IF-MAP service in order to enable or disable publishing at the network and range levels.
— Authentication: Select one of the following authentication methods:
— Certificate: Select this to use the IF-MAP client certificate for client authentication. You must already
have a certificate configured for the member before you can select and save this configuration. For
information about creating a client certificate, see Creating IF-MAP Client Certificates on page 1100.
— Basic: Select this to use username and password credentials for IF-MAP client authentication.
Complete the following:
• Username: Enter the username the member uses to connect to the IF-MAP server. This username
must have been configured as a valid username on the IF-MAP server. Each member must have its
own username.
• Password: Enter the password the member uses to connect to the IF-MAP server.
• Confirm Password: Enter the password again.

Note: When you upgrade to a new NIOS release, the basic authentication credentials are retained if IF-MAP was
enabled and basic authentication was used before the upgrade.

— Enable IF-MAP publishing: Click Override to override the Grid setting. Select this check box to enable
IF-MAP publishing for all the networks that are served by this member. Ensure that you enable IF-MAP
at either the Grid or member level in order to enable IF-MAP publishing for all networks.
4. Save the configuration and click Restart if it appears at the top of the screen.

Creating IF-MAP Client Certificates

Before you can select “Certificate” as the client authentication method, you must first create a certificate for the
specified member.
You can do one of the following to generate an IF-MAP client certificate:
• Generate a self-signed certificate and save it. For information, see Generating Self-Signed Certificates.
• Request a CA (Certificate Authority) signed certificate. When you receive the certificate from the CA, upload it to
the member that you configure as an IF-MAP client. For information, see Generating Certificate Signing Requests
on page 1101.

Generating Self-Signed Certificates

You can replace the default certificate with a self-signed certificate that you generate. When you generate a
self-signed certificate, you can specify the correct hostname and change the public/private key size, enter valid dates
and specify additional information specific to the member. If you have multiple members, you can generate a
certificate for each appliance with the appropriate hostname.
To generate a self-signed certificate:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box, and then click IF-MAP
Client Certificate -> Generate Self-signed Certificate from the Toolbar.
2. In the Generate Self-Signed Certificate dialog box, complete the following:
— Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256
(SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
— Days Valid: Specify the validity period of the certificate.
— Common Name: Specify the domain name of the member. You can enter the FQDN (fully qualified domain
name) of the appliance.
— Organization: Enter the name of your company.
— Organizational Unit: Enter the name of your department.
— Locality: Enter a location, such as the city or town of your company.

1100 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IF-MAP

— State or Province: Enter the state or province.

— Country Code: Enter the two-letter code that identifies the country, such as US.
— Admin E-mail Address: Enter the email address of the appliance administrator.
— Comment: Enter information about the certificate.
3. Click OK.
4. If the appliance already has an existing client certificate, the new certificate replaces the existing one. In the
Replace IF-MAP Certificate Confirmation dialog box, click Yes.

Generating Certificate Signing Requests

You can generate a CSR (certificate signing request) that you use to obtain a signed certificate from your own trusted
CA. Once you receive the signed certificate, you can import it to the member, as described in Uploading Certificates.
To generate a CSR:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box, and then click IF-MAP
Client Certificate -> Create Signing Request from the Toolbar.
2. In the Create Certificate Signing Request dialog box, enter the following:
— Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256
(SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
— Common Name: Specify the domain name of the member. You can enter the FQDN of the appliance.
— Organization: Enter the name of your company.
— Organizational Unit: Enter the name of your department.
— Locality: Enter a location, such as the city or town of your company.
— State or Province: Enter the state or province.
— Country Code: Enter the two-letter code that identifies the country, such as US.
— Admin E-mail Address: Enter the email address of the appliance administrator.
— Comment: Enter information about the certificate.
3. Click OK.

Uploading Certificates
When you receive the certificate from the CA, the appliance finds the matching CSR and takes the private key
associated with the CSR and associates it with the newly imported certificate. The appliance then automatically
deletes the CSR.
To import a certificate:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box, and then click IF-MAP
Client Certificate -> Upload Certificate from the Toolbar.
2. Navigate to where the certificate is located and click Open.
3. If the appliance already has an existing IF-MAP client certificate, the new certificate replaces the existing one. In
the Replace IF-MAP Certificate Confirmation dialog box, click Yes.

Downloading Certificates
You can download the current certificate or a self-signed certificate.
To download a certificate:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box, and then click IF-MAP
Client Certificate -> Download Certificate from the Toolbar.
2. Navigate to where you want to save the certificate, enter the file name, and then click Save.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1101

Configuring DHCP Properties

Overriding IF-MAP Publishing Settings

When you enable IF-MAP publishing at the Grid level, all members, networks (IPv4 and IPv6), and DHCP ranges (IPv4
only) in the Grid inherit the same setting. To control which ip-mac and ip-duid metadata is published for specific
leases that belong to a specific network or address range, you can override the Grid settings at a specific member,
network, or range level. Note that you must first enable the IF-MAP service at the Grid and member levels in order to
enable or disable IF-MAP publishing at other levels. For example, if you want the DHCP server to publish IF-MAP data
for specific leases in a specific network that is served by a specific member, you must first enable the IF-MAP service
at the Grid and member levels, as described in Configuring a Grid to Support IF-MAP on page 1099. Then, you can
enable IF-MAP publishing at the range level, as described in this section.
Though you can configure and save the settings of IF-MAP publishing any time at any level, the publishing does not
actually happen unless the IF-MAP service is enabled at the Grid or member level. If a network or DHCP range is served
by a specific member and you want to enable IF-MAP publishing for the network or range, you must first enable the
IF-MAP service for the specified member.
To override IF-MAP publishing settings:
1. Member: From the Data Management tab, select the DHCP tab -> Members tab -> member check box, and then
click the Edit icon.
Network: From the Data Management tab, select the DHCP tab -> Networks tab -> network check box, and then
click the Edit icon.
DHCP Range: From the Data Management tab, select the DHCP tab -> Networks tab -> network -> addr_range
check box, and then click the Edit icon.
2. In the editor, click Toggle Advanced Mode, and then click the IF-MAP tab.
3. Click Override and complete the following:
— Enable IF-MAP Publishing: Select this check box to instruct the DHCP server to publish metadata to the
IF-MAP server when the IF-MAP service is enabled for the Grid or member. Clear this check box so the DHCP
server does not publish metadata to the server.

Deleting Data from the IF-MAP Server

The appliance allows you to delete IF-MAP data from the IF-MAP server. You can delete all IF-MAP data published by
a specific member. You can also define how the IF-MAP server handles the deletion of existing metadata before the
IF-MAP client publishes another update.

Deleting all data

You can delete all IF-MAP data published by a specified member. To delete data published by all members in a Grid,
you must delete data for each member individually.
To delete IF-MAP data published by a member from the IF-MAP database:
1. From the Data Management tab, select the DHCP tab -> Members tab, and then click Clear -> IF-MAP Data from the
Toolbar.
2. In the Purge IF-MAP Data dialog box, click Select Member to select a member. If there are multiple members, Grid
Manager displays the Member Selector dialog box from which you can select one. Click the member name in the
dialog box, and then click Purge to delete all the DHCP data published by the Grid member. You can also click
Clear to clear the displayed member and select a new one.

Deleting Existing Data Before Publishing

You can define how the IF-MAP server deletes existing metadata before an IF-MAP client publishes new data. You can
configure the IF-MAP client to instruct the server to always delete existing data, never delete it, or delete the data
before a specified time period.
To define how the IF-MAP server deletes DHCP data before the next publish:
1. From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.

1102 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Starting DHCP Services on a Member

2. In the Grid DHCP Properties editor, click Toggle Advanced Mode.

3. Click the IF-MAP tab and complete the following:
— Enable IF-MAP: Select this check box to enable the IF-MAP service.
— Delete existing metadata: You can define how the IF-MAP server deletes the existing metadata before the
IF-MAP client publishes new data. Select one of the following:
— Always delete: Select this to always delete existing metadata before the IF-MAP client publishes
updates. This is the default.
— Do not delete: Select this to never delete the existing metadata before the IF-MAP client publishes
updates.
— Earlier than: Select this to delete metadata that was published before a given time before the IF-MAP
client publishes updates. When you select this option, enter a time value, and then select a time unit
from the drop-down list.
4. Save the configuration and click Restart if it appears if it appears at the top of the screen.

Starting DHCP Services on a Member

The DHCP service is disabled by default. After you complete the DHCP configuration, you can start DHCP service on a
member. To enable the member to provide DHCPv6 service as well, you must start the DHCP service and then enable
the DHCPv6 service on the member. In addition, you must specify the DHCP Unique Identifier (DUID) of the member.
IPv6 clients use DUIDs to identify the source of the DHCP messages from servers.
To start DHCP service on a member:
1. From the Data Management tab, select the DHCP tab -> Members tab -> -> Members -> member check box.
2. Expand the Toolbar and click Start.
3. In the Start Member DHCP Service dialog box, click Yes.
4. Grid Manager starts DHCP on the selected member.
You can stop DHCP service on a member by selecting the member check box and click Stop from the Toolbar. This will
stop DHCP service enabled on the LAN port.
To stop DHCP service enabled on the LAN2 port:
1. From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box.
2. Click the Edit icon.
3. In the Member DHCP Properties editor, select the General Basic tab.
4. Clear the check box for LAN2 under DHCP interfaces.
5. Save the configuration.
To enable DHCPv6 service on the member:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box.
2. In the Member DHCP Properties editor, select the General Basic tab.
3. In the IPv6 Properties section, do the following:
— Server DUID: Enter the DUID of the member.
— Enable DHCPv6 Service: Select this check box.
4. Save the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1103

Configuring DHCP Properties

Viewing DHCP Member Status

You can view DHCP member status after you configure DHCP properties and start or stop DHCP services on a member.
To view member status:
1. From the Data Management tab, select the DHCP tab -> Members tab -> Members section.
2. Grid Manager displays the following information:
— Name: The name of the Grid member.
— Status: The status of the DHCP services on the member. This can be one of the following:
— Not Running: DHCP services have not been started on the member.
— Running: The DHCP services are running properly on the member.
— Warning: The member is connecting or synchronizing with its Grid Master.
— Error: The member is offline, is not licensed (that is, it does not have a DNSone license with the Grid
upgrade that permits Grid membership), is upgrading or downgrading, or is shutting down.

Note: You can mouse over on the informational icon next to the status to view detailed information.

— Comment: The information you entered for the member.

— IPv4 DHCP Utilization: The percentage of the total IPv4 DHCP utilization of the member. This is the
percentage of the total number of DHCP hosts, fixed addresses, reservations, and leases assigned to the
member versus the total number of IP addresses (excluding IP addresses in the exclusion range) and all
DHCP objects assigned to the member. Note that only enabled objects are included in the calculation. It
does not include abandoned addresses or leases. The appliance updates the utilization data every 15
minutes. The appliance displays the utilization data in one of the following colors:
— Red: The DHCP resources are 100% utilized.
— Yellow: The utilization percentage is over the effective high watermark threshold.
— Blue: The utilization percentage is below the effective low watermark threshold.
— Black: The utilization percentage is at any number other than 100%, or within the effective thresholds.
— Site: The site to which the member belongs. This is one of the predefined extensible attributes.
You can select the following additional columns for display:
— Address: The IP address of the member.
— Static Addresses: The number of static IP addresses.
— Dynamic Addresses: The number of dynamically assigned IP addresses.
— IF-MAP Connection: The status of the IF-MAP service connection on the member. This can be one of the
following.
— Stopped: The DHCP or IF-MAP service on the member is stopped, or the IF-MAP service is not enabled.
— Running: The IF-MAP client is connected to the IF-MAP server and the IF-MAP service is running
properly.
— Failed: The IF-MAP client cannot publish data to the IF-MAP server due to some errors.
— Warning: Some non-fatal errors occurred. The IF-MAP client attempts to reconnect to the server.

Note: You can mouse over on the informational icon next to the status to view detailed information, including
the status description and the timestamp when the status initially changed.

— IF-MAP Last Update: The timestamp the status of the IF-MAP service was last updated. For example, if the
IF-MAP connection status is Running and this field shows 2011-11-20 12:30:42 EST, it means that an
IF-MAP operation, such as a publish, was last completed on November 20, 2011 at 12:30:42 Eastern
Standard Time.

1104 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing DHCP Member Status

To view status information about the IF-MAP connection on an independent appliance, from the Data Management
tab -> DHCP tab, click System DHCP Properties from the toolbar. The appliance displays the following:
• IF-MAP Connection: The status of the IF-MAP service on the independent appliance. A color icon associated with
the connection status appears before the status.
• IF-MAP Connection Information: Detailed information about the status. On a Grid member, this information
appears when you mouse over on the informational icon.
• IF-MAP Last Update: The timestamp when the status of the IF-MAP service last changed.

Note: For more information about these fields, see descriptions about Grid member status in this section.

You can view detailed information about a specific member by clicking the member link. Grid Manager displays the
following information about the selected member:
• Network: The network assigned to the member.
• Comment: The information about the network.
• IPv4 DHCP Utilization: The percentage of the DHCP usage of the network. This is the percentage of the total
number of fixed addresses, reservations, hosts, and active leases on the network over the total IP addresses in
the range, excluding the number of addresses on the network. Note that only enabled objects are included in
the calculation. It does not include abandoned addresses or leases.
• Site: The site to which the DHCP object belongs. This is one of the predefined extensible attributes.
In the member panel, you can select the following additional fields for display:
• Disabled: Indicates whether the member is disabled or not.
• IPAM Utilization: When you define a network, this is the percentage based on the IP addresses in use divided by
the total addresses in the network. For example, in a /24 network, if there are 25 static IP addresses defined
and a DHCP range that includes 100 addresses, the total number of IP addresses in use is 125. Of the possible
256 addresses in the network, the IPAM utilization is about 50% for this network.
When you define a network container that contains subnets, this is the percentage of the total address space
defined within the container regardless of whether any of the IP addresses in the subnets are in use. For
example, when you define a /16 network and then 64 /24 networks underneath it, the /16 network container is
considered 25% utilized even when none of the IP addresses in the /24 networks is in use.
You can use this information to verify if there is a sufficient number of available addresses in a network. The
IPAM utilization is calculated approximately every 15 minutes.
• Extensible attributes that associate with the network.
You can also sort the data in ascending or descending order by column. For information, see Customizing Tables on
page 69.

Viewing DHCP Configuration Files

You can view the IPv4 and IPv6 DHCP configuration of a selected member. The format of the configuration file
depends on the browser you use.
To view the DHCP configuration of a selected member:
1. From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box.
2. Expand the Toolbar, select View DHCP Configuration, and then select either IPv4 or IPv6. Grid Manager displays
the IPv4 or IPv6 DHCP configuration of the selected member in a new browser. You can print and save the file
using the corresponding functions in your browser.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1105

Configuring DHCP Properties

1106 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 27 Managing IPv4 DHCP Data
This chapter explains how to configure and manage IPv4 DHCP data. It contains the following sections:
• Configuring DHCP for IPv4 on page 1109
• About the Next Available Network or IP Address on page 1109
• Configuring IPv4 Networks on page 1111
— Adding IPv4 Networks on page 1111
— Viewing Networks on page 1115
— Modifying IPv4 Networks on page 1118
— Deleting IPv4 Networks on page 1119
• Configuring IPv4 Shared Networks on page 1119
— Adding IPv4 Shared Networks on page 1119
— Viewing Shared Networks on page 1120
— Modifying IPv4 Shared Networks on page 1120
— Deleting IPv4 Shared Networks on page 1121
• Configuring IPv4 Address Ranges on page 1121
— Adding IPv4 Address Ranges on page 1122
— Modifying IPv4 Address Ranges on page 1123
— Controlling Lease Assignments on page 1124
— Deleting IPv4 Address Ranges on page 1125
• Configuring IPv4 Fixed Addresses on page 1125
— Adding IPv4 Fixed Addresses on page 1126
— Modifying IPv4 Fixed Addresses on page 1129
— Deleting Fixed Addresses on page 1130
• Configuring IPv4 Reservations on page 1131
— Adding IPv4 Reservations on page 1131
— Modifying IPv4 Reservations on page 1134
• Viewing IPv4 DHCP Objects on page 1135
• About Roaming Hosts on page 1136
— Configuring Roaming Hosts on page 1136
— Enabling Support for Roaming Hosts on page 1136
— Adding IPv4 Roaming Hosts on page 1137
— Adding IPv6 Roaming Hosts on page 1137
— Adding IPv4/IPv6 Roaming Hosts on page 1138

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1107

Managing IPv4 DHCP Data

— Viewing Roaming Hosts on page 1139

— Setting Properties for Roaming Hosts on page 1139
— Deleting Roaming Hosts on page 1140

1108 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DHCP for IPv4

Configuring DHCP for IPv4

To configure DHCP service for an IPv4 network and the resources in the network, perform the following tasks:
1. Create a network and assign it to Grid members or Microsoft DHCP servers, or an interface on an external
discovered device. For information, see Adding IPv4 Networks and Modifying IPv4 Networks on page 1118.
2. Configure DHCP properties for the network. You can override properties set at the Grid or member level and enter
unique values for the network. For information, see Configuring General IPv4 DHCP Properties on page 1071 and
Configuring DHCP IPv4 and IPv6 Common Properties on page 1092.
3. Optionally, assign zones to a network. For information, see Associating Networks with Zones on page 1093.
4. Add a DHCP range to the network and assign it to a member, a failover association, or a Microsoft DHCP server.
For information, see Adding IPv4 Address Ranges on page 1122 and Modifying IPv4 Address Ranges on page
1123.
5. Optionally, add exclusions to the DHCP range for addresses that are not used for dynamic allocation. For
information, see Configuring IPv4 Fixed Addresses on page 1125.
6. Optionally, configure DHCP properties for the address range. You can override properties set at an upper level
and enter unique values for the address range. For information, see Modifying IPv4 Address Ranges on page
1123.
7. Optionally, define filters for precise address assignments and apply them to the DHCP range. For information, see
About IPv4 DHCP Filters on page 1188.
8. Optionally, add fixed addresses and reservations to the network and configure DHCP properties for them. For
information, see Configuring IPv4 Fixed Addresses on page 1125 and Configuring IPv4 Reservations on page
1131.

About the Next Available Network or IP Address

When you create certain objects through Grid Manager, the appliance can obtain the next available IPv4 or IPv6
network from a specific network container. It can also obtain the next available IP address from a specific network or
address range. This feature automates the allocation of networks and IP addresses so you can manage your network
space more efficiently. You can also use this feature to organize network devices. For example, you can create a
reserved range called “Printer Range” to reserve static IP addresses for printers in your network. When you allocate
IP addresses for printers, you can have the appliance search for the next available IP address within “Printer Range,”
and then allocate the next available address to a new printer.
When you create a new network, the appliance can look up the next available network address within a specific
network container. The next available network address is the first unused network address in the network container
to which you have administrative permissions. For information about creating IPv4 and IPv6 networks using the next
available feature, see Adding IPv4 Networks on page 1111 and Adding IPv6 Networks on page 1161.
You can also obtain the next available IP address when you define a fixed address, reservation, or host record. The
next available IP address is the first unused IP address in a specified network, DHCP range, or reserved range to which
you have administrative permissions. For information about creating fixed addresses, reservations, and host records
using the next available feature, see Configuring IPv4 Fixed Addresses on page 1125, Configuring IPv4 Reservations
on page 1131, and Adding Host Records on page 579.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1109

Managing IPv4 DHCP Data

Obtaining the Next Available

The appliance searches for the next available network or IP address based on the context you define when you create
an object. For example, when you create a network within a specific network container, the appliance searches for
the next available network within the specified container. Similarly, when you drill down to an address range and
create an object from there, the appliance looks up the next available IP address within that address range. If you are
not within a specific network or address range when you create an object, Grid Manager displays a selector from
which you can select the network or address range for the next available network or IP address.
For information about how the appliance select the next available network and IP address, see Guidelines for the Next
Available Network and IP Address.

Guidelines for the Next Available Network and IP Address

The appliance follows certain rules when searching for the next available network and IP address in the specified
wizard, network container, and address range.
In a wizard where you can obtain the next available network or IP address, the following applies:
• In a wizard, if you add a network or IP address and then delete it, the appliance excludes it from the next
available. When you try to obtain the next available network or IP address in the same wizard, the appliance
does not return the deleted network or IP address until you exit the wizard.
In a network, the appliance searches for the next IP address that meets all of the following criteria:
• It does not match any DNS resource record, such as an A or PTR record, that is associated with an IP address.
• It is not assigned to a DHCP fixed address or host address record.
• It is not part of any DNS bulk host record.
• It does not match any unmanaged IP address.
• It is not the network (the first) or broadcast (the last) address in the specified network.
• It is not within any DHCP range in this network.
• It is not within any reserved range in this network.
• It is not within an exclusion range.
• It is not part of a scheduled task that involves a fixed address. For information about how to schedule a task,
see Scheduling Tasks on page 85.
In a DHCP range, the appliance searches for the next IP address that meets all of the following criteria:
• It is not assigned to a fixed address or host record.
• It does not match any unmanaged IP address.
• It is not part of an exclusion range within the DHCP range.
• It is not part of a scheduled task that involves a fixed address.
• It does not match any active DHCP lease.
In a reserved range, the appliance searches for the next IP address that meets all of the following criteria:
• It is not assigned to a fixed address or host record.
• It does not match any unmanaged IP address.
• It is not part of a scheduled task that involves a fixed address.

Note: The appliance does not search for deleted leases in the Recycle Bin.

When multiple users simultaneously request for the next available network or IP address, the appliance returns the
same unused network or IP address to all users. The user who first saves the task gets the next available network or
IP address. In some cases, other users get an error message telling them that the network or IP address is not
available when they save their tasks. They can then request another unused network or IP address or enter a new one.

1110 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Networks

Configuring IPv4 Networks

When you create an IPv4 network, you can do so from scratch or from a network template that contains predefined
properties. When you use a template to create a network, the properties of the template apply to the new network.
For information about network templates, see About IPv4 Network Templates on page 1146. You can also create an
IPv4 network from the Tasks Dashboard, as described in The Tasks Dashboard on page 119.
After you create IPv4 networks, you can combine them into shared networks or create ranges and fixed addresses.

Adding IPv4 Networks

When you configure an IPv4 network, you must assign either Grid members or Microsoft servers to the network. A
network cannot be served by a mix of Microsoft and Infoblox DHCP servers. Multiple servers can serve a network, but
Grid members and Microsoft servers cannot serve the same network.
A Grid member can serve only one network view. Similarly, a Microsoft server can serve only one network view.
Therefore when you assign Grid members to networks, you must assign the members to networks in the same
network view. For information, see Configuring DHCP for IPv4 on page 1109.
If you have enabled support for RIR (Regional Internet Registry) updates and are adding an RIR IPv4 network container
or network to NIOS, Grid Manager displays an RIR section in the Add IPv4 Network wizard. You must enter RIR related
information in this section in order for NIOS to associate the newly added network with an RIR organization. For more
information about RIR address allocation and updates, see RIR Registration Updates on page 555.
To add an IPv4 network:
1. From the Data Management tab, select the DHCP tab -> Networks tab.
2. In the Networks section, select IPv4 Network from the Add drop-down menu.
3. In the Add Network wizard, select one of the following and click Next:
— Add Network: Click this to add a network from scratch.
— Add Network using Template: To use a template, click this, and then click Select Template and select a
network template. For information, see About IPv4 Range Templates on page 1142. The appliance
populates the template properties in the wizard when you click Next. You can then edit the pre-populated
properties, except for Netmask.
4. Complete the following and click Next:
— Regional Internet Registry: This section appears only when support for RIR updates is enabled. For
information about RIR, see RIR Registration Updates on page 555. Complete the following to create an RIR
IPv4 network container or network:
— Internet Registry: Select the RIR from the drop-down list. The default is RIPE. When you select None, the
network is not associated with an RIR organization.
— Organization ID: Click Select Organization and select an organization from the RIR Organization
Selector dialog box.
— Registration Status: The default is Not Registered. When adding an RIR allocated network, you can
change this to Registered and select the Do not update registrations check box below. Note that when
you select API as the communication method, the registration status will be updated automatically
after the registration update is completed. However, when you select Email as the communication
method, the registration status will not be automatically updated. If you are creating a new network
and the registration update is completed successfully, the status will be changed to Registered. If the
update fails, the status will be changed to Not Registered. The updated status and timestamp are
displayed in the Status of last update field in the IPv4 Network Container or IPv4 Network editor.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1111

Managing IPv4 DHCP Data

— Registration Action: Select the registration action from the drop-down list. When you select Create, the
appliance creates the IPv4 network and assigns it to the selected organization. When you select None,
the appliance does not send registration updates to RIPE. When you are adding an existing RIR
allocated network to NIOS, select None. When you are adding networks to an RIR allocated network (a
parent network), select Create. Ensure that the parent network associated with an RIR organization
already exists.
— Do not update registrations: Select this check box if you do not want the appliance to submit RIR
updates to RIPE. By default, the appliance sends updates to the RIR database based on the configured
communication method.
— Network View: This appears only when you have multiple network views. From the drop-down list, select the
network view in which you want to create the network.
— Netmask: Enter the netmask or use the netmask slider to select the appropriate number of subnet mask
bits for the network. The appliance supports /1 to /32 netmasks. Note that when you use a template that
contains a fixed netmask, you cannot adjust the netmask for this network.
Microsoft servers can serve networks with /1 to /31 netmasks. Infoblox DHCP servers can serve networks
with /8 to /32 netmasks.
Since Infoblox DHCP servers do not support /1 to /7 networks, you can assign these networks to Microsoft
DHCP servers only. You can create DHCP ranges and fixed addresses within these subnets.
— Networks: Do one of the following to add new networks:
Click the Add icon to enter a new network. Grid Manager adds a row to the table. Enter the network address
in the Network field. Click the Add icon again to add another network.
or
Click the Next Available icon to have the appliance search for the next available network. Complete the
following in the Next Available Networks section:
— Create new network(s) under: Enter the network container in which you want to create the new network.
When you enter a network that does not exist, the appliance adds it as a network container. When you
enter a network that is part of a parent network, the parent network is converted into a network
container if it does not have a member assignment or does not contain address ranges, fixed
addresses, reservations, shared networks, and host records that are served by DHCP. When you enter a
network that has a lower CIDR than an existing network, the appliance creates the network as a parent
network and displays a message indicating that the newly created network overlaps an existing
network. You can also click Select Network to select a specific network in the Network Selector dialog
box. For information about how the appliance searches for the next available network, see Obtaining
the Next Available on page 1110.
— Number of new networks: Enter the number of networks you want to add to the selected network
container. Note that if there is not enough network space in the selected network to create the number
of networks specified here, Grid Manager displays an error message. The maximum number is 20 at a
time. Note that when you have existing networks in the table and you select one, the number you enter
here includes the selected network.
— Click Add Next to add the networks. Grid Manager lists the networks in the table. You can click Cancel to
reset the values.

Note: You must click Add Next to add the network container you enter in the Next Available Networks section. If
you enter a network in the Next Available Networks section and then use the Add icon to add another
network, the appliance does not save the network you enter in the Next Available Networks section until
you click Add Next.

— Comment: Enter useful information about the network, such as the name of the organization it serves.
— Automatically Create Reverse-Mapping Zone: This function is enabled if the netmask of the network equals
/8, /16, or /24. Select this to have the appliance automatically create reverse-mapping zones for the
network. A reverse-mapping zone is an area of network space for which one or more name servers have the
responsibility for responding to address-to-name queries. These zones are created in the DNS view
assigned to receive dynamic DNS updates at the network view level.

1112 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Networks

— Disable for DHCP: Select this if you do not want the DHCP server to provide DHCP services for this network
at this time. This feature is useful when you are in the process of setting up the DHCP server. Clear this after
you have configured the server and are ready to have it serve DHCP for this network.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. To delegate authority for this network,
complete the following:
Delegate authority from the Grid Master
— Delegate To: This field indicates whether the authority for the network you want to create has already been
delegated to a Cloud Platform Appliance. Click Select to choose the Cloud Platform Appliance to which you
want to delegate authority. The Member Selector displays only Cloud Platform Appliances in the Grid. Click
the member, and Grid Manager displays the member name next to this field. This cloud member now
assumes authority for this network, and the Grid Master does not have authority any more. You can also
click Clear to remove authority delegation from the selected Cloud Platform Appliance and return authority
back to the Grid Master.
5. Click Next and add a Grid member or Microsoft server as a DHCP server for the network. A network can be served
by either Grid members or Microsoft servers, but not both at the same time.
— click the Add icon and select one of the following options:
— Add Infoblox Member: Select this option to add a Grid member as a DHCP server for the network. Select
the Grid member from the Member Selector dialog box. Keep in mind, DHCP properties for the network
are inherited from this member. The network can be served by multiple members, but a member can
serve networks in one network view only.
or
— Add Microsoft Server: Select this option to add a Microsoft server as a DHCP server for the network.
Select the Microsoft server from the Microsoft Server Selector dialog box.
6. Click Next to associate Active Directory Sites with the network. For more information, see Associating Active
Directory Sites with Networks on page 1272.
7. Click Next to override DHCP properties as described in About DHCP Properties on page 1071. This only applies
if you are adding a network that is served by an Infoblox Grid member.
or
8. (Applies only with Network Insight) Click Next to initiate or disable discovery of the new network(s). This step is
not required for creating a new network. Discovery settings differ based on whether you are defining one network
or multiple networks.
— Configuring one network: discovery settings include the following: Enable Discovery and Enable Immediate
Discovery, selecting a Probe member to perform the discovery; and Polling Options, which define how the
network will be discovered by the Probe member, including the ability to enable or disable the use of SNMP
Credentials and CLI Credentials, along with Switch Port Data Collection settings. By default, all Polling
Options discovery settings are inherited from the parent network (or Grid, if no parent exists) unless you
click Override. Polling Options govern the protocols used to query and collect information about the
network devices being discovered. For more information, see the section Configuring Discovery Properties
on page 676 for a complete description of discovery Polling Options.
or
— Configuring more than one network: If the networks are child networks, they automatically inherit the
settings of the parent network, including discovery settings and the discovery member. Discovery is
disabled for any parent networks. These settings will not appear in the wizard page. For discovery of
multiple networks, you can only enable or disable Immediate Discovery.
9. As part of creating a network in IPAM or DHCP, you can provision the network on an actual device (switch, router,
or switch-router), that is discovered and managed through the Grid Manager.
— Begin by checking the Enable Network Provisioning check box, and clicking the Select Device button.
Choose your device from the Device Selector dialog. (Click Clear to remove the setting. For more
information, see the section Using the Device Selector on page 689.)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1113

Managing IPv4 DHCP Data

— If you performed DHCP configuration in the previous step of the Add Network Wizard, the Router IP value
will automatically be populated with the DHCP Router IP address value. Otherwise, you enter the standard
router IP address (for example, if Grid Manager discovers and manages a router 172.16.22.1, the IP value
172.16.22.1 should be entered in the Router IP field).
— if required for the newly provisioned network to ensure that attached devices receive DHCP
auto-configuration, enable the DHCP Forwarding check box. For this setting, if a DHCP Failover was
previously configured, the IP addresses defined for DHCP failover are automatically used for the DHCP
forwarding configuration.
— You will also need to choose an interface on the selected device on which to provision the network by
selecting it from the Interface drop-down menu. Grid Manager ensures that only those interfaces that can
support provisioning, and are available for provisioning (that do not have an Operation Status of Up),
appear in the drop-down menu.
— Otherwise, when creating networks and provisioning them on managed devices, you can create a VLAN on
which to provision the network by clicking the Create VLAN option and entering the VLAN Name and VLAN
ID. Ensure that the VLAN ID value you enter is appropriate for the application - do not create a new VLAN and
provision a network for a VLAN value that is already actively carrying traffic for another routing domain.
If a selected device does not support VLANs, the Create VLAN option will not appear.
10. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see About Extensible Attributes on page 417.
If you are adding an RIR network, the RIR network attribute table appears. For information about these attributes
and how to enter them, see RIR Network Attributes on page 565. You can preview the information before the
appliance submits updates to the RIPE database. To preview registration updates, click Preview RIR
Submissions. For more information, see Previewing Registration Updates on page 569.

Note: You cannot leave an optional RIR attribute value empty. If you do not have a value for an RIR attribute, you
must delete it from the table. You can enter up to 256 characters for all RIR attributes.

11. As the final step in the Add IPv4 Network wizard, you define when Grid Manager provisions the new network by
scheduling it. You also schedule when the associated port control task executes (if a port configuration has been
specified).
— To create the new network and its associated port configuration immediately, select Now. Grid Manager
synchronizes the port control task to take place at the same time as the creation of the new network.
— You can choose to have Grid Manager execute the port control task at the same time as the network
creation. To do so, select At same time as above.
— You can choose to have Grid Manager execute the port control task at a later time by selecting Later.
Choose a Selected time by entering or selecting a Start Date (click the calendar icon to choose a calendar
date) and a Start Time, and choose a Time Zone.
12. Choose one of the following from the Save & ... drop-down button menu:
— Click Save & Close to add the new network and close the wizard (this is the default).
— Click Save & Edit to add the new network and launch the editor.
— Click Save & New to add the new network and launch the wizard again to add another network.

Note: At any step during the wizard, you can click Schedule for Later to schedule the task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.

After you create a network, you can do the following:

• Use the split network feature to create subnets for the network. For information, see Splitting IPv4 Networks into
Subnets on page 592.
• Use the join networks feature to create a parent network that encompasses multiple subnets into a larger
network. For information, see Joining IPv4 Networks on page 592. You can also create a shared network for
subnets that are on the same network segment.
Networks served by Microsoft servers do not support the split and join functions.

1114 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Networks

Viewing Networks
You can view IPv4 networks from the IPAM tab -> Net Map and List panels. The Net Map panel provides a graphical
view of your networks and the List panel displays the networks in table format. For more information, seeIPv4
Network Map on page 586 and IPAM Home on page 590.
You can also view a list of IPv4 and IPv6 networks in the DHCP tab -> Networks tab -> Networks panel. This panel
displays all IPv4 and IPv6 networks.
In any of these panels, you can use filters or the Go to function to navigate to a specific network. You can also create
a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77. You can add,
delete, or edit a network. You can also monitor the DHCP utilization of a selected network.
When viewing networks, you can choose to view them in one of the following views:
• Click Toggle Hierarchical View to view networks hierarchically in a parent-child structure (networks in a network
container). You can view detailed information about the networks by clicking the network link and drilling down
to the lowest hierarchical level, and then opening a network. To go back to a previous hierarchical view, click
the link of the corresponding level in the breadcrumb. The hierarchical view is the default view.
• Click Toggle Flat View to display a flat list of all networks and network containers. The parent and child networks
are listed separately in the flat view.
Depending on where you view your networks from, Grid Manager displays some of the following information by
default. You can also select specific information for display.
• Network: The network address.
The network is displayed in one of the following colors:
— Yellow: The network is unmanaged.
— Blue: The selected network.
— Grey: The network is currently not available as a NIOS network object.
• Comment: The information you entered about the network.
• IPAM Utilization: This information is available for IPv4 networks only. It displays the percentage based on the IP
addresses in use divided by the total addresses in the network. For example, in a /24 network, if there are 25
static IP addresses defined and a DHCP range that includes 100 addresses, the total number of IP addresses in
use is 125. Of the possible 256 addresses in the network, the IPAM utilization is about 50% for this network.
The appliance updates the IPAM utilization data immediately for a network container, but for a network it is
updated every 15 minutes.
The IPAM utilization data is displayed in one of the following colors:
— Red: The IPAM utilization percentage is above the configured Trigger value.
— Blue: The IPAM utilization percentage is below the configured Trigger value.
• Site: The site to which the network belongs. This is one of the predefined extensible attributes.
• Protocol: Displays whether the network is an IPv4 or IPv6 network.
• Disabled: Indicates if the network is disabled.
• Leaf Network: Indicates whether the network is a leaf network or not. A leaf network is a network that does not
contain other networks.
• IPv4 DHCP Utilization: This information is available for IPv4 networks only. It displays the percentage of the total
DHCP usage of theIPv4 network. This is the percentage of the total number of DHCP hosts, fixed addresses,
reservations, and active leases in the network divided by the total number of IP addresses (excluding IP
addresses in the exclusion range) and all DHCP objects in the network. Note that only enabled addresses are
included in the calculation. It does not include abandoned addresses or leases. The appliance updates the
utilization data approximately every 15 minutes. The utilization data is displayed in one of the following colors:
— Red: The DHCP resources are 100% utilized.
— Yellow: The DHCP utilization percentage is over the effective high-water mark threshold.
— Blue: The DHCP utilization percentage is below the effective low-water mark threshold.
— Black: The DHCP utilization percentage is at any number other than 100%, or it is not above and below any
threshold.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1115

Managing IPv4 DHCP Data

You see the following when RIR is enabled (For information, see RIR Registration Updates on page 555.):
• RIR Organization: This appears only if support for RIR updates is enabled. This displays the name of the RIR
organization to which the network is assigned.
• RIR Organization ID: This appears only if support for RIR updates is enabled. This displays the ID of the RIR
organization to which the network is assigned.
• RIR Registration Status: This appears only if support for RIR update is enabled. This field displays the RIR
registration status. This can be Registered or Not Registered. Registered indicates that the network has a
corresponding entry in the RIPE database.
• Last Registration Updated: Displays the timestamp when the last registration was updated. The displayed
timestamp reflects the timestamp used on the Grid Master.
• Status of Last Registration Update: Displays the registration status and communication method of the last
registration update. The status can be Pending, Sent, Succeeded, or Failed. Each time you send a registration
update to create, modify, or delete a network container or network, the updated status will be displayed here. If
you have selected not to send registration updates, the previous status is retained.
You see the following only with Network Insight (For information, see Infoblox Network Insight on page 653.):
• Discovery Enabled: Indicates whether discovery is allowed on the network container or the network.
• Managed: Indicates whether the network is set to Managed status under NIOS.
• First Discovered: The date and timestamp of the first occasion that NIOS discovered the network.
• Last Discovered: The date and timestamp of the last occasion that NIOS performed discovery on the network.
You see the following when the Cloud Network Automation license is installed on the Grid Master (For information,
see Deploying Cloud Network Automation on page 361.):
• Cloud Usage: This field indicates whether this object is associated with any specific cloud extensible attributes
or within a scope of delegation. It can be one of the following:
— Cloud from adapter: Indicates that this object has been created by a cloud adapter and it may or may not be
within a scope of delegation at the moment.
— Cloud from delegation: Indicates that this object is within the scope of delegation or the object itself
defines a scope of authority delegation, and it is not created by a cloud adapter.
— Used by cloud: Indicates that this network or network container is associated with the extensible attribute
Is External or Is Shared and the value is set to True, which implies the network is a private or shared
network managed by the CMP, and it is not Cloud from adapter or Cloud from delegation.
— Non-cloud: The object is a regular NIOS object and is not within the scope of any authority delegation nor is
it associated with any of these extensible attributes: Cloud API Owned, Is External, or Is Shared. NIOS
admin users can modify this object based on their permissions.
• Owned By: A cloud object can be owned by the Grid Master or the cloud adapter. When the object is created by
the Cloud Platform member, this shows Grid. If the object is created by the cloud adapter, this shows Adapter.
• Delegated To: This tells you whether a cloud object has been delegated to a Cloud Platform Appliance or not. If
the cloud object has a parent object and the parent has been delegated, this field shows the parent delegation
and you cannot modify the field.
• Extensible attributes (Building, Country, Region, State and VLAN): You can select the extensible attributes such
as Building, Country, Region, State, and VLAN for display. When you enable other features such as RIR, Network
Insight, and Cloud Network Automation, you can select additional attributes for display.
You can sort the list of networks in ascending or descending order by certain columns. For information about
customizing tables in Grid Manager, see Customizing Tables on page 69.
You can also modify some of the data in the table. Double click a row of data, and either edit the data in the field or
select an item from a drop-down list. Note that some fields are read-only. For more information about this feature,
see Modifying Data in Tables on page 70. You can edit values of inheritable extensible attributes by double clicking
on the respective row. If an extensible attribute has an inherited value, then the cell is highlighted in blue when you
perform an inline editing. The Descendant Actions dialog box is displayed when you click Save. For information, see
Managing Inheritable Extensible Attributes at the Parent and Descendant Level on page 424. If you delete the value
of an inheritable extensible attribute at the parent level, you can choose to preserve the descendant value or remove
it. For information, see Deleting Inheritable Extensible Attributes Associated with Parent Objects on page 427.

1116 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Networks

Viewing Network Details

You can view detailed information about a specific network by clicking the network link. Grid Manager displays the
objects in the network, including DHCP ranges, hosts, fixed addresses and roaming hosts. It displays the following
information about the network:
• IP Address: The IP address of a DHCP object, such as a DHCP range, fixed address, reservation, host configured
for DHCP, or roaming host with an allocated IP address. For a DHCP range, this field displays the start and end
addresses of the range. For a host that has multiple IP addresses, each IP address is displayed separately. Note
that the appliance highlights all disabled DHCP objects in gray.
The IP address is displayed in one of the following colors:
— Yellow: The IP address is unmanaged.
— Blue: The IP address is excluded.
— Pink: Indicates IP address conflicts.
— Grey: The
• Type: The DHCP object type, such as DHCP Range or Fixed Address.
• Name: The object name. For example, if the IP address belongs to a host record, this field displays the
hostname.
• Comment: The information you entered for the object.
• IPv4 DHCP Utilization: The percentage of the total DHCP usage of a DHCP range. This is the percentage of the
total number of fixed addresses, reservations, hosts, and active leases in the DHCP range divided by the total IP
addresses in the range, excluding the number of addresses in the exclusion ranges. Note that only enabled
objects are included in the calculation. It does not include abandoned addresses or leases.
• Site: The site to which the DHCP object belongs. This is one of the predefined extensible attributes.
You can select the following additional columns for display:
• Static Addresses: Indicates whether the IP address is a static address.
• Dynamic Addresses: Indicates whether the IP address is a dynamically assigned address.
• Disabled: Indicates whether the object is disabled.
• Priority: Displays the priority of a DHCP range when NAC filters are applied.
• Available extensible attributes.
You can also do the following in this panel:
• Modify some of the data in the table. Double click a row, and either modify the data in the field or select an item
from a drop-down list. Click Save to save the changes. Note that some fields are read only. You can edit values
of inheritable extensible attributes by double clicking on the respective row. If an extensible attribute has an
inherited value, then the cell is highlighted in blue when you perform an inline editing. The Descendant Actions
dialog box is displayed when you click Save. For information, see Managing Inheritable Extensible Attributes at
the Parent and Descendant Level on page 424. If you delete the value of an inheritable extensible attribute at
the parent level, you can choose to preserve the descendant value or remove it. For information, see Deleting
Inheritable Extensible Attributes Associated with Parent Objects on page 427.
• Sort the displayed data in ascending or descending order by column.
• Click Go to IPAM View to view information about the object in the IPAM tab.
• Add new objects, such as DHCP ranges, to the network.
• Delete or schedule the deletion of a selected object or multiple objects.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Print or export the data.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1117

Managing IPv4 DHCP Data

Modifying IPv4 Networks

You can modify existing network settings and override the Grid or member DHCP properties, with the exception of the
network address and netmask.
To modify an IPv4 network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network check box,
and then click the Edit icon.
or
From the Data Management tab, select the IPAM tab -> network check box, and then click the Edit icon.
2. The IPv4 Network editor contains the following basic tabs from which you can modify data:
— Genera Basic: You can modify the following fields:
— Comment: The information you entered for the network.
— Disabled: This field is displayed only if the selected network is a network without a child network under
it. You can disable and enable existing networks instead of removing them from the database, if the
selected network does not have a child subnet. This feature is especially helpful when you have to
move or repair the server for a particular network.
When the Cloud Network Automation license is installed on the Grid Master, Grid Manager displays the
following information in the Cloud section: Cloud Usage, Owned By, and Delegated To. You cannot modify these
fields. For more information, see Viewing Networks on page 1115.
— Member Assignment: Add or delete a Grid member that provides DHCP services for this network. For
information, see Adding IPv4 Networks on page 1111.
— IPv4 DHCP Options: Keep the inherited DHCP properties or override them and enter unique settings for the
network. For information, see Defining IPv4 DHCP Options on page 1082.
— Discovery: Checking the Enable Discovery check box informs NIOS to begin discovering the network after
you click Save and Close. You manage discovery polling settings local to each network from this page. For a
complete overview of features on this page, see Discovering Devices and Networks on page 687 and its
subsections.
— Discovery Exclusions: IP Addresses and IP ranges can be locally excluded from discovery by clicking the Add
icon and selecting Add IP Address or Add IP Range. These IP addresses or IP ranges are selected from within
the chosen network. For related information, see Excluding IP Addresses from Discovery on page 685 and
its subsections.
— Discovery Blackout: Define extended time periods and regularly scheduled times when discovery and/or
Port Configuration tasks will not take place on a network. Editing a network under DHCP, blackout settings
apply only to the specified network. You also specify the scheduled time when the blackout period begins,
and the duration of the blackout period. By default, the network inherits its discovery blackout settings
from the Grid level. For related information, see Defining Blackout Periods on page 731 and its
subsections.

Note: Discovery blackout settings also can be defined for DHCP ranges.

— RIR Registration: Modify RIR network information. This tab appears only when support for RIR updates is
enabled. For information, see Modifying RIR Network Data on page 561.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific network. You
can also modify the values of the extensible attributes. For information, see About Extensible Attributes on
page 417. You can edit values of inheritable extensible attributes by double clicking on the respective
column. If an extensible attribute has an inherited value, then the cell is highlighted in blue when you
perform an inline editing. The Descendant Actions dialog box is displayed when you click Save. For
information, see Managing Inheritable Extensible Attributes at the Parent and Descendant Level on page
424. If you delete the value of an inheritable extensible attribute at the parent level, you can choose to
preserve the descendant value or remove it. For information, see Deleting Inheritable Extensible Attributes
Associated with Parent Objects on page 427.

1118 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Shared Networks

— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, click Toggle Advanced Mode to display the following tabs from which you can modify advanced data.
— General Advanced: You can associate zones with a network. For information, see Associating Networks with
Zones on page 1093.
— IPv4 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the network.
Note that you must click Override and select Enable DDNS updates for the DDNS settings you configure in
this tab to take effect. For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915.
— IPv4 BOOTP/PXE: Keep the inherited BOOTP properties or override them and enter unique settings for the
network. For information, see Configuring IPv4 BOOTP and PXE Properties on page 1076.
— IPv4 Filters: You can keep the inherited IPv4 logic filters or override them and add a new IPv4 logic filter. For
information, see Applying Filters to DHCP Objects on page 1204.
— IPv4 DHCP Thresholds: Keep the inherited thresholds settings or override them and enter unique settings
for the network. For information, see Configuring Thresholds for DHCP Ranges on page 1087.
4. Save the configuration or click the Schedule icon at the top of the wizard to schedule this task. In the Schedule
Change panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting IPv4 Networks

When you delete a network, all of its data, including all DHCP records, subnets, and records in its subnets, is deleted
from the database. Because of the potentially large loss of data that can occur when you delete a network, the
appliance stores the deleted network in the Recycle Bin. You can restore a deleted network from the Recycle Bin, if
enabled. You can also disable a network instead of deleting it. For information, see Modifying IPv4 Networks on page
1118.
To delete a network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network check box,
and then select Delete or Schedule Delete from the Delete drop-down menu.
2. To delete the network now, in the Delete Confirmation dialog box, click Yes. To schedule the deletion, see
Scheduling Deletions on page 90.
The appliance puts the deleted network in the Recycle Bin, if enabled.
Any Port reservation associated with the deleted network will also be deleted without user intervention.

Configuring IPv4 Shared Networks

You can combine individual contiguous networks into a shared network to allow the DHCP server to assign IP
addresses from any subnet (that resides on the same network interface) in the shared network.
Before creating a shared network, you must first create the subnets. For example, you must first create the networks
10.32.1.0 and 10.30.0.0 before designating them to a shared network. For more information, see About Shared
Networks on page 1055.

Adding IPv4 Shared Networks

To add a shared network:
1. Select the Data Management tab.
2. If you have more than one network view in the system, select the network view in which you want to add the
network.
3. Select the DHCP tab -> Networks tab.
4. In the Shared Networks section, select IPv4 Shared Network from the Add drop-down menu.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1119

Managing IPv4 DHCP Data

5. In the Add IPv4 Shared Network wizard, complete the following and click Next:
— Name: Enter the name of the shared network.
— Comment: Enter information about the shared network.
— Disabled: Select this if you want to enable the shared network at a later time. You can disable and enable
existing networks instead of removing them from the database. This feature is especially helpful when you
have to move or repair the server for a particular network.
6. Do the following to add networks:
a. Click the Add icon.
b. In the Select Network dialog box, select the networks that you want to include in the shared network.
Ensure that the networks are served by the same Grid members to avoid DHCP inconsistencies.
7. Click Next to configure or override DHCP options as described in Defining IPv4 DHCP Options on page 1082.
8. Click Next to enter values for required extensible attributes or add optional extensible attributes for the shared
network. For information, see Using Extensible Attributes on page 427.
9. Save the configuration or click the Schedule icon at the top of the wizard to schedule this task. In the Schedule
Change panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.

Viewing Shared Networks

To view IPv4 and IPv6 shared networks:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Shared Networks.
2. Grid Manager displays the following information:
— Name: The name of the shared network.
— Protocol: Displays whether the network is an IPv4 pr IPv6 network.
— Comment: The information you entered about the shared network.
— IPv4 DHCP Utilization: The percentage of the DHCP utilization of the networks that belong to the shared
network. This is the percentage of the total number of available IP addresses from all the networks that
belong to the shared network versus the total number of all IP addresses in all of the networks in the shared
network.
— Site: The site to which the shared network belongs. This is one of the predefined extensible attributes.
You can select Disabled or available extensible attributes for display. You also can view detailed information about a
network in a shared network by clicking the network link.
In this panel, you can use filters or the Go to function to navigate to a specific network. You can also create a quick
filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
You can sort the list of networks in ascending or descending order by columns. For information about customizing
tables in Grid Manager, see Customizing Tables on page 69.
You can also modify some of the data in the table. Double click a row of data, and either edit the data in the field or
select an item from a drop-down list. Note that some fields are read-only. For more information about this feature,
see Modifying Data in Tables on page 70.

Modifying IPv4 Shared Networks

You can modify existing network settings and override the Grid or member DHCP properties:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Shared Networks section ->
shared_network check box, and then click the Edit icon.
2. The Shared Network editor contains the following tabs from which you can modify data:
— General: Modify the fields Name, Comments, and Disabled as described in Adding IPv4 Shared Networks
on page 1119.

1120 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Address Ranges

— Networks: Displays the networks that are currently assigned to the shared network. You can add or
delete a network. To add a network, click the Add icon. In the Select Network dialog box, select the
network you want to add. To delete an existing network, select the network check box, and then click
the Delete icon.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific network. You
can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify
advanced data.
— IPv4 DHCP Options: Keep the inherited DHCP properties or override them and enter unique settings for the
shared network. For information, see Defining IPv4 DHCP Options on page 1082.
— IPv4 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the shared
network. Note that you must click Override and select Enable DDNS updates for the DDNS settings you
configure in this tab to take effect. For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on
page 915.
— IPv4 BOOTP/PXE: Keep the inherited BOOTP properties or override them and enter unique settings for the
shared network. For information, see Configuring IPv4 BOOTP and PXE Properties on page 1076.
— IPv4 Filters: You can keep the inherited IPv4 logic filters or override them and add a new IPv4 logic filter. For
information, see Applying Filters to DHCP Objects on page 1204.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting IPv4 Shared Networks

Though you can delete the networks in a shared network, a shared network must have at least one network in it.
To delete a shared network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Shared Networks section ->
shared_network check box, and then select Delete or Schedule Delete from the drop-down menu.
2. To delete the shared network now, in the Delete Confirmation dialog box, click Yes. To schedule the deletion, see
Scheduling Deletions on page 90.
The appliance puts the deleted shared network in the Recycle Bin, if enabled.

Configuring IPv4 Address Ranges

In a network, you define address ranges from which the DHCP server or failover association assigns IP addresses to
client requests. When a DHCP client requests an IP address, the appliance allocates an address within a defined
DHCP range. The DHCP client can use the assigned IP address until the lease expires.
When you do not assign a DHCP server or failover association to an address range, the range becomes a reserved
range. A reserved range contains IP addresses that are reserved for static hosts, not for dynamic assignments. You
can allocate the next available IP from a reserved range.
You can also apply filters to DHCP ranges to control how the DHCP server allocates IP addresses. For information
about DHCP filters, see About IPv4 DHCP Filters on page 1188.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1121

Managing IPv4 DHCP Data

Adding IPv4 Address Ranges

To add an IPv4 address range:
1. Navigate to the IPv4 network to which you want to add an address range, and then select Range from the Add
drop down menu.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> Range -> IPv4.
2. In the Add IPv4 Range wizard, select one of the following and click Next:
— Add Range: Select this to add an address range from scratch.
or
— Add Range Using Template: Click Select Template and select the template that you want to use. Note that
when you use a template to create an address range, the configurations of the template apply to the new
range. The appliance automatically populates the range properties in the wizard. You can then edit the
pre-populated properties.
3. Complete the following:
— Network: Click Select Network. Grid Manager displays the network address here if you have only one
network configured. When there are multiple networks, Grid Manager displays the Select Network dialog
box from which you can select one.
— Start: Enter the first available IP address in the range.
— End: Enter the last available IP address in the range.
— Name: Optionally, enter a name for the range.
— Comment: Enter additional information about the address range.
— Disabled: Select this if you want to save the configuration for the address range but do not want to activate
the address range yet. You can clear this check box when you are ready to allocate addresses from this
range.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. To delegate authority for this range,
complete the following:
Delegate authority from the Grid Master
— Delegate To: This field indicates whether the authority for the range you want to create has already been
delegated to a Cloud Platform Appliance. Click Select to choose the Cloud Platform Appliance to which you
want to delegate authority. The Member Selector displays only Cloud Platform Appliances in the Grid. Click
the member, and Grid Manager displays the member name next to this field. This cloud member now
assumes authority for this range, and the Grid Master does not have authority any more. You can also click
Clear to remove authority delegation from the selected Cloud Platform Appliance and return authority back
to the Grid Master.
4. Click Next and select one of the following:
— None (Reserved Range): Select this if you want to reserve this address range for static hosts. Addresses in
this range cannot be allocated as dynamic addresses. You can allocate the next available IP from this range
to a static host. This is selected by default.
— Grid Member: Select this if you want a Grid member to serve DHCP for this address range. Select a Grid
member from the drop-down list. The drop-down list displays only the Grid members that are associated
with the network to which the DHCP range belongs.
— Failover Association: Select this if you want a failover association to serve DHCP for this address range.
Click Select Association. In the DHCP Failover Association Selector dialog box, choose a failover
association, and then click the Select icon. The appliance lists failover associations that serve DHCP in the
network view of the DHCP range. For information, see Chapter 30, DHCP Failover, on page 1177.
5. Click Next to configure or override DHCP options as described in Defining IPv4 DHCP Options on page 1082.

1122 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Address Ranges

Note: Steps 6-7 apply only in deployments using Network Insight discovery features. Otherwise, skip to Step 8.

6. Click Next to initiate or disable discovery of the new DHCP range.

7. Discovery settings include the following: Enable Discovery and Immediate Discovery, selecting a Probe member
to perform the discovery; and Polling Options, which define how the network will be discovered by the Probe
member. By default, all Polling Options discovery settings are inherited from the parent network unless you click
Override. Polling Options govern the protocols used to query and collect information about the network devices
being discovered. For more information, see the section Configuring Discovery Properties on page 676 for a
complete description of discovery Polling Options.
8. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
9. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.
For information on viewing address ranges in a network, see Viewing IPv4 DHCP Objects on page 1135.

Modifying IPv4 Address Ranges

You can modify settings for the DHCP range. You can also define an exclusion range to prevent the appliance from
assigning the addresses in the exclusion range to clients. IP addresses in an exclusion range are excluded from the
pool of IP addresses. For more information, see About Exclusion Ranges on page 1056.
To modify an IPv4 address range:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network -> addr_range
check box, and then click the Edit icon.
2. The DHCP Range editor contains the following basic tabs from which you can modify data:
— General: Modify the fields, except the network address, as described in Adding IPv4 Address Ranges on
page 1122.
When the Cloud Network Automation license is installed on the Grid Master, Grid Manager displays the
following information in the Cloud section: Cloud Usage, Owned By, and Delegated To. You cannot modify
these fields. For more information, see Adding IPv4 Address Ranges on page 1122.
— Member Assignment: Modify the Grid member or failover association that provides DHCP services for the
DHCP range as described in Adding IPv4 Address Ranges on page 1122.
— IPv4 DHCP Options: Keep the inherited DHCP options or override them and enter unique settings for the
DHCP range. For information, see Defining IPv4 DHCP Options on page 1082.
— Extensible Attributes: You can add and delete extensible attributes that are associated with a specific DHCP
range. You can also modify the values of extensible attributes. For information, see Using Extensible
Attributes on page 427. You can edit values of inheritable extensible attributes by double clicking on the
respective column. If an extensible attribute has an inherited value, then the cell is highlighted in blue
when you perform an inline editing. The Descendant Actions dialog box is displayed when you click Save.
For information, see Managing Inheritable Extensible Attributes at the Parent and Descendant Level on
page 424. If you delete the value of an inheritable extensible attribute at the parent level, you can choose to
preserve the descendant value or remove it. For information, see Deleting Inheritable Extensible Attributes
Associated with Parent Objects on page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify
advanced data.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1123

Managing IPv4 DHCP Data

— IPv4 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the DHCP
range. Note that you must click Override and select Enable DDNS updates for the DDNS settings you
configure in this tab to take effect. For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on
page 915.
— IPv4 BOOTP/PXE: Keep the inherited BOOTP properties or override them and enter unique settings for the
DHCP range. For information, see Configuring IPv4 BOOTP and PXE Properties on page 1076.
— Exclusion Ranges: Configure a range of IP addresses that the appliance does not use to assign to clients.
You can use these exclusion addresses as static IP addresses. Enter the start and end addresses of the
exclusion range, and optionally, enter information about this exclusion range.
— IPv4 DHCP Thresholds: Keep the inherited thresholds settings or override them and enter unique settings
for the DHCP range. For information, see Configuring Thresholds for DHCP Ranges on page 1087.
— IPv4 Filters: You can keep the inherited IPv4 logic filters or override them and add a new IPv4 logic filter. For
information, see Applying Filters to DHCP Objects on page 1204.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Controlling Lease Assignments

You can set parameters to control how the DHCP server responds to lease requests within a specific DHCP range.
When you set a DHCP range to deny all leases requests, the appliance does not assign IP addresses within this range
to DHCP clients. This is useful when you want DHCP clients with IP addresses within this range to obtain new IP
addresses when they renew their leases. When a client with an IP address within this range broadcasts a
DHCPREQUEST message for its old IP address, the authoritative DHCP server responds with a DHCPNAK. This causes
the client to move to the INIT state and to send a DHCPDISCOVER message for a new IP address.
You can also configure the DHCP server to assign or deny IP addresses within a DHCP range to known and unknown
DHCP clients. Known clients include roaming hosts and clients with fixed addresses or DHCP host entries. Unknown
clients include clients that are not roaming hosts and clients that do not have fixed addresses or DHCP host entries.
To control how the appliance assigns leases to client requests:
1. DHCP Range: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
addr_range check box, and then click the Edit icon.
2. In the IPv4 Range editor, click Toggle Advanced Mode if the editor is in basic mode. When the additional tabs
appear, click the IPv4 DHCP Options tab -> Advanced tab and complete the following:

Note: The IPv4 DHCP Options tab is enabled when you select a Grid Member or IPv4 DHCP Failover Association in
the Member Assignment tab.

— Allow/Deny Clients
— Known Clients: Select this check box, and then select Allow or Deny from the drop-down list to assign
or deny IP addresses within this range to known DHCP clients. Known DHCP clients include roaming
hosts and clients with fixed addresses or DHCP host entries. Note that the appliance cannot deny an IP
address to a fixed address within this range. You must disable the fixed address if you do not want it to
obtain an IP address here.
— Unknown Clients: Select this check box, and then select Allow or Deny from the drop-down list to
assign or deny IP addresses within this range to unknown DHCP clients. Unknown DHCP clients include
clients that are not roaming hosts and clients that do not have fixed addresses or DHCP host entries.
— Deny Leases: Select Deny all lease requests for this range to deny all lease requests from DHCP clients.
3. Save the configuration and click Restart if it appears at the top of the screen.

1124 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Fixed Addresses

Deleting IPv4 Address Ranges

To delete a DHCP range:
• From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network ->
addr_range check box, and then click the Delete icon.

Configuring IPv4 Fixed Addresses

A fixed address represents a persistent link between an IP address and one of the following:
• MAC address
• Client identifier
• Circuit ID or remote ID in the DHCP relay agent option (option 82)
You can create fixed addresses as described in Adding IPv4 Fixed Addresses or from the Tasks Dashboard. For
information about the Tasks Dashboard, see The Tasks Dashboard on page 119. You can also create a fixed address
when you create a host record or when you convert an active, dynamically leased address to a fixed address. For more
information, see Adding Host Records on page 579 and Converting DHCP Leases on page 609.
When you create a fixed address, you must define a host identifier that the DHCP server uses to match the DHCP
client. Every time the DHCP client with the matching identifier requests an IP address, the DHCP server assigns it the
same address.
When a DHCP client sends a DHCPDISCOVER, it can include the MAC address or a unique client identifier as option
61 in the DHCP section of the packet. Using a client identifier is especially useful for virtualized server processes that
might be moved to different hardware platforms. For information about option 61, refer to RFC2132, DHCP Options
and BOOTP Vendor Extensions. You can select either the MAC address or client identifier as the host identifier in a
fixed address. The DHCP server matches the option 61 value in the client request using either the MAC address or
client identifier, depending on your configuration. When a DHCP client renews an IP address using a matching MAC
address or client identifier, the DHCP server tracks the allocation of IP addresses and reserves the same IP address
for the client.
When you enter a MAC address, you can use one of the following formats:
• aa:bb:cc:dd:ee:ff — Six groups of two hexadecimal digits separated by colons (:)
• aa-bb-cc-dd-ee-ff — Six groups of two hexadecimal digits separated by hyphens (-)
• aabb.ccdd.eeff — Three groups of four hexadecimal digits separated by periods (.)
• aabbcc-ddeeff — Two groups of six hexadecimal digits separated by a hyphen (-)
• aabbccddeeff — One group of 12 hexadecimal digits without any separator
After you save the entry, the appliance displays the MAC address in the AA:BB:CC:DD:EE:FF format.
When a DHCP client requests an IP address through a DHCP relay agent, the agent adds either the circuit ID or remote
ID, or both, to the DHCP relay agent information option (option 82). For information, see About the DHCP Relay Agent
Option (Option 82) on page 1085. When you select the DHCP relay agent option (circuit ID or remote ID) as the host
identifier in a fixed address, the DHCP server matches the DHCP client request using either the circuit ID or the remote
ID, depending on your configuration. When a DHCP client renews an IP address using a matching relay agent ID, the
DHCP server tracks the allocation of IP addresses and reserves the same IP address for the client. Note that leases
are not renewed at the standard renewal time (T1) when option 82 information is not available as a unicast renewal.
Instead, leases are renewed at the rebinding time (T2) when renewals are sent as broadcasts to the relay agents and
contain option 82 information. For information about how to configure the lease time, see Configuring General IPv4
DHCP Properties on page 1071.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1125

Managing IPv4 DHCP Data

Adding IPv4 Fixed Addresses

For Cloud Network Automation, you can create IPv4 fixed addresses within the delegation authority of a Cloud
Platform Appliance. The newly created fixed address is forwarded to the Cloud Platform Appliance. For information,
see About Authority Delegation on page 376.
To add an IPv4 fixed address:
1. Navigate to the network to which you want to add a fixed address, and then select Fixed Address from the Add
drop-down menu.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> Fixed Address -> IPv4.
2. In the Add IPv4 Fixed Address wizard, select one of the following and click Next:
— Add Fixed Address
or
— Add Fixed Address using Template
Click Select Template and select the template that you want to use. Note that when you use a template to
create a fixed address, the configurations of the template apply to the new address. The appliance
automatically populates the fixed address properties in the wizard. You can then edit the pre-populated
properties.
3. Complete the following:
a. Network: Click Select Network. When there are multiple networks, Grid Manager displays the Select
Network dialog box from which you can select one.
b. IP Address: Enter the IPv4 address for the fixed address, or click Next Available IP to obtain the next
available IP address. For information about obtaining the next available IP address, see About the Next
Available Network or IP Address on page 1109. Note that for Cloud Network Automation, Next Available IP
is not available if the fixed address you want to create is within a delegated range.
c. If the network of the IP address is served by a Grid member, Grid Manager displays the Assign IP Address by
section. Select one of the following to match your criteria:
— MAC Address: Select this to assign a fixed address to a host with the MAC address that you specify
here. Enter the MAC address in the field. For MAC address format, see Configuring IPv4 Fixed Addresses
on page 1125.
— DHCP Client Identifier: Select this to assign a fixed address to a host with the DHCP client identifier that
you specify here. In the field, enter the client identifier of the host to which you want the DHCP server to
assign this IP address. The client identifier must be unique within the network.
• Match null (\0) at beginning of DHCP client identifier: This is enabled when you select DHCP client
identifier. Select this when a DHCP client sends a \000 prefixed to the DHCP client identifier. \0 is
the null character. Some DHCP clients (for example, Microsoft) send the client identifier in a
\000foo format (with the null character prefix instead of just foo). The client identifier for the
requesting host and the client identifier stored in the appliance must match.
— DHCP Relay Agent: Select this to assign a fixed address to a host with the circuit ID or remote ID you
specify here. From the drop-down list, select Circuit ID or Remote ID, and then enter the ID in the field.
For information about circuit IDs and remote IDs, see About the DHCP Relay Agent Option (Option 82)
on page 1085. You can enter the ID in hexadecimal format, such as ex:aa, ab, 1f:cd, or ef:23:56, or in
string format, such as abcd or aa:gg. The appliance matches the value you enter here with the value
sent by the DHCP client in counted octet sequence format. For information about how to use
hexadecimal values, see DHCP Option Data Types on page 1080. The ID is case sensitive and can
contain up to 230 characters. Regardless of the entry you enter here, you can define the logging format
for the circuit ID and remote ID when Grid Manager displays them in the detailed lease information
page. For information about how to configure the logging format, see Defining Logging Format for DHCP
Option 82 on page 1086.

1126 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Fixed Addresses

Note: You cannot use the same circuit ID or remote ID for different fixed addresses if the addresses are in the
same network or the same shared network.

d. Name: Enter a name for the Fixed Address. This field is required if the network is served by a Microsoft
server. For information, see Adding Fixed Addresses/Microsoft Reservations on page 1313.
e. Comment: Optionally, enter additional information about the fixed address.
f. Disabled: Select this if you do not want the DHCP server to allocate this IP address at this time.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. This section displays the following
information:
• Cloud Usage: This field indicates whether this object is associated with any specific cloud extensible
attributes or within a scope of delegation. It can be one of the following:
— Cloud from adapter: Indicates that this object has been created by a cloud adapter and it may or may
not be within a scope of delegation at the moment.
— Cloud from delegation: Indicates that this object is within the scope of delegation or the object itself
defines a scope of authority delegation, and it is not created by a cloud adapter.
— Used by cloud: Indicates that this network or network container is associated with the extensible
attribute Is External or Is Shared and the value is set to True, which implies the network is a private or
shared network managed by the CMP, and it is not Cloud from adapter or Cloud from delegation.
— Non-cloud: The object is a regular NIOS object and is not within the scope of any authority delegation
nor is it associated with any of these extensible attributes: Cloud API Owned, Is External or Is Shared.
NIOS admin users can modify this object based on their permissions.
• Owned By: A cloud object can be owned by the Grid Master or the cloud adapter. When the object is created
by the Grid Master, this shows Grid. If the object is created by the cloud adapter, this shows Adapter.
Delegate authority from the Grid Master
— Delegate To: This field indicates whether the authority for the object you want to create has already been
delegated. If so, it displays the name of the delegation.
4. (Optional) Click Next to configure or override DHCP options as described in About IPv4 DHCP Options on page
1078.
5. (Applies only to Network Insight) This step is not required for creating a new Fixed Address. In the following
Wizard step, you can optionally define the following identification values and settings for the new object’s port
reservation:
— Choose the Device Type: Router, Switch-Router, Switch, MSFT (Microsoft) Server, NetMRI, NIOS, VNIOS, or
ESX (VMware) Server.
The values on this page are not required for defining the actual port reservation in a later wizard step.
Certain device types could be descriptively relevant based on the type of object you are creating. As an
example, the MSFT Server designator helps identify the new object as a Microsoft Hyper-V Host. The ESX
Server designator can be used to identify the new object as a VMware ESX Host. These values are not
required and will not affect the functionality of the object.
— Choose the Device Vendor: Cisco, Juniper, Aruba, Dell, Infoblox, or HP.
— You can also enter a Location and a Description. These values are advisory and not required for
configuration.
After you define this group of settings, you can also define a device port reservation, which is done in a later
step. This is not required for the Fixed Address object creation.
6. Click Next to initiate or disable discovery of the new Fixed Address. (Applies only to Network Insight) This step is
not required for creating a new Fixed Address.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1127

Managing IPv4 DHCP Data

a. Choose either Exclude from Network Discovery or Enable Immediate Discovery. If you choose to Exclude,
discovery will not execute on the fixed IP address. If you choose Enable Immediate Discovery, discovery will
execute on the object after you save your settings. You may also choose to leave both options disabled.
b. By default, the new fixed address object inherits its SNMP credentials from those defined at the grid level.
Should you wish to override them for a local set of credentials, check the Override Credentials check box
and select the SNMPv1/SNMPv2 or SNMPv3 option and enter the locally used credentials.
c. You may also test the entered SNMP credentials by clicking Test SNMP Credential.

Note: For descriptions of SNMP credentials for discovery, see the section Configuring SNMP1/v2 Credentials for
Polling on page 680 and Configuring SNMPv3 Properties on page 680. These Grid-based values are
inherited, by default, by each new object you create.

— For the new object, you can check the Override CLI Credentials check box to override the inherited set of CLI
credentials taken from the Grid level. This set of credentials may be used for the device that is directly
associated with the new object in its port reservation.
— You can also click Test CLI Credentials to enter and test a set of CLI login credentials against a device based
on its IP address.
Port control operations require CLI credentials for the involved devices. (If you are not using port control for
the new object, usage of CLI credentials is optional.) Because some IPAM and DHCP objects will use port
control features as part of object creation, CLI credentials are automatically leveraged as part of discovery.
Ensure you have the correct sets of CLI credentials for devices in your network. For more information, see
the section Configuring CLI Discovery Properties on page 681.
— SSH is the default for CLI operations. Check the Allow Telnet check box if you know the device involved in
the object assignment may support Telnet but may not support SSH, or if you want Telnet as an option.

Note: All port configuration operations require CLI credentials to be entered into Grid Manager. Because some
IPAM and DHCP objects will use port control features as part of object creation, CLI credentials are
automatically leveraged as part of discovery. Ensure you have the correct sets of CLI credentials for
devices in your network.

7. Click Next to define port connectivity for the device port that will be associated with the new object. This step is
not required for creating a new Fixed Address. This feature set is also termed port control in the NIOS/Grid
Manager system. The device whose interface the new Fixed Address will be associated should already be
discovered by Network Insight.
— Begin by checking the Reserve Port check box. Note that reserving a switch port does not guarantee its
availability.
Optionally, you can skip connecting port configuration by clicking Next.
Click the Clear button to remove the selected device from the configuration.
— Click the Select Device button to choose the device for which the port reservation will be associated. You
should know the identity of the device to whose interface the new object will be associated before taking
this step. For more information, see the section Using the Device Selector on page 689.
— After choosing the device, choose the Interface with which the port reservation will be bound. The
drop-down list shows only interfaces that are most recently found to be available by Grid Manager during
the last discovery cycle.
— The Wizard page also shows a list of any VLANs that are currently configured in the chosen device (The
following VLANs are configured). This Wizard page allows only the assignment of an existing VLAN in the
chosen device to the new port reservation.
— Check the Configure Port check box to define port control settings for the port reservation.
— Choose the Data VLAN and/or the Voice VLAN settings you may need for the port assignment. Depending
on the selected device, you may or may not be able to apply VLAN settings.
— Set the Admin Status to Up if you need to activate the port after assignment in the current task.

1128 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Fixed Addresses

All port control operations require CLI credentials to be configured. Because some IPAM and DHCP objects
will use port control features as part of object creation, CLI credentials are automatically leveraged as part
of discovery and definition of port configurations such as Admin Up/Down status. Ensure you have the
correct sets of CLI credentials for devices in your network.
— Enter a Description for the port assignment. Infoblox recommends doing so to help other technicians to
recognize the port assignment task.
8. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427. When you create a new fixed address whose authority is delegated
to a Cloud Platform Appliance, the required cloud extensible attributes and their values are automatically
populated.
9. As the final step in the Add Fixed Address wizard, you define when Grid Manager creates the new object by
scheduling it. You also schedule when the associated port control task executes (if a port configuration is
specified).
— To create the new object and its associated port configuration immediately, select Now. Grid Manager
synchronizes the port reservation task to take place at the same time as the activation of the new object.
— You can choose to have Grid Manager execute the port reservation task at the same time as the Fixed
Address object creation. To do so, select At same time as Fixed Address.
— You can choose to have Grid Manager execute the port reservation task at a later time by selecting Later.
Choose a Selected time by entering or selecting a Start Date (click the calendar icon to choose a calendar
date) and a Start Time, and choose a Time Zone.
10. Choose one of the following from the Save & ... drop-down button menu:
— Click Save & Close to add the new object and close the wizard (this is the default).
— Click Save & Edit to add the new object and launch the editor.
— Click Save & New to add the new object and launch the wizard again to add another Fixed Address object.

Note: At any step during the wizard, you can click Schedule for Later to schedule the task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85. You cannot
schedule this task when you are creating an object that is within a delegated scope.

For information on viewing fixed addresses and other DHCP objects, see Viewing IPv4 DHCP Objects on page 1135.

Modifying IPv4 Fixed Addresses

To modify the settings of a fixed address:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network ->
fixed_address check box, and then click the Edit icon.
2. The Fixed Address editor contains the following tabs from which you can modify settings:
— General: You can modify the fields, except the network address, as described in Adding IPv4 Fixed
Addresses on page 1126.
— Device Information: Define general identity/type information for the type of device to which your new object
connects. For more information, see step 5 in the previous section, Adding IPv4 Reservations on page
1131.
— Discovery: Checking the Enable Discovery check box informs NIOS to begin discovering the fixed address
after you click Save and Close. You manage discovery polling settings local to the fixed address from this
page. For a complete overview of features on this page, see Discovering Devices and Networks on page 687
and its subsections.
— IPv4 DHCP Options: You can keep the inherited DHCP options or override them and enter unique settings for
the fixed address. For information, see Defining IPv4 DHCP Options on page 1082.
— IPv4 Discovered Data: Displays the discovered data of the fixed address. For information, see Viewing
Discovered Data on page 642.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1129

Managing IPv4 DHCP Data

— Port Reservation: Review and edit any device port reservations that may be defined for the current object, or
create a new port reservation and schedule it. For a closer look, see the section Port Control Features in
Network Insight on page 714, and steps 4-8 in the section Adding IPv4 Fixed Addresses on page 1126.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific network. You
can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427. You can edit values of inheritable extensible attributes by double clicking on the respective
column. If an extensible attribute has an inherited value, then the cell is highlighted in blue when you
perform an inline editing.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify
advanced data.
— IPv4 DDNS: You can keep the inherited DDNS settings or override them and enter unique settings for the
fixed address. Note that you must click Override and select Enable DDNS updates for the DDNS settings you
configure in this tab to take effect. For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on
page 915.
— IPv4 BOOTP/PXE: You can keep the inherited BOOTP properties or override them and enter unique settings
for the fixed address. For information, see Configuring IPv4 BOOTP and PXE Properties on page 1076.
— IPv4 Filters: You can keep the inherited IPv4 logic filters or override them and add a new IPv4 logic filter. For
information, see Applying Filters to DHCP Objects on page 1204.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration and click Restart if it appears at the top of the screen.

Note: At any step during the wizard, you can click Schedule for Later to schedule the task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85. You cannot
schedule this task when you are creating an object that is within a delegated scope.

Deleting Fixed Addresses

To delete a fixed address within the DHCP range:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network ->
fixed_address check box or check boxes. You cannot delete multiple fixed addresses at the same time if the
authority for one of the fixed addresses is delegated to a Cloud Platform Appliance.
2. Select Delete from the Delete drop-down list.
3. In the Delete Confirmation dialog box, do the following:
— Delete associated leases with the fixed address (selected fixed IP address): When you clear this check box
and click Yes, the appliance changes the status of the associated leases from Static to Active. When you
select this check box and click Yes, the appliance deletes all the leases associated with the fixed address.

Note: NIOS removes all the static leases associated with a fixed address when you delete a fixed address out of the
DHCP range, regardless of the selection of the Delete associated leases with the fixed address (selected fixed
IP address) check box in the Delete Confirmation dialog box.

To schedule the fixed address deletion:

1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network ->
fixed_address check box.
2. Select Schedule Delete from the Delete drop-down list.
3. In the Schedule Deletion dialog box, complete the following:
— Delete Now: Select this to delete the object upon clicking Delete Now.
— Delete Later: Select this to schedule the deletion at a later date and time. Complete the following:

1130 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Reservations

— Date: Enter the date in YYYY-MM-DD (year-month-day) format. The appliance displays today’s date. You
can also click the calendar icon to select a date from the calendar widget.
— Time: Enter the time in hh:mm:ss AM/PM (hours:minutes:seconds AM or PM) format. You can also
select a time from the drop-down list by clicking the time icon.
— Time Zone: Select a time zone for the scheduled date and time from the drop-down list. This field
displays the time zone of the browser that the admin uses to log in to Grid Manager.
— Delete associated leases with the fixed address: Select this check box to delete all the leases associated
with the fixed address.
4. Click Schedule Deletion.
The appliance performs the deletion at the scheduled date and time, and puts all deleted objects in the Recycle
Bin, if enabled. You can restore the objects if necessary.

Configuring IPv4 Reservations

You can create a reservation as a static IP address for future use. A reservation is a pre-provisioned fixed address that
is associated with a MAC address of 00:00:00:00:00:00. Since 00:00:00:00:00:00 is not a real MAC address, no
client can receive this IP address from the address pool. You can reserve this static IP address and assign it to a client
in the future.
To create a reservation, you can do one of the following:
• Add a reservation. For information, see Adding IPv4 Reservations.
• Convert a fixed address or a dynamic address with an active lease to a reservation. For information, see
Converting Objects Associated with IP Addresses on page 609.
• Define a fixed address with an IP address. For information, see Adding IPv4 Fixed Addresses on page 1126.

Adding IPv4 Reservations

Note: At any step during the wizard, you can click Schedule for Later to schedule the task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.

To create a reservation:
1. Navigate to the network to which you want to add a reservation, and then select IPv4 Reservation from the Add
drop down menu.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> IPv4 Reservation.
2. In the Add Reservation wizard, select one of the following and click Next:
— Add Reservation
or
— Add Reservation using Template
Click Select Template and select the template that you want to use. Note that when you use a template to
create a reservation, the configurations of the template apply to the new address. The appliance
automatically populates the reservation properties in the wizard. You can then edit the pre-populated
properties.
3. Complete the following:
— Network: The displayed network address can either be the last selected network or the network from which
you are adding the DHCP range. If no network address is displayed or if you want to specify a different
network, click Select Network. When there are multiple networks, Grid Manager displays the Select Network
dialog box from which you can select one.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1131

Managing IPv4 DHCP Data

— IP Address: Enter the IP address that you want to reserve for manual assignment, or click Next Available IP
to obtain the next available IP address. For information about obtaining the next available IP address, see
Adding IPv4 Fixed Addresses on page 1126. Note that for Cloud Network Automation, Next Available IP is
not available if the reservation you want to create is within a delegated range.
— Name: Optionally, enter a name for the reservation.
— Comment: Optionally, enter additional information about the reservation.
— Disabled: Select this if you do not want the DHCP server to use this reservation at this time.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. This section displays the following
information:
• Cloud Usage: This field indicates whether this object is associated with any specific cloud extensible
attributes or within a scope of delegation. It can be one of the following:
— Cloud from adapter: Indicates that this object has been created by a cloud adapter and it may or may
not be within a scope of delegation at the moment.
— Cloud from delegation: Indicates that this object is within the scope of delegation or the object itself
defines a scope of authority delegation, and it is not created by a cloud adapter.
— Used by cloud: Indicates that this network or network container is associated with the extensible
attribute Is External or Is Shared and the value is set to True, which implies the network is a private or
shared network managed by the CMP, and it is not Cloud from adapter or Cloud from delegation.
— Non-cloud: The object is a regular NIOS object and is not within the scope of any authority delegation
nor is it associated with any of these extensible attributes: Cloud API Owned, Is External or Is Shared.
NIOS admin users can modify this object based on their permissions.
• Owned By: A cloud object can be owned by the Grid Master or the cloud adapter. When the object is created
by the Grid Master, this shows Grid. If the object is created by the cloud adapter, this shows Adapter.
Delegate authority from the Grid Master
— Delegate To: This field indicates whether the authority for the object you want to create has already been
delegated. If so, it displays the name of the delegation.
4. Click Next to configure or override DHCP options as described in Defining IPv4 DHCP Options on page 1082.
5. (Applies only to Network Insight) This step is not required for creating a new IPv4 Reservation. In the following
Wizard step, you can optionally define the following identification values and settings for the new object’s port
reservation:
— Choose the Device Type: Router, Switch-Router, Switch, MSFT (Microsoft) Server, NetMRI, NIOS, VNIOS, or
ESX (VMware) Server.
The values on this page are not required for defining the actual port reservation in a later wizard step.
Certain device types could be descriptively relevant based on the type of object you are creating. As an
example, the MSFT Server designator helps identify the new object as a Microsoft Hyper-V Host. The ESX
Server designator can be used to identify the new object as a VMware ESX Host. These values are not
required and will not affect the functionality of the object.
— Choose the Device Vendor: Cisco, Juniper, Aruba, Dell, Infoblox, or HP.
— You can also enter a Location and a Description. These values are advisory and not required for
configuration.
After you define this group of settings, you will still need to define a device port reservation, which is done
in a later step.
6. (Applies only to Network Insight) Click Next to initiate or disable discovery of the new IPv4 reservation.
— Choose either Exclude from Network Discovery or Enable Immediate Discovery. If you choose to Exclude,
discovery will not execute on the object. If you choose Enable Immediate Discovery, discovery will execute
on the object after you save your settings. You may also choose to leave both options disabled.

1132 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv4 Reservations

— By default, the new object inherits its SNMP credentials from those defined at the grid level. Should you
wish to override them for a local set of credentials, check the Override Credentials check box and select the
SNMPv1/SNMPv2 or SNMPv3 option and enter the locally used credentials. For more information, see the
sections Configuring SNMP1/v2 Credentials for Polling on page 680 and Configuring SNMPv3 Properties
on page 680 for a complete description of SNMP credentials for discovery.
— For the new object, you can check the Override CLI Credentials check box to override the inherited set of CLI
credentials taken from the Grid level. This set of credentials may be used for the device that is directly
associated with the new object (in this case, an IPv4 Reservation) in its port reservation.
— You can also click Test CLI Credentials to select and test a set of CLI login credentials against a device based
on its IP address.
Port control tasks require CLI credentials for the involved devices. (If you are not using port control for the
new object, usage of CLI credentials is not required.) Because some IPAM and DHCP objects will use port
control features as part of object creation, CLI credentials are automatically leveraged as part of discovery.
Ensure you have the correct sets of CLI credentials for devices in your network. For more information, see
the section Configuring CLI Discovery Properties on page 681.
— SSH is the default for CLI operations. Check the Allow Telnet check box if you know the device involved in
the object assignment may support Telnet but may not support SSH, or if you want Telnet as an option.
7. (Applies only with Network Insight) Click Next to define optional device port association for the IPv4 reservation.
This step is optional and not required for creating the new IPv4 Reservation. This feature set is also termed port
control in the NIOS/Grid Manager system. The device to which the new object will be associated should already
be discovered and managed from the Infoblox Grid.
— Begin by checking the Reserve Port check box. Note that reserving a switch port does not guarantee its
availability.
Optionally, you can skip connecting port configuration by clicking Next.
Click the Clear button to remove the selected device from the configuration.
— Click the Select Device button to choose the device for which the port reservation will be associated. You
should know the identity of the device to whose interface the new object will be associated before taking
this step. For more information, see the section Using the Device Selector on page 689.
— After choosing the device, choose the Interface with which the reservation will be bound. The drop-down
list shows only interfaces that are most recently found to be available by Grid Manager during the last
discovery cycle.
— The Wizard page also shows a list of any VLANs that are currently configured in the chosen device (The
following VLANs are configured). This Wizard page allows only the assignment of an existing VLAN in the
chosen device to the new port reservation.
— Check the Configure Port check box to define specific port configuration settings for the port reservation.
— Choose the Data VLAN and/or the Voice VLAN settings you may need for the port assignment. Depending
on the selected device, you may or may not be able to apply VLAN settings.
— Set the Admin Status to Up if you need to activate the port after assignment in the current task.
All port control operations require CLI credentials to be entered into Grid Manager. Because some IPAM and
DHCP objects will use port control features as part of object creation, CLI credentials are automatically
leveraged as part of discovery and definition of port configurations such as Admin Up/Down status. Ensure
you have the correct sets of CLI credentials for devices in your network.
— Enter a Description for the port reservation. Infoblox recommends doing so to help other technicians to
recognize the port assignment task.
8. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
9. As the final step in the Add IPv4 Reservation wizard, you define when Grid Manager creates the new object by
scheduling it. You also schedule when the associated port control task executes (if a port configuration is
specified).

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1133

Managing IPv4 DHCP Data

— To create the new IPv4 Reservation and its associated port reservation immediately, select Now. Grid
Manager synchronizes the port control task to take place at the same time as the activation of the new
object.
— You can choose to have Grid Manager execute the port control task at the same time as the object creation.
To do so, select At same time as IPv4 Reservation.
— You can choose to have Grid Manager execute the port control task at a later time by selecting Later.
Choose a Selected time by entering or selecting a Start Date (click the calendar icon to choose a calendar
date) and a Start Time, and choose a Time Zone.
10. Choose one of the following from the Save & ... drop-down button menu:
— Click Save & Close to add the new object and close the wizard (this is the default).
— Click Save & Edit to add the new object and launch the editor.
— Click Save & New to add the new object and launch the wizard again to add another IPv4 Reservation
object.
11. Click Restart if it appears at the top of the screen.

Note: At any step during the wizard, you can click Schedule for Later to schedule the task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85. You cannot
schedule this task when you are creating an object that is within a delegated scope.

Modifying IPv4 Reservations

To modify an IPv4 reservation:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network -> reservation
check box, and then click the Edit icon.
2. The Reservation Address editor contains the following tabs from which you can modify data:
— General: Modify the fields, except the network address, as described in Adding IPv4 Reservations on page
1131.
— Device Information: Define general identity/type information for the type of device to which your new object
connects. For more information, see Step 5 in the previous section, Adding IPv4 Reservations on page
1131.
— IPv4 DHCP Options: Keep the inherited DHCP options or override them and enter unique settings for the
reservation. For information, see Defining IPv4 DHCP Options on page 1082.
— IPv4 Discovered Data: Displays the discovered data of the reservation. For information, see Viewing
Discovered Data on page 642.
— Port Reservation: Review and edit any device port reservations that may be defined for the current object, or
create a new port reservation and schedule it. For a closer look, see the section Port Control Features in
Network Insight on page 714, and steps 4-8 in the section Adding IPv4 Reservations on page 1131.
— Extensible Attributes: Add and delete extensible attributes that are associated with a reservation. You can
also modify the values of extensible attributes. For information, see Using Extensible Attributes on page
427. You can edit values of inheritable extensible attributes by double clicking on the respective column. If
an extensible attribute has an inherited value, then the cell is highlighted in blue when you perform an
inline editing. The Descendant Actions dialog box is displayed when you click Save. For information, see
Managing Inheritable Extensible Attributes at the Parent and Descendant Level on page 424. If you delete
the value of an inheritable extensible attribute at the parent level, you can choose to preserve the
descendant value or remove it. For information, see Deleting Inheritable Extensible Attributes Associated
with Parent Objects on page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify
advanced data.

1134 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing IPv4 DHCP Objects

— IPv4 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the
reservation. Note that you must click Override and select Enable DDNS updates for the DDNS settings you
configure in this tab to take effect. For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on
page 915.
— IPv4 BOOTP/PXE: You can keep the inherited BOOTP properties or override them and enter unique settings
for the reservation. For information, see Configuring IPv4 BOOTP and PXE Properties on page 1076.
— IPv4 Filters: You can keep the inherited IPv4 logic filters or override them and add a new IPv4 logic filter. For
information, see Applying Filters to DHCP Objects on page 1204.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration and click Restart if it appears at the top of the screen.

Note: At any step during the wizard, you can click Schedule for Later to schedule the task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85. You cannot
schedule this task when you are creating an object that is within a delegated scope.

Viewing IPv4 DHCP Objects

To view the address ranges, fixed addresses and reservations in a network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> addr_range.
2. Grid Manager displays the following information:
— IP Address: The IP address of the object in the DHCP range. For exclusion ranges, this displays the start and
end IP addresses. For host records with multiple IP addresses, each IP address is displayed separately. The
appliance highlights disabled DHCP objects in gray. A DHCP object can be a fixed address, reservation, host
configured for DHCP, or roaming host with an allocated IP address.
— Type: The object type, such as Fixed Address.
— Name: The object name. For example, if the IP address belongs to a host record, this field displays the
hostname.
— Fingerprint: The name of the DHCP fingerprint or vendor ID of the network device that was identified through
DHCP fingerprint detection. This field displays No Match for devices that do not have any DHCP fingerprint
information. For information about DHCP fingerprints, see DHCP Fingerprint Detection on page 1357.
— Comment: The information you entered for the object.
— Site: The site to which the object belongs. This is one of the predefined extensible attributes. You can edit
values of inheritable extensible attributes by double clicking on the respective column. If an extensible
attribute has an inherited value, then the cell is highlighted in blue when you perform an inline editing.
You can select Disabled or available extensible attributes for display.
You can also do the following:
• Sort the data in ascending or descending order by column.
• Create a bookmark for the range.
• Delete or schedule the deletion of a selected object or multiple objects in the range.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Select an object and view detailed information.
• Print or export the data.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1135

Managing IPv4 DHCP Data

About Roaming Hosts

A roaming host is a host with a dynamically assigned IP address and a specific set of properties and DHCP options.
When you create a roaming host for a network device, the device can receive any dynamically assigned address from
the network to which it belongs. You can create roaming hosts for devices, such as laptop computers and mobile
phones, that require different IP addresses each time they are moved from one network to another and require a
unique set of DHCP options.
You can configure IPv4 addresses, IPv6 addresses, or IPv4 and IPv6 addresses for roaming hosts that require both
types of addresses. When you configure IPv4 addresses for a roaming host, you must specify the host MAC address
or a DHCP client identifier that the appliance uses to match the host, and specify DHCP options for the host. The
appliance assigns an IP address from the DHCP range associated with the network from which the address request
originates. You can configure an IPv6 prefix or address for a DHCP client. When you do, you must specify the DUID of
the host so the appliance can use the DUID to match the host.
A roaming host also receives DHCP options from the Grid, member, network, or shared network with which it
associates.
When you configure a roaming host, you must configure it in a specific network view. If you have multiple network
views, you must specify the network view to which the requesting hosts belong so the appliance can assign
addresses to the hosts from the networks within the same network view.
After you enable support for roaming hosts at the Grid level, you can add a roaming host that supports IPv4, IPv6, or
both protocols. You can also convert an IPv4 roaming host to an IPv6 roaming host and vice versa, or convert an IPv4
or IPv6 roaming host to one that supports both IPv4 and IPv6.

Configuring Roaming Hosts

To configure a roaming host, perform the following tasks:
1. Enable support for roaming hosts at the Grid level. For information, see, Enabling Support for Roaming Hosts.
2. Add a roaming host.
— To add an IPv4 roaming host, see Adding IPv4 Roaming Hosts
— To add an IPv6 roaming host, seeAdding IPv6 Roaming Hosts
— To add a dual stack roaming host, see Adding IPv4/IPv6 Roaming Hosts
• Optionally, configure DHCP properties for the roaming host. You can override properties set for the upper levels
and enter unique values for the roaming hosts. For information, see Defining IPv4 DHCP Options on page 1082
You can do the following after you configure roaming hosts:
• View the configured roaming hosts.For information, seeViewing Roaming Hosts
• Modify existing roaming hosts. For information, see Setting Properties for Roaming Hosts on page 1139.
• Delete roaming hosts that are not currently in use. For information, see Deleting Roaming Hosts on page 1140.

Enabling Support for Roaming Hosts

You must first enable support for roaming hosts before adding them. After you enable this feature, you can disable it
only after you delete all the existing roaming hosts.
To enable support for roaming hosts:
1. From the Data Management tab, select the DHCP tab.
2. Expand the Toolbar and click Grid DHCP Properties.
3. In the General Advanced tab, select Enable support for roaming host.
4. Save the configuration and click Restart if it appears at the top of the screen.

1136 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Roaming Hosts

Adding IPv4 Roaming Hosts

To add an IPv4 roaming host:
1. From the Data Management tab, select the DHCP tab.
2. Select a network view from the drop-down list.
3. Expand the Toolbar and click Add -> Roaming Host -> IPv4.
4. In the Add Roaming Host wizard, select one of the following and click Next:
— Add Roaming Host
or
— Add Roaming Host using Template
Click Select Template to create a roaming host using a fixed address/reservation template. In the DHCP
Template Selector dialog box, select the template that you want to use. Note that when you use a template
to create a roaming host, the configurations of the template apply to the new host. The appliance
automatically populates the host properties in the wizard. You can then edit the pre-populated properties.
5. Complete the following:
— Name: Enter the name of the roaming host. The name must be unique for each roaming host in a given
network view.
— Assign IPv4 Address by: Select one of the following criteria on which the appliance matches when assigning
an IP address to the host.
— MAC Address: Select this to assign a dynamic IP address to a host, provided that the MAC address of
the requesting host matches the MAC address that you specify here.
— DHCP Client Identifier: Select this to assign a dynamic IP address to a host with the same DHCP client
identifier that you specify here. When you select this, the Match null (\0) at beginning of DHCP client
identifier check box is displayed. Select this when a DHCP client sends a \000 prefixed to the DHCP
client identifier. \0 is the null character. Some DHCP clients (for example, Microsoft) send the client
identifier in a \000foo format (with the null character prefix instead of just foo). The client identifier for
the requesting host and the client identifier stored in the appliance must match.
— Comment: Enter useful information about the roaming host.
— Disabled: Select this if you do not want the DHCP server to use this roaming host definition. When you
disable a roaming host, the host gets an IP address without the defined DHCP options.
6. Click Next to configure the IDHCP options for the roaming host, as described in Defining IPv4 DHCP Options on
page 1082.
7. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
8. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Adding IPv6 Roaming Hosts

To add an IPv6 roaming host:
1. From the Data Management tab, select the DHCP tab.
2. Select a network view from the drop-down list.
3. Expand the Toolbar and click Add -> Roaming Host -> IPv6.
4. In the Add Roaming Host wizard, select one of the following and click Next:
— Add IPv6 Roaming Host
or

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1137

Managing IPv4 DHCP Data

— Add Roaming Host Using IPv6 Template

Click Select IPv6 Template to create a roaming host using an IPv6 fixed address template. In the DHCP
Template Selector dialog box, select the template that you want to use. Note that when you use a template
to create a roaming host, the configurations of the template apply to the new host. The appliance
automatically populates the host properties in the wizard. You can then edit the pre-populated properties.
5. Complete the following:
— Name: Enter the name of the roaming host. The name must be unique for each roaming host in a given
network view.
— DUID: Enter the DHCP unique identifier of the host.
— Comment: Optionally, enter additional information about the roaming host.
— Disabled: Select this if you do not want the DHCP server to use this roaming host definition. When you
disable a roaming host, the host gets an IP address without the defined DHCP options.
6. Click Next to configure the DHCP options for the roaming host, as described in Defining General IPv6 Properties
on page 1089.
7. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
8. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Adding IPv4/IPv6 Roaming Hosts

To add an IPv4/IPv6 roaming host:
1. From the Data Management tab, select the DHCP tab.
2. Select a network view from the drop-down list.
3. Expand the Toolbar and click Add -> Roaming Host -> Both.
4. In the Add Roaming Host wizard, select one of the following and click Next:
— Add Roaming Host
or
— Add Roaming Host using Both IPv4 and IPv6 Templates
When you use both templates to create a roaming host, the appliance applies the IPv4 template and then the
IPv6 template. Therefore, the comments and extensible attributes from the IPv6 template override those from
the IPv4 template.
5. Complete the following:
— Name: Enter the name of the roaming host. The name must be unique for each roaming host in a given
network view.
— Assign IP Address by: Select one of the following criteria on which the appliance matches when assigning
an IP address to the host.
— MAC Address: Select this to assign a dynamic IP address to a host, provided that the MAC address of
the requesting host matches the MAC address that you specify here.
— DHCP Client Identifier: Select this to assign a dynamic IP address to a host with the same DHCP client
identifier that you specify here. When you select this, the Match null (\0) at beginning of DHCP client
identifier check box is displayed. Select this when a DHCP client sends a \000 prefixed to the DHCP
client identifier. \0 is the null character. Some DHCP clients (for example, Microsoft) send the client
identifier in a \000foo format (with the null character prefix instead of just foo). The client identifier for
the requesting host and the client identifier stored in the appliance must match.
— DUID: Specify the DHCP unique identifier of the host.

1138 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Roaming Hosts

— Comment: If both IPv4 and IPv6 templates were used to create the host, this field displays the comment
from the IPv6 template. You can change or add information.
— Disabled: Select this if you do not want the DHCP server to use this roaming host definition. When you
disable a roaming host, the host gets an IP address without the defined DHCP options.
6. Click Next to configure the IPv4 DHCP options for the roaming host, as described in Defining IPv4 DHCP Options
on page 1082.
7. Click Next to configure IPv6 properties described in Defining General IPv6 Properties on page 1089.
8. Click Next to enter values for required extensible attributes or add optional extensible attributes. If both IPv4 and
IPv6 templates were used to create the host, this panel displays the attributes from the IPv6 template. You can
change or add information. For information, see Using Extensible Attributes on page 427.
9. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Viewing Roaming Hosts

To view a list of roaming hosts in a specific network view:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Roaming Hosts.
2. From the Network View drop-down list, select the network view to which the roaming hosts belong.
3. The Grid Manager displays the following for each roaming host:
— Name: The name of the roaming host.
— Address: The IP address of the roaming host.
— Comment: The information that you entered for the roaming host.
— Site: The site to which the template belongs. This is one of the predefined extensible attributes.
You can select Disabled and available extensible attributes for display.
You can also do the following:
• Sort the displayed data in ascending or descending order by column.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.

Setting Properties for Roaming Hosts

You can modify an existing roaming host to add, modify or delete IPv4 or IPv6 addresses, and to set IPv4 and IPv6
DHCP properties.
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Roaming Hosts section -> roaming_host
check box, and then click the Edit icon.
2. The Roaming Host editor contains the following tabs from which you can modify data:
— General: Edit the fields as described in Adding IPv4 Roaming Hosts on page 1137, except for the Templates
field.
— IPv4 DHCP Options: Keep the inherited DHCP options or override them and enter unique settings for the
roaming host. For information, see Defining IPv4 DHCP Options on page 1082.
— IPv6 DHCP Options: Keep the inherited IPv6 DHCP properties or override them. For more information, see
Defining General IPv6 Properties on page 1089.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1139

Managing IPv4 DHCP Data

— Extensible Attributes: Add and delete extensible attributes that are associated with a roaming host. You can
also modify the values of extensible attributes. For information, see Using Extensible Attributes on page
427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify
advanced data.
— IPv4 DDNS: Click Override and select Enable DDNS updates for the DDNS settings you configure in this tab
to take effect. You can specify the following:
— DDNS Domain Name: Specify the domain name that the appliance uses to update DNS.
— DDNS Hostname: Select the Replace the host name dynamically provided by the client/member with
the roaming host name check box to use the name of the roaming host record as the name of the client
for DDNS updates.
For information about DDNS, see Chapter 21, Configuring DDNS Updates, on page 909.
— IPv4 BOOTP/PXE: Keep the inherited PXE and BOOTP properties or override them and enter unique settings
for the roaming host. For information, see Configuring DHCP for IPv4 on page 1109.
— IPv6 DDNS: Click Override and select Enable DDNS Updates for the DDNS settings you configure in this tab
to take effect. You can specify the following:
— DDNS Domain Name: Specify the domain name that the appliance uses to update DNS.
— DDNS Hostname: Select the Replace the host name dynamically provided by the client/member with
the roaming host name check box to use the name of the roaming host record as the name of the client
for DDNS updates.
For information about DDNS, see Chapter 21, Configuring DDNS Updates, on page 909.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration and click Restart if it appears at the top of the screen.
You can also click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting Roaming Hosts

To delete a roaming host:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Roaming Hosts -> roaming_host check box,
and then select Delete or Schedule Delete from the drop-down menu.
2. To delete the roaming host now, in the Delete Confirmation dialog box, click Yes. To schedule the deletion, see
Scheduling Deletions on page 90. The Grid Manager puts the deleted roaming host in the Recycle Bin, if enabled.

1140 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 28 Managing DHCP Templates
This chapter explains how to configure and manage IPv4 and IPv6 DHCP templates. It contains the following sections:
• About DHCP Templates on page 1142
• About IPv4 DHCP Templates on page 1142
— About IPv4 Range Templates on page 1142
— About IPv4 Fixed Address/Reservation Templates on page 1144
— About IPv4 Network Templates on page 1146
— Configuration Example: Creating an IPv4 Network Using a Template on page 1149
• About IPv6 DHCP Templates on page 1151
— About IPv6 Range Templates on page 1151
— About IPv6 Fixed Address Templates on page 1153
— About IPv6 Network Templates on page 1154
• Viewing Templates on page 1157
• Deleting Templates on page 1157

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1141

Managing DHCP Templates

About DHCP Templates

A template contains a set of predefined properties that you use to create IPv4 and IPv6 DHCP objects. It is metadata
that you can modify and reuse. Using a template enables you to create objects in a quick and consistent way. You can
define the object properties once in a template, and then create multiple objects that inherit their properties from the
template. For example, you can create a network template that has a fixed netmask of /24 and extensible attribute
“State” set to California. You can then use the template to create networks in California that contain /24 netmasks.
You can also modify and delete a template. Note that modifying or deleting a template does not affect existing objects
created based on the template. You must be a superuser or have read/write permissions to add, modify, or delete a
template. A superuser can set other admin group privileges on templates. For information, see Administrative
Permissions for IPv4 or IPv6 DHCP Templates on page 259. You can also define extensible attributes for these
templates when you create them. For information, see Using Extensible Attributes on page 427.

About IPv4 DHCP Templates

You can use templates to create DHCP IPv4 ranges, fixed addresses, reservations, roaming hosts, and networks. You
can create the following IPv4 templates:
• A DHCP range template, containing DHCP range settings, such as the total number of IP addresses allocated to a
range. You can add a DHCP range template to a network template. For information, see About IPv4 Range
Templates on page 1142.
• A fixed address/reservation template, containing information for creating fixed addresses, reservations, or
roaming hosts. You can add a fixed address/reservation template to a network template. For information, see
About IPv4 Network Templates on page 1146.
• A network template, containing basic network properties for creating networks. It is also a container that holds
your DHCP range templates and fixed address/reservation templates. When you create a network using a
network template, the network inherits the properties of the range and fixed address/reservation templates.
You can create a network in any network view using a network template. For information, see About IPv4
Network Templates on page 1146.
Because you can potentially add DHCP range and fixed address/reservation templates to a network template, create
the DHCP range and fixed address/reservation templates before you create a network template. For information, see
Configuration Example: Creating an IPv4 Network Using a Template on page 1149.

About IPv4 Range Templates

When you create an IPv4 range template, the start and end address fields are based on the specified offset from the
network start address and the number of IP addresses in the range. After you create a DHCP range template, you can
configure additional properties such as exclusion ranges and DHCP filters, as described in Modifying IPv4 Range
Templates on page 1143. Then when you use the template to create a DHCP range, the range inherits the properties
of the template. You can also include a DHCP range template in a network template to automatically create a DHCP
range when you use that network template.
If you have deployed the Cloud Network Automation license on the Grid Master, you can configure range templates
for cloud delegation. When you select a default Cloud Platform Appliance for a template, all ranges you create using
this template will delegate authority to the same Cloud member. Note that when a Cloud member is removed from
the Grid, the delegation will also be removed from the template. For information about Cloud Network Automation,
see Deploying Cloud Network Automation on page 361.

1142 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Templates

Adding IPv4 Range Templates

To create an IPv4 DHCP range template:
1. From the Data Management tab, select the DHCP tab -> Templates tab, and then expand the Toolbar and click Add
-> Templates -> Range -> IPv4.
2. In the Add IPv4 Range Template wizard, do the following:
— Name: Enter a name that helps identify the DHCP range template. For example, enter Region 1 IT if you want
to use this template to create DHCP ranges for the IT department in Region 1.
— Offset: An offset in a DHCP range template determines the starting IP address of the range. The appliance
adds the offset value you enter here to the start IP address of the network in which you create a DHCP range
using this template. That IP address becomes the start IP address of the DHCP range. For example, you
specify an offset value of 25 for a 25.0.0.0/8 network using the DHCP range template, the appliance creates
a DHCP range with the start IP address of 25.0.0.25 in the network.
— Number of Addresses: Enter the total number of IP addresses to be included in the DHCP range.
— Comment: Enter useful information about the template.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. To configure this template for cloud
delegation, complete the following:
Use for cloud delegation: Select this check box to enable cloud delegation for this template.
Delegate authority from the Grid Master
— Delegate To: In a non-cloud API request, this parameter defines the default member to which authority is
delegated. In a cloud API request, the appliance ignores this parameter, which allows you to use this
template to create an object on different Cloud Platform Appliances. Click Select to choose the default
Cloud Platform Appliance to which you want to delegate authority. The Member Selector displays only Cloud
Platform Appliances in the Grid. Click the member, and Grid Manager displays the member name next to
this field.
3. Click Next and select one of the following to provide DHCP services for the range:
— None (Reserved Range): Select this if you want to reserve this address range for static hosts. Addresses in
this range cannot be allocated as dynamic addresses. You can allocate the next available IP from this range
to a static host. This is selected by default.
— Grid Member: Click Select and choose a Grid member from the drop-down list.
— Failover Association: Click Select and choose a failover association. Only failover associations that provide
DHCP services in the network view of the DHCP range appear in the drop-down list.
— Microsoft DHCP Server: Click Select and choose a Microsoft server from the drop-down list. The drop-down
list displays only the servers that are associated with the network to which the DHCP range belongs.
4. Click Next to configure or override DHCP options as described in Defining IPv4 DHCP Options on page 1082.
5. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
6. Save the configuration and click Restart if it appears at the top of the screen.

Modifying IPv4 Range Templates

After you use the wizard to create an IPv4 DHCP range template, you can set additional properties for the template.
Following are some guidelines:
• In the DHCP Options tab of a DHCP range template, the broadcast address is an address offset number rather
than a broadcast IP address; network router addresses are offset numbers as well.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1143

Managing DHCP Templates

An offset in a DHCP range template indicates the starting IP address of the DHCP range object created from the
template. For example, you can create a network template called test_network_template and a DHCP range
template test_range_template linked to this network template. If the test_range_template has an offset value
10, when you create a 10.0.0.0/8 network using the test_network_template, the appliance creates a DHCP
range with the starting IP address 10.0.0.10. If you create a 20.0.0.0/8 network using the
test_network_template, the appliance creates a DHCP range with the starting IP address 20.0.0.10
• For the exclusion range in the template, the start and end addresses are determined by the number of offsets in
the DHCP range template's start address and the number of IP addresses in the exclusion range. For more
information about exclusion ranges, see About DHCP Ranges on page 1056.
To modify and set properties for a DHCP range template:
1. From the Data Management tab, select the DHCP tab -> Templates tab -> template check box, and then click the
Edit icon.
2. The DHCP Range Template editor contains the following tabs from which you can modify data:
— General: Modify general information described in Adding IPv4 Range Templates on page 1143.
— Member Assignment: Change the Grid member, failover association, or Microsoft server that provides DHCP
services for this template. You can also add or delete a member or failover association. For information, see
Adding IPv4 Address Ranges on page 1122.
— IPv4 DHCP Options: Keep the inherited DHCP options or override them and enter unique settings for the
template. For information, see Defining IPv4 DHCP Options on page 1082.
— Extensible Attributes: Add and delete extensible attributes that are associated with this template. You can
also modify the values of the extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see About
Administrative Permissions on page 195.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify data:
— IPv4 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the template.
For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915.
— IPv4 BOOTP/PXE: Keep the inherited BOOTP properties or override them and enter unique settings for the
template. For information, see Configuring IPv4 BOOTP and PXE Properties on page 1076.
— Exclusion Ranges: Configure a range of IP addresses that the appliance does not use for dynamic address
assignments. Complete the following:
— Offset: An offset for an exclusion range determines the start IP address of the exclusion range. The
appliance adds the offset value you enter here to the start IP address of the DHCP range created using
this template. That IP address becomes the start IP address of the exclusion range.
— Number of Addresses: Enter the number of IP addresses to be included in the exclusion range.
— Comment: Enter useful information about the exclusion range.
— IPv4 DHCP Thresholds: Keep the inherited thresholds settings or override them and enter unique settings
for the template. For information, see Configuring Thresholds for DHCP Ranges on page 1087.
4. Save the configuration and click Restart if it appears at the top of the screen.

Note: Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.

About IPv4 Fixed Address/Reservation Templates

You can use an IPv4 fixed address/reservation template to create fixed addresses, reservations and roaming hosts.
When you create an IPv4 fixed address/reservation template, you can specify an offset and number of addresses.
This is used when you include the template in a network template. When you include a fixed address/reservation
template in a network template, the DHCP server automatically creates reservations based on the offset and number
of addresses you specified in the fixed/address reservation template. It does not create fixed addresses.

1144 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Templates

After you create a fixed address/reservation template using the wizard, you can configure additional properties as
described in Modifying IPv4 Fixed Address/Reservation Templates on page 1145. Then when you use the template
to create a fixed address, it inherits the properties of the template.
If you have deployed the Cloud Network Automation license on the Grid Master, you can configure fixed address
templates for cloud delegation. When you configure a template for cloud delegation, all fixed addresses you create
using this template will inherit authority delegations from their parent objects. For information about Cloud Network
Automation, see Deploying Cloud Network Automation on page 361.

Adding IPv4 Fixed Address/Reservation Templates

To create an IPv4 fixed address/reservation template:
1. From the Data Management tab, select the DHCP tab -> Templates section.
2. Click the Add drop-down list and select IPv4 Fixed Address/Reservation Template.
3. In the Add IPv4 Fixed Address/Reservation Template wizard, enter the following:
— Name: Enter a name that helps identify the fixed address/reservation template. For example, you can enter
HP Printer when you create a template that contains settings for assigning fixed addresses or reservations
to HP printers.
— Comment: Optionally, enter additional information about the template.
— Use for cloud delegation: When you select this check box, all fixed addresses you create using this template
inherit authority delegation from their parent objects.
In the Optional Settings For Range of Objects section, do the following:
— Offset: An offset in a fixed address/reservation template determines the start IP address of the object
created from the template. The appliance adds the offset value you enter here to the start IP address of the
network in which you create objects using this template. That IP address becomes the start IP address of
the object.
— Number of Addresses: Enter the number of IP addresses to be used as fixed addresses, reservations, or
roaming hosts.

Note: The appliance uses the offset and number of addresses only when this template is used in a network
template.

4. Click Next to configure or override DHCP options as described in Defining IPv4 DHCP Options on page 1082.
5. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
6. Save the configuration and click Restart if it appears at the top of the screen.

Modifying IPv4 Fixed Address/Reservation Templates

To modify a fixed address/reservation template:
1. From the Data Management tab, select the DHCP tab -> Templates tab -> template check box, and then click the
Edit icon.
2. The Fixed Address/Reservation Template editor contains the following tabs from which you can modify data:
— General: Modify general information for the template as described in Adding IPv4 Fixed
Address/Reservation Templates on page 1145.
— IPv4 DHCP Options: Keep the inherited DHCP options or override them and enter unique settings for the
template. For information, see Defining IPv4 DHCP Options on page 1082.
— Extensible Attributes: Add and delete extensible attributes that are associated with the template. You can
also modify the values of the extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see About
Administrative Permissions on page 195.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1145

Managing DHCP Templates

3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify data:
— IPv4 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the template.
For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915.
— IPv4 Filters: You can keep the inherited IPv4 logic filters or override them and add a new IPv4 logic filter for
the template. For information, see Applying Filters to DHCP Objects on page 1204.
— IPv4 BOOTP/PXE: Keep the inherited BOOTP properties or override them and enter unique settings for the
template. For information, see Configuring IPv4 BOOTP and PXE Properties on page 1076.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration and click Restart if it appears at the top of the screen.

About IPv4 Network Templates

You can create IPv4 network templates to facilitate network configuration. You can use network templates to create
networks in any network view. When you create a network template, you do not specify a network address. You enter
the network address when you create an actual network from the template. You can specify a netmask or allow the
user to define the netmask when they create the actual network.
A network template is useful for setting up a network with fixed addresses and DHCP ranges already defined. You can
add DHCP range or fixed address/reservation templates to a network template. Once the fixed address and DHCP
range information is set up, the network template contains a range template list and a fixed address/reservation
template list.
When you enable support for RIR updates, you can create IPv4 network templates specific for RIR associated
networks. For information about RIR updates, see RIR Registration Updates on page 555.
If you have deployed the Cloud Network Automation on the Grid Master, you can configure network templates for
cloud delegation. When you select a default Cloud Platform Appliance for a template, all networks you create using
this template will delegate authority to the same Cloud member. If you want to associate any range or fixed address
templates with a network template, ensure that you enable “User for cloud delegation” for the network, range, and
fixed address templates. Note that when a Cloud member is removed from the Grid, the delegation will also be
removed from the template. For information about Cloud Network Automation, see Deploying Cloud Network
Automation on page 361.

Adding IPv4 Network Templates

To create a network template:
1. From the Data Management tab, select the DHCP tab -> Templates section.
2. Click the Add drop-down list and select IPv4 Network Template.
3. In the Add IPv4 Network Template wizard, do the following:
— Regional Internet Registry: This section appears only when support for RIR updates is enabled. For
information about RIR, see RIR Registration Updates on page 555. Complete the following to create a
network template for an RIR IPv4 network container or network:
— Internet Registry: Select the RIR from the drop-down list. The default is RIPE. When you select None, the
network is not associated with an RIR organization.
— Organization ID: Click Select Organization and select an organization from the RIR Organization
Selector dialog box.
— Registration Status: The default is Not Registered. When using this template to add an RIR allocated
network, you can change this to Registered and select the Do not update registrations check box below.
Note that when you select API as the communication method, the registration status will be updated
automatically after the registration update is completed. However, when you select Email as the
communication method, the registration status will not be automatically updated. If you are creating a
new network and the registration update is completed successfully, the status will be changed to
Registered. If the update fails, the status will be changed to Not Registered.

1146 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Templates

— Registration Action: Select the registration action from the drop-down list. When you select Create, the
appliance creates the IPv4 network and assigns it to the selected organization. When you select None,
the appliance does not send registration updates to RIPE. When you use this template to add an
existing RIR allocated network to NIOS, select None. When you use this template to add networks to an
RIR allocated network (a parent network), select Create. Ensure that the parent network associated with
an RIR organization already exists.
— Do not update registrations: Select this check box if you do not want the appliance to submit RIR
updates to RIPE. By default, the appliance sends updates to the RIR database based on the configured
communication method.
— Name: Enter a name that helps identify the network template. For example, you can enter Class C if you
want to configure the template for creating Class C networks.
— Netmask: Select one of the following options:
— Fixed: Select this and adjust the netmask slider to a fixed netmask for this network template. When you
select this option, users cannot specify another netmask when they use this template to create a
network. For example, if you select /24 as the fixed netmask, all networks created using this template
have a /24 netmask.
— Allow User to Specify Netmask: Select this to allow users to specify the subnet mask when creating
networks using this template.
— Comment: Optionally, enter additional information about the template.
— Automatically Create Reverse-Mapping Zone: This function is enabled if the fixed netmask of the template
equals /8, /16, and /24, or if you select the Allow User to Specify Netmask option. Select this if you want
the appliance to automatically create the corresponding reverse-mapping zone for the networks created
using this template. A reverse-mapping zone is an area of network space for which one or more name
servers have the responsibility for responding to address-to-name queries. These zones are created in the
DNS view assigned to receive dynamic DNS updates at the network level.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. To configure this template for cloud
delegation, complete the following:
Use for cloud delegation: Select this check box to enable cloud delegation for this template.

Note: When you select this for the network template, all range and fixed address templates that you want to
associate with this network template must also be enabled for “Use for cloud delegation.”

Delegate authority from the Grid Master

— Delegate To: In a non-cloud API request, this parameter defines the default member to which authority is
delegated. In a cloud API request, the appliance ignores this parameter, which allows you to use this
template to create an object on different Cloud Platform Appliances. Click Select to choose the default
Cloud Platform Appliance to which you want to delegate authority. The Member Selector displays only Cloud
Platform Appliances in the Grid. Click the member, and Grid Manager displays the member name next to
this field.
4. Click Next and do the following to assign either Grid members or Microsoft DHCP servers to this network
template. Ensure that you include members or Microsoft servers that are associated with other templates that
you plan to add to this network template. You can assign one or multiple members to this template. However, you
cannot assign a combination of NIOS Grid members and vNIOS Grid members to the template. You can also
assign multiple Microsoft servers to a template, but you cannot assign a mix of Microsoft servers and Grid
members to a template.
— click the Add icon and select one of the following options:
— Add Infoblox Member: Select this option to add a Grid member as a DHCP server for the networks
created using this template. Select the Grid member from the Member Selector dialog box. Keep in
mind, DHCP properties for the network are inherited from this member. Networks created using this
template can be served by multiple members, but a member can serve networks in one network view
only.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1147

Managing DHCP Templates

or
— Add Microsoft Server: Select this option to add a Microsoft server as a DHCP server for the networks
created using this template. Select the Microsoft server from the Microsoft Server Selector dialog box.
5. Click Next to associate Active Directory Sites with the network. For more information, see Associating Active
Directory Sites with Networks on page 1272.
6. Click Next and do the following to include IPv4 address range and fixed address/reservation templates in the
network template. Note that when you select a fixed address/reservation template, only reservations, not fixed
addresses, are created for networks created using this template. You cannot add a fixed address/reservation
template that does not contain an offset value or a total number of IP addresses for a range.
a. Click the Add icon.
b. In the DHCP Template Selector dialog box, choose the template that you want to include in this network
template. You can choose a DHCP range or fixed address/reservation template. Use SHIFT+click and
CTRL+click to select multiple templates.
c. Click the Select icon.
You can delete a template from the table by selecting it and clicking the Delete icon.
7. Click Next to configure or override DHCP options as described in Defining IPv4 DHCP Options on page 1082.
8. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
If you are adding an RIR network, the RIR network attribute table appears. For information about these attributes
and how to enter them, see RIR Network Attributes on page 565.
9. Save the configuration and click Restart if it appears at the top of the screen.

Modifying IPv4 Network Templates

To modify a network template:
1. From the Data Management tab, select the DHCP tab -> Templates tab -> template check box, and then click the
Edit icon.
2. The IPv4 Network Template editor contains the following tabs from which you can modify data:
— General: Modify general information described in Adding IPv4 Network Templates on page 1146.
— Member Assignment: Change the Microsoft servers or Grid members that provide DHCP services for this
template. For information, see Adding IPv4 Networks on page 1111.
— Templates: Add or delete DHCP range and fixed address/reservation templates. For information, see About
IPv4 Range Templates on page 1142 and About IPv4 Fixed Address/Reservation Templates on page 1144.
— IPv4 DHCP Options: Keep the inherited DHCP options or override them and enter unique settings for the
template. For information, see Defining IPv4 DHCP Options on page 1082.
— RIR Registration: Modify RIR network information. This tab appears only when support for RIR updates is
enabled. For information, see Modifying RIR Network Data on page 561.
— Extensible Attributes: Add and delete extensible attributes that are associated with the template. You can
also modify the values of the extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify data:
— IPv4 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the template.
For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915.
— IPv4 BOOTP/PXE: Keep the inherited BOOTP properties or override them and enter unique settings for the
template. For information, see Configuring IPv4 BOOTP and PXE Properties on page 1076.
— IPv4 Filters: You can keep the inherited IPv4 logic filters or override them and add a new IPv4 logic filter for
the template. For information, see Applying Filters to DHCP Objects on page 1204.

1148 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Templates

— IPv4 DHCP Thresholds: Keep the inherited thresholds settings or override them and enter unique settings
for the template. For information, see Configuring Thresholds for DHCP Ranges on page 1087.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration and click Restart if it appears at the top of the screen.

Configuration Example: Creating an IPv4 Network Using a Template

This example describes how to create a /24 network template and how to use the template to create a 192.168.2/24
network with the following configurations:
• First address 192.168.2.1 is reserved for the router
• Next 10 addresses (192.168.2.2 to 192.168.2.11) reserved for servers
• Next 10 addresses (192.168.2.12 to 192.168.2.21) reserved for printers
• Next 10 addresses (192.168.2.22 to 192.168.2.31) assigned as fixed addresses
• 100 addresses (192.168.2.32 to 192.168.2.131) reserved for workstations. The appliance assigns these
dynamically.
• 10 addresses (192.168.2.42 to 192.168.2.51) are in an exclusion range. If you assigned static addresses to
certain hosts in the middle of an address range template, you can exclude the addresses from the address
range template so the appliance does not assign these IP addresses to clients.
Figure 28.1 illustrates the configurations of the 192.168.2/24 network using the network template you create:

Figure 28.1 Creating a Network Using a Template

192.168.2.0 /24
Network

192.132.7.9

Workstations
Router Servers Printers Fixed
Exclusion
Addresses
Range

192.168.2.1 192.168.2.1 to 192.168.2.12 to 192.168.2.22 to 192.168.2.32 to 192.168.2.42 to

192.168.2.11 192.168.2.21 192.168.2.31 192.168.2.131 192.168.2.51

Use the following steps to create the sample network template (shown in Figure 28.1).
1. Create the following DHCP range templates. For information, see Adding IPv4 Range Templates on page 1143.
— Server template with the following values:
— Name: Servers
— Offset: 2
— Number of Addresses: 10
— Comment: Address range 2 to 11 for Servers
— Printer template with the following values:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1149

Managing DHCP Templates

— Name: Printers
— Offset: 12
— Number of Addresses: 10
— Comment: Address range 12 to 21 for printers.
— Workstation template with the following values:
— Name: Workstations
— Offset: 32
— Number of Addresses: 100
— Comment: Address range 32 to 131 for DHCP on workstations
— Exclusion range with the following values. You must modify the Workstations template to add the exclusion
range. For information, see Modifying IPv4 Range Templates on page 1143.
— Name: Exclusion
— Offset: 42
— Number of Addresses: 10
— Comment: Excluding addresses 42 to 51 from the DHCP range 32 to 131.
2. Create a fixed address/reservation template with the following values. For information, see Adding IPv4 Fixed
Address/Reservation Templates on page 1145.
— Name: Router
— Comment: Fixed address template
— Offset: 1
— Number of Addresses: 1
3. Create a fixed address/reservation template with the following values. For information, see Adding IPv4 Fixed
Address/Reservation Templates on page 1145.
— Name: myFixedAddress
— Comment: Fixed address template
— Offset: 22
— Number of Addresses: 10
4. Create a network template with the following values. For information, see Adding IPv4 Network Templates on
page 1146.
— Name: myNetworkTemplate
— Netmask: Select /24 as the fixed subnet mask for the network
— Comment: Network template for /24 network
— Automatically create a reverse-mapping zone: Select this so that the NIOS appliance automatically creates
the corresponding reverse-mapping zone for the network.
5. Add the DHCP range templates Servers, Printers, and Workstations to the network template.
6. Add the fixed address/reservation template myFixedAddress to the network template.
7. Add a fixed address with the following values:
8. Create a network using the network template myNetworkTemplate with the following values. For information, see
Adding IPv4 Networks on page 1111.
— Address: Enter the IP address 192.168.2.0 of the network that you want to create using the template.
— Select template: Select the network template myNetworkTemplate.
9. To verify your configuration, from the Data Management tab, select the DHCP tab -> Templates tab. Select
myNetworkTemplate and click the Edit icon. In the Network Template editor, click the Templates tab. The Grid
Manager displays the DHCP range templates and fixed address templates.
10. Click Restart to restart services.

1150 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv6 DHCP Templates

About IPv6 DHCP Templates

You can use templates to create DHCP IPv6 ranges, fixed addresses, roaming hosts, and networks. You can create the
following IPv6 templates:
• A DHCP range template that specifies an offset and the total number of addresses in a range. You can add a
DHCP range template to a network template. For more information, see About IPv6 Range Templates on page
1151.
• A fixed address template, containing information for creating fixed addresses and roaming hosts. You can add a
fixed address template to a network template. For information, see About IPv6 Fixed Address Templates on
page 1153.
• A network template, containing basic network properties for creating networks. It is also a container that holds
your DHCP range templates and fixed address/reservation templates. When you create a network using a
network template, the network inherits the properties of the range and fixed address/reservation templates.
You can create a network in any network view using a network template. For information, see Adding IPv6
Network Templates on page 1154.
Because you can potentially add DHCP range and fixed address/reservation templates to a network template, create
the DHCP range and fixed address/reservation templates before you create a network template.

About IPv6 Range Templates

You can create range templates to specify an offset and the number of addresses allocated to a range. Note that you
cannot create templates for prefix-delegated ranges because the start or end prefix can be outside of the subnet
address boundary.
After you create a DHCP range template, you can configure additional properties such as exclusion ranges and DHCP
properties, as described in Modifying IPv6 Range Templates on page 1152. Then when you use the template to create
a DHCP range, the range inherits the properties of the template. You can also include a DHCP range template in a
network template to automatically create a DHCP range when you use that network template.
If you have deployed the Cloud Network Automation license on the Grid Master, you can configure range templates
for cloud delegation. If you select a default Cloud Platform Appliance for a template, all ranges you create using this
template will delegate authority to the same Cloud member. Note that when a Cloud member is removed from the
Grid, the delegation will also be removed from the template. For information about Cloud Network Automation, see
Deploying Cloud Network Automation on page 361.

Adding IPv6 Range Templates

To create an IPv6 range template:
1. From the Data Management tab, select the DHCP tab -> Templates tab.
2. Click the Add drop-down menu and select IPv6 DHCP Range Template.
3. In the Add IPv6 Range Template wizard, complete the following:
— Name: Enter a name that helps identify the IPv6 DHCP range template.
— Offset: An offset in a DHCP range template determines the starting IP address of the range. The appliance
adds the offset value you enter here to the start IP address of the network in which you create a DHCP range
using this template. That IP address becomes the start IP address of the DHCP range. For example, you
specify an offset value of 10 for the 2001:db8:1263:/48 network using the DHCP range template, the
appliance creates a range with the start address 2001:db8:1263:0:0:0:0:a.
— Number of Addresses: Enter the total number of IPv6 addresses to be included in the DHCP range.
— Comment: Optionally, enter additional information about the template.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1151

Managing DHCP Templates

The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. To configure this template for cloud
delegation, complete the following:
Use for cloud delegation: Select this check box to enable cloud delegation for this template.
Delegate authority from the Grid Master
— Delegate To: In a non-cloud API request, this parameter defines the default member to which authority is
delegated. In a cloud API request, the appliance ignores this parameter, which allows you to use this
template to create an object on different Cloud Platform Appliances. Click Select to choose the default
Cloud Platform Appliance to which you want to delegate authority. The Member Selector displays only Cloud
Platform Appliances in the Grid. Click the member, and Grid Manager displays the member name next to
this field.
4. Click Next and select one of the following to provide DHCP services for the range:
— None (Reserved Range): Select this if you want to reserve this address range for static hosts. Addresses in
this range cannot be allocated as dynamic addresses. You can allocate the next available IP from this range
to a static host. This is selected by default.
— Grid Member: Click Select and choose a Grid member from the drop-down list.
5. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
6. Save the configuration.

Modifying IPv6 Range Templates

You can modify the properties of a DHCP range template and define an exclusion range. For the exclusion range in the
template, the start and end addresses are determined by the number of offsets in the DHCP range template's start
address and the number of IP addresses in the exclusion range. For more information about exclusion ranges, see
About DHCP Ranges on page 1056.
To modify a DHCP range:
1. From the Data Management tab, select the DHCP tab -> Templates tab -> template check box, and then click the
Edit icon.
2. The IPv6 DHCP Range Template editor contains the following tabs from which you can modify data:
— General: Modify general information as described in Adding IPv6 Range Templates.
— Member Assignment: Change the Grid member that provides DHCP services for ranges created from this
template. For information, see Adding IPv6 Range Templates.
— Extensible Attributes: Add and delete extensible attributes that are associated with this template. You can
also modify the values of the extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see About
Administrative Permissions on page 195.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify data:
— Exclusion Ranges: Configure a range of IP addresses that the appliance does not use for dynamic address
assignments. Exclusion Ranges: Configure a range of IP addresses that the appliance does not use for
dynamic address assignments. Complete the following:
— Offset: An offset for an exclusion range determines the start IP address of the exclusion range. The
appliance adds the offset value you enter here to the start IP address of the DHCP range created using
this template. That IP address becomes the start IP address of the exclusion range.
— Number of Addresses: Enter the number of IP addresses to be included in the exclusion range.
— Comment: Enter useful information about the exclusion range.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration.

1152 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv6 Fixed Address Templates

About IPv6 Fixed Address Templates

A fixed address template is useful when you want to create multiple fixed addresses in a network. When you create
a fixed address template, you specify the offset value and number of fixed addresses to be created. You can also
specify additional properties for the fixed addresses.
Note that you can use the template to create address-based fixed addresses. You cannot specify prefixes in the
template because a fixed address could use a prefix that is not part of the subnet to which the fixed address belongs.
You can enter prefixes when you create the individual fixed address objects using the template.
If you have deployed the Cloud Network Automation license on the Grid Master, you can configure fixed address
templates for cloud delegation. When you configure a template for cloud delegation, all fixed addresses you create
using this template will inherit authority delegations from their parent objects. For information about Cloud Network
Automation, see Deploying Cloud Network Automation on page 361.

Adding IPv6 Fixed Address Templates

To create an IPv6 fixed address template:
1. From the Data Management tab, select the DHCP tab -> Templates tab.
2. Click the Add drop-down menu and select IPv6 Fixed Address Template.
3. In the Add IPv6 Fixed Address Template wizard, enter the following:
— Name: Enter a name that helps identify the IPv6 fixed address template. For example, you can enter HP
Printer when you create a template that contains settings for assigning fixed addresses or reservations to
HP printers.
— Comment: Optionally, enter additional information about the template.
— Use for cloud delegation: When you select this check box, all fixed addresses you create using this template
inherit authority delegation from their parent objects.
In the Optional Settings For Range of Objects section, do the following:
— Offset: An offset in a fixed address template determines the IP address of the first fixed address created
from the template. The appliance adds the offset value you enter here to the start IP address of the network
in which you create objects using this template, and that IP address becomes the IP address of the object.
For example, you specify an offset value of 50 for the 2001:db8:1263:/48 network, when you create a fixed
address using the fixed address template, the appliance assigns it the address 2001:db8:1263:0:0:0:0:32.
— Number of Addresses: Enter the number of IP addresses to be used as fixed addresses or roaming hosts.

Note: The appliance uses the offset and number of addresses only when this template is used in a network
template.

4. Click Next to configure or override DHCP options as described in Configuring DHCP Properties on page 1069.
5. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
6. Save the configuration.

Modifying IPv6 Fixed Address Templates

To modify a fixed address template:
1. From the Data Management tab, select the DHCP tab -> Templates tab -> template check box, and then click the
Edit icon.
2. The IPv6 Fixed Address Template editor contains the following tabs from which you can modify data:
— General: Modify general information for the template as described in Adding IPv6 Fixed Address Templates
on page 1153.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1153

Managing DHCP Templates

— IPv6 DHCP Options: Keep the inherited DHCP options or override them and enter unique settings for the
template. For information, see Defining General IPv6 Properties on page 1089.
— Extensible Attributes: Add and delete extensible attributes that are associated with the template. You can
also modify the values of the extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see About
Administrative Permissions on page 195.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify data:
— IPv6 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the template.
For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration.

About IPv6 Network Templates

You can create IPv6 network templates to facilitate network configuration. You can use network templates to create
networks in any network view. When you create a network template, you do not specify a network address. You enter
the network address when you create an actual network from the template. You can specify a netmask or allow the
user to define the netmask when they create the actual network.
A network template is useful for setting up a network with fixed addresses and DHCP ranges already defined. You can
add DHCP range or fixed address templates to a network template.
When you enable support for RIR updates, you can create IPv6 network templates specific for RIR associated
networks. For information about RIR updates, see RIR Registration Updates on page 555.
You can also configure network templates for cloud delegation if you have deployed the Cloud Network Automation
on the Grid Master. If you select a default Cloud Platform Appliance for a template, all networks you create using this
template will delegate authority to the same Cloud member. Note that when a Cloud member is removed from the
Grid, the delegation will also be removed from the template. For information about Cloud Network Automation, see
Deploying Cloud Network Automation on page 361.

Adding IPv6 Network Templates

To create a network template:
1. From the Data Management tab, select the DHCP tab -> Templates tab.
2. Click the Add drop-down menu and select IPv6 Network Template.
3. In the Add IPv6 Network Template wizard, do the following:
— Regional Internet Registry: This section appears only when support for RIR updates is enabled. For
information about RIR, see RIR Registration Updates on page 555. Complete the following to create a
network template for an RIR IPv6 network container or network:
— Internet Registry: Select the RIR from the drop-down list. The default is RIPE. When you select None, the
network is not associated with an RIR organization.
— Organization ID: Click Select Organization and select an organization from the RIR Organization
Selector dialog box.
— Registration Status: The default is Not Registered. When using this template to add an RIR allocated
network, you can change this to Registered and select the Do not update registrations check box below.
Note that when you select API as the communication method, the registration status will be updated
automatically after the registration update is completed. However, when you select Email as the
communication method, the registration status will not be automatically updated. If you are creating a
new network and the registration update is completed successfully, the status will be changed to
Registered. If the update fails, the status will be changed to Not Registered.

1154 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv6 Network Templates

— Registration Action: Select the registration action from the drop-down list. When you select Create, the
appliance creates the IPv4 network and assigns it to the selected organization. When you select None,
the appliance does not send registration updates to RIPE. When you use this template to add an
existing RIR allocated network to NIOS, select None. When you use this template to add networks to an
RIR allocated network (a parent network), select Create. Ensure that the parent network associated with
an RIR organization already exists.
— Do not update registrations: Select this check box if you do not want the appliance to submit RIR
updates to RIPE. By default, the appliance sends updates to the RIR database based on the configured
communication method.
— IPv6 Prefix: If you are adding a template for a previously defined global IPv6 prefix, you can select it from
the list.
— Name: Enter a name that helps identify the network template.
— Netmask: Select one of the following options:
— Fixed: Select this and adjust the netmask slider to a fixed netmask for this network template. When you
select this option, users cannot specify another netmask when they use this template to create a
network. For example, if you select /24 as the fixed netmask, all networks created using this template
have a /24 netmask.
— Allow User to Specify Netmask: Select this to allow users to specify the subnet mask when creating
networks using this template.
— Comment: Enter useful information about the template.
— Automatically create a reverse-mapping zone: This function is enabled if the fixed netmask of the template
is a multiple of 4 (4, 8, 24, and so on), or if you select the Allow User to Specify Netmask option. Select this
if you want the appliance to automatically create the corresponding reverse-mapping zone for the networks
created using this template. These zones are created in the DNS view assigned to receive dynamic DNS
updates at the network level.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. To configure this template for cloud
delegation, complete the following:
Use for cloud delegation: Select this check box to enable cloud delegation for this template.
Delegate authority from the Grid Master
— Delegate To: In a non-cloud API request, this parameter defines the default member to which authority is
delegated. In a cloud API request, the appliance ignores this parameter, which allows you to use this
template to create an object on different Cloud Platform Appliances. Click Select to choose the default
Cloud Platform Appliance to which you want to delegate authority. The Member Selector displays only Cloud
Platform Appliances in the Grid. Click the member, and Grid Manager displays the member name next to
this field.
4. Click Next to associate Active Directory Sites with the network. For more information, see Associating Active
Directory Sites with Networks on page 1272.
5. Click Next to assign Grid members to this network template. Ensure that you include members that are
associated with other templates that you plan to add to this network template. You can assign one or multiple
members to this template. However, you cannot assign a combination of NIOS Grid members and vNIOS Grid
members to the template.
— Click the Add icon to add a Grid member as a DHCP server for the networks created using this template.
Select the Grid member from the Member Selector dialog box. Keep in mind, DHCP properties for the
network are inherited from this member. Networks created using this template can be served by multiple
members, but a member can serve networks in one network view only.
6. Click Next, and then click the Add icon to include DHCP range and fixed address templates in the network
template. Choose the template that you want to include in this network template. Use SHIFT+click and CTRL+click
to select multiple templates.
You can remove a template from the list by selecting the template and clicking the Delete icon.
7. Click Next to configure or override DHCP options as described in Defining General IPv6 Properties on page 1089.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1155

Managing DHCP Templates

8. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
If you are adding an RIR network, the RIR network attribute table appears. For information about these attributes
and how to enter them, see RIR Network Attributes on page 565.
9. Save the configuration.

Modifying IPv6 Network Templates

To modify and set the properties of a network template:
1. From the Data Management tab, select the DHCP tab -> Templates tab -> template check box, and then click the
Edit icon.
2. The Network Template editor contains the following tabs from which you can modify data:
— General: Modify general information described in Adding IPv6 Network Templates on page 1154.
— Member Assignment: Change the Grid members that provide DHCP services for networks created from this
template. For information, see Adding IPv6 Networks on page 1161.
— Templates: Add or delete DHCP range and fixed address templates. For information, see Adding IPv6 Range
Templates on page 1151 and Adding IPv6 Fixed Address Templates on page 1153
— IPv6 DHCP Options: Keep the inherited DHCP options or override them and enter unique settings for the
template. For information, see Defining General IPv6 Properties on page 1089.
— RIR Registration: Modify RIR network information. This tab appears only when support for RIR updates is
enabled. For information, see Modifying RIR Network Data on page 561.
— Extensible Attributes: Add and delete extensible attributes that are associated with the template. You can
also modify the values of the extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify data:
— IPv6 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the template.
For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration.

1156 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Templates

Viewing Templates
To view a list of all IPv4 and IPv6 DHCP templates:
1. From the Data Management tab, select the DHCP tab -> Templates tab.
2. Grid Manager displays the following information:
— Name: The name of the template.
— Type: The template type, such as IPv4 Network Template or IPv6 Network Template.
— Comment: The information you entered about the template.
— Site: The site to which the template belongs. This is one of the predefined extensible attributes.
You can select predefined and user defined extensible attributes for display.
You can also do the following in this panel:
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Sort the displayed data in ascending or descending order by column.
• Delete a selected template or multiple templates. For information, see Deleting Templates.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Select an object and edit its information.
• Print or export the data in the panel.

Deleting Templates
To delete a template:
1. From the Data Management tab, select the DHCP tab -> Templates tab -> template check box, and then click the
Delete icon.
2. In the Delete Confirmation dialog box, click Yes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1157

Managing DHCP Templates

1158 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 29 Managing IPv6 DHCP Data
This chapter explains how to configure and manage IPv6 DHCP data. It contains the following sections:
• Configuring IPv6 Networks on page 1160
• Defining Global IPv6 Prefixes on page 1160
• Managing IPv6 Networks on page 1161
— Adding IPv6 Networks on page 1161
— Modifying IPv6 Networks on page 1165
— Deleting IPv6 Networks on page 1166
• About IPv6 Shared Networks on page 1166
— Adding IPv6 Shared Networks on page 1166
— Modifying IPv6 Shared Networks on page 1167
— Deleting IPv6 Shared Networks on page 1167
• Configuring IPv6 Address Ranges on page 1168
— Adding IPv6 Address Ranges on page 1168
— Setting the Priority of IPv6 Address Ranges on page 1169
— Modifying IPv6 Address Ranges on page 1169
— Deleting IPv6 Address Ranges on page 1170
• Configuring IPv6 Fixed Addresses on page 1171
— Adding IPv6 Fixed Addresses on page 1171
— Modifying IPv6 Fixed Addresses on page 1174
— Deleting IPv6 Fixed Addresses on page 1175
• Viewing IPv6 DHCP Objects on page 1175

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1159

Managing IPv6 DHCP Data

Configuring IPv6 Networks

To configure DHCP services for an IPv6 network and the resources in the network, perform the following tasks:
1. To facilitate network creation, you can specify the IPv6 global prefixes for the Grid. For more information, see
Defining Global IPv6 Prefixes.
2. Create a network and assign it to Grid members. For information, see Managing IPv6 Networks on page 1161 and
About IPv6 Shared Networks on page 1166.
3. Optionally, configure DHCP properties for the network. You can override properties set at the Grid or member
level and enter unique values for the network and fixed addresses. For information, see Configuring DHCPv6
Properties on page 1089 and Configuring DHCP IPv4 and IPv6 Common Properties on page 1092.
4. Optionally, assign zones to a network. For information, see Associating Networks with Zones on page 1093.
5. Add a DHCP range to the network and assign it to a member. For information, see Configuring IPv6 Address
Ranges on page 1168.
6. Optionally, add exclusions to the DHCP range for addresses that are not used for dynamic allocation. For
information, see Modifying IPv6 Address Ranges on page 1169.
7. Optionally, configure DHCP properties for the address range. You can override properties set at an upper level
and enter unique values for the address range. For information, see Modifying IPv6 Address Ranges on page
1169.
8. Optionally, add fixed addresses to the network and configure DHCP properties for them. A fixed address may also
be associated with a device port through a Port Reservation. For information, see Configuring IPv6 Fixed
Addresses on page 1171.
9. Start the DHCP service and the IPv6 DHCP service. For more information, see Starting DHCP Services on a Member
on page 1103.

Defining Global IPv6 Prefixes

To simplify network creation, you can define IPv6 prefixes that are used for networks served by the Grid members. If
your organization is assigned IPv6 prefixes, you can enter them globally at the Grid level, and then just select the
appropriate IPv6 prefix when you define the networks.
To add global IPv6 prefixes:
1. From the Data Management tab, select the DHCP tab.
2. Expand the Toolbar and click Grid DHCP Properties.
3. In the Grid DHCP Properties editor, select the IPv6 Global Prefixes tab.
4. Click the Add icon and enter a name for the prefix and the prefix. Select the Default check box if you’d like to
specify a default IPv6 prefix for the Grid.
5. Save the configuration.

1160 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv6 Networks

Managing IPv6 Networks

You can create an IPv6 network from scratch or create a network template and then use that template to create one
or more networks. Using a network template facilitates creating multiple IPv6 networks with similar properties. You
can also create an IPv6 network from the Tasks Dashboard. For information about the Tasks Dashboard, see The Tasks
Dashboard on page 119.
An IPv6 network inherits its DHCP options & DDNS settings from its shared network, if it is part of a shared network,
or from the member to which it is assigned.
If you have enabled support for RIR (Regional Internet Registry) updates and are adding an RIR IPv6 network container
or network to NIOS, Grid Manager displays an RIR section in the Add IPv6 Network wizard. You must enter RIR related
information in this section in order for NIOS to associate the newly added network with an RIR organization. For more
information about RIR address allocation and updates, see RIR Registration Updates on page 555.

Adding IPv6 Networks

To add an IPv6 network:
1. Select the Data Management tab.
2. If you have more than one network view in the system, select the network view in which you want to add the
network.
3. Select the DHCP tab -> Networks tab.
4. In the Networks section, click the Add drop-down list and select IPv6 Network.
5. In the Add IPv6 Network wizard, select one of the following and click Next:
— Add IPv6 Network: Click this to add an IPv6 network from scratch.
— Add IPv6 Network using Template: To use a template, click this, and then click Select Template and select
an IPv6 network template. For information about network templates, see About IPv6 Network Templates on
page 1154. When you use a template to create a network, the configurations of the template apply to the
new network. The appliance populates the template properties in the wizard when you click Next. You can
then edit the pre-populated properties. If the template specified a fixed netmask, you cannot edit the
netmask.
6. Complete the following and click Next:
— Regional Internet Registry: This section appears only when support for RIR updates is enabled. For
information about RIR, see RIR Registration Updates on page 555. Complete the following to create an RIR
IPv6 network container or network:
— Internet Registry: Select the RIR from the drop-down list. The default is RIPE. When you select None, the
network is not associated with an RIR organization.
— Organization ID: Click Select Organization and select an organization from the RIR Organization
Selector dialog box.
— Registration Status: The default is Not Registered. When adding an RIR allocated network, you can
change this to Registered and select the Do not update registrations check box below. Note that when
you select API as the communication method, the registration status will be updated automatically
after the registration update is completed. However, when you select Email as the communication
method, the registration status will not be automatically updated. If you are creating a new network
and the registration update is completed successfully, the status will be changed to Registered. If the
update fails, the status will be changed to Not Registered. The updated status and timestamp are
displayed in the Status of last update field in the IPv6 Network Container or IPv6 Network editor.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1161

Managing IPv6 DHCP Data

— Registration Action: Select the registration action from the drop-down list. When you select Create, the
appliance creates the IPv4 network and assigns it to the selected organization. When you select None,
the appliance does not send registration updates to RIPE. When you are adding an existing RIR
allocated network to NIOS, select None. When you are adding networks to an RIR allocated network (a
parent network), select Create. Ensure that the parent network associated with an RIR organization
already exists.
— Do not update registrations: Select this check box if you do not want the appliance to submit RIR
updates to RIPE. By default, the appliance sends updates to the RIR database based on the configured
communication method.
— Network View: This appears only when you have multiple network views. From the drop-down list, select the
network view in which you want to create the network.
— Netmask: Use the netmask slider to select the appropriate number of subnet mask bits for the network.
— Networks: Do one of the following to add new networks:
Click the Add icon to enter a new network. If you are adding a network for a previously defined global IPv6
prefix, you can select the prefix from the IPv6 Prefix drop-down list. The default is None, which means that
you are not creating an IPv6 network for a previously defined subnet route. If you have defined a global
prefix at the Grid level, the default is the global prefix value. Click Add and Grid Manager adds a row to the
table. Enter the network address in the Network field. When you enter an IPv6 address, you can use double
colons to compress a contiguous sequence of zeros. You can also omit any leading zeros in a
four-hexadecimal group. For example, the complete IPv6 address
2001:0db8:0000:0000:0000:0000:0102:0304 can be shortened to 2001:db8::0102:0304. Note that if
there are multiple noncontiguous groups of zeros, the double colon can only be used for one group to avoid
ambiguity. The appliance displays an IPv6 address in its shortened form, regardless of its form when it was
entered. Click Add again to add another network. You can also select a network and click the Delete icon to
delete it.
or
Click the Next Available icon to have the appliance search for the next available network. Complete the
following in the Next Available Networks section:
— Create new network(s) under: Enter the network container in which you want to create the new network.
When you enter a network that does not exist, the appliance adds it as a network container. When you
enter a network that is part of a parent network, the parent network is converted into a network
container if it does not have a member assignment or does not contain fixed addresses and host
records that are served by DHCP. You can also click Select Network to select a specific network in the
Network Selector dialog box. For information about how the appliance searches for the next available
network, see Obtaining the Next Available on page 1110.
— Number of new networks: Enter the number of networks you want to add to the selected network
container. Note that if there is not enough network space in the selected network to create the number
of networks specified here, Grid Manager displays an error message. The maximum number is 20 at a
time. Note that when you have existing networks in the table and you select one, the number you enter
here includes the selected network.
— Click Add Next to add the networks. Grid Manager lists the networks in the table. You can click Cancel to
reset the values.

Note: You must click Add Next to add the network container you enter in the Next Available Networks section. If
you enter a network in the Next Available Networks section and then use the Add icon to add another
network, the appliance does not save the network you enter in the Next Available Networks section until
you click Add Next.

— Comment: Enter additional information about the network, such as the name of the organization it serves.

1162 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv6 Networks

— Automatically create reverse-mapping zone: This function is enabled if the netmask of the network is a
multiple of four, such as 4, 8, 12 or 16. Select this to have the appliance automatically create
reverse-mapping zones for the network. A reverse-mapping zone is an area of network space for which one
or more name servers have the responsibility for responding to address-to-name queries. These zones are
created in the DNS view assigned to receive dynamic DNS updates at the network view level.
— Disable for DHCP: Select this if you do not want the DHCP server to provide DHCP services for this network
at this time. This feature is useful when you are in the process of setting up the DHCP server. Clear this after
you have configured the server and are ready to have it serve DHCP for this network.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. To delegate authority for this network,
complete the following:
Delegate authority from the Grid Master
— Delegate To: This field indicates whether the authority for the network you want to create has already been
delegated to a Cloud Platform Appliance. Click Select to choose the Cloud Platform Appliance to which you
want to delegate authority. The Member Selector displays only Cloud Platform Appliances in the Grid. Click
the member, and Grid Manager displays the member name next to this field. This cloud member now
assumes authority for this network, and the Grid Master does not have authority any more. You can also
click Clear to remove authority delegation from the selected Cloud Platform Appliance and return authority
back to the Grid Master.
7. Click Next and add one or more Grid members as DHCP servers for the network.
— click the Add icon and select a Grid member from the Member Selector dialog box. Keep in mind, some
DHCP properties for the network are inherited from this member. The network can be served by multiple
members, but a member can serve networks in one network view only.
8. Click Next to associate Active Directory Sites with the network. For more information, see Associating Active
Directory Sites with Networks on page 1272.
9. (Applies only to Network Insight) Click Next to initiate or disable discovery of the new network(s). Discovery
settings differ based on whether you are defining one network or multiple networks.
— Configuring one network: discovery settings include the following: Enable Discovery and Immediate
Discovery, selecting a Probe member to perform the discovery; and Polling Options, which define how the
network will be discovered by the Probe member. By default, all Polling Options discovery settings are
inherited from the parent network (or Grid, if no parent exists) unless you click Override. Polling Options
govern the protocols used to query and collect information about the network devices being discovered.
or
— Configuring more than one network: If the networks are child networks, they automatically inherit the
settings of the parent network, including discovery settings and the discovery member. These settings will
not appear in the wizard page. For discovery of multiple networks, you can only enable or disable
Immediate Discovery. Click Next to override the DHCP properties described in Defining General IPv6
Properties on page 1089.
10. As part of creating a network, you can provision the network on an actual device (switch, router, or switch-router),
that is discovered and managed through the Grid Manager.
— Begin by checking the Enable Network Provisioning check box, and clicking the Select Device button.
Choose your device from the Device Selector dialog. (Click Clear to remove the setting. For more
information, see the section Using the Device Selector on page 689.)
— If you performed DHCP configuration in the previous step of the Add Network Wizard, the Router IP value
will automatically be populated with the DHCP Router IP address value. Otherwise, you enter the standard
router IP address.
— If required for the newly provisioned network to ensure that attached devices receive DHCP
auto-configuration, enable the DHCP Forwarding check box. For this setting, if a DHCP Failover was
previously configured, the IP addresses defined for DHCP failover are automatically used for the DHCP
forwarding configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1163

Managing IPv6 DHCP Data

— You will also need to choose an interface on the selected device on which to provision the network by
selecting it from the Interface drop-down menu. Grid Manager ensures that only those interfaces that can
support provisioning, and are available for provisioning (that do not have an Operation Status of Up),
appear in the drop-down menu.
— Otherwise, when creating networks and provisioning them on managed devices, you can create a VLAN on
which to provision the network by clicking the Create VLAN option and entering the VLAN Name and VLAN
ID. Ensure that the VLAN ID value you enter is appropriate for the application - don’t create a new VLAN and
provision a network for a VLAN value that is already actively carrying traffic for another routing domain.
If a selected device does not support VLANs, the Create VLAN option will not appear.
11. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see About Extensible Attributes on page 417.
If you are adding an RIR network, the RIR network attribute table appears. For information about these attributes
and how to enter them, see RIR Network Attributes on page 565. You can preview the information before the
appliance submits updates to the RIPE database. To preview registration updates, click Preview RIR
Submissions. For more information, see Previewing Registration Updates on page 569.

Note: You cannot leave an optional RIR attribute value empty. If you do not have a value for an RIR attribute, you
must delete it from the table. You can enter up to 256 characters for all RIR attributes.

12. As the final step in the Add IPv6 Network wizard, you define when Grid Manager creates the new network by
scheduling it. You also schedule when the associated port control task executes (if a port configuration has been
specified).
— To create the new network and its associated port configuration immediately, select Now. Grid Manager
synchronizes the port control task to take place at the same time as the creation of the new network.
— You can choose to have Grid Manager execute the port control task at the same time as the network
creation. To do so, select At same time as above.
— You can choose to have Grid Manager execute the port control task at a later time by selecting Later.
Choose a Selected time by entering or selecting a Start Date (click the calendar icon to choose a calendar
date) and a Start Time, and choose a Time Zone.
13. Choose one of the following from the Save & ... drop-down button menu:
— Click Save & Close to add the new network and close the wizard (this is the default).
— Click Save & Edit to add the new network and launch the editor.
— Click Save & New to add the new network and launch the wizard again to add another network.

Note: At any step during the wizard, you can click Schedule for Later to schedule the task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.

After you create a network, you can do the following:

• Add it to a shared network. For more information, see Adding IPv6 Shared Networks on page 1166.
• Use the split network feature to create subnets for the network. For information, see Splitting IPv6 Networks into
Subnets on page 606.
• Use the join networks feature to create a parent network that encompasses multiple subnets into a larger
network. For information, see Joining IPv6 Networks on page 607. You can also create a shared network for
subnets that are on the same network segment.
• View a list of networks. For more information, see Viewing Networks on page 1115.

1164 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing IPv6 Networks

Modifying IPv6 Networks

You can modify existing network settings and override the Grid or member DHCP properties, with the exception of the
network address and netmask.
To modify an IPv6 network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box, and then
click the Edit icon.
2. The IPv6 Network editor contains the following basic tabs from which you can modify data:
— Genera Basic: You can modify the following fields:
— Comment: The information you entered for the network.
— Disabled: This field is displayed only if the selected network is a network without a child network under
it. You can disable and enable existing networks instead of removing them from the database, if the
selected network does not have a child subnet. This feature is especially helpful when you have to
move or repair the server for a particular network.
When the Cloud Network Automation license is installed on the Grid Master, Grid Manager displays the
following information in the Cloud section: Cloud Usage, Owned By, and Delegated To. You cannot modify these
fields. For more information, see Adding IPv6 Networks on page 1161.
— Member Assignment: Add or delete a Grid member that provides DHCP services for this network.
— IPv6 DHCP Options: Keep the inherited DHCP properties or override them and enter unique settings for the
network. For information, see Defining General IPv6 Properties on page 1089.
— Discovery: Checking the Enable Discovery check box informs NIOS to begin discovering the network after
you click Save and Close. You manage discovery polling settings local to each network from this page. For a
complete overview of features on this page, see Discovering Devices and Networks on page 687 and its
subsections.
— Discovery Exclusions: IP Addresses and IP ranges can be locally excluded from discovery by clicking the Add
icon and selecting Add IP Address or Add IP Range. These IP addresses or IP ranges are selected from within
the chosen network. For related information, see Excluding IP Addresses from Discovery on page 685 and
its subsections.
— Discovery Blackout: Define extended time periods and regularly scheduled times when discovery and/or
port configuration tasks will not take place on a network. Editing a network under DHCP, blackout settings
apply only to the specified network. You also specify the scheduled time when the blackout period begins,
and the duration of the blackout period. By default, the network inherits its discovery blackout settings
from the Grid level. For related information, see Defining Blackout Periods on page 731 and its
subsections.

Note: Discovery blackout settings also can be defined for DHCP ranges.

— RIR Registration: Modify RIR network information. This tab appears only when support for RIR updates is
enabled. For information, see Modifying RIR Network Data on page 561.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific network. You
can also modify the values of the extensible attributes. For information, see About Extensible Attributes on
page 417.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify
advanced data.
— General Advanced: You can associate zones with a network. For information, see Associating Networks with
Zones on page 1093.
— IPv6 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the network.
Note that you must click Override and select Enable DDNS updates for the DDNS settings you configure in
this tab to take effect. For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on page 915.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1165

Managing IPv6 DHCP Data

Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration or click the Schedule icon at the top of the wizard to schedule this task. In the Schedule
Change panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting IPv6 Networks

When you delete a network, all of its data, including all DHCP records, subnets, and records in its subnets, is deleted
from the database. Because of the potentially large loss of data that can occur when you delete a network, the
appliance stores the deleted network in the Recycle Bin. You can restore a deleted network from the Recycle Bin, if
enabled. You can also disable a network instead of deleting it. For information, see Modifying IPv6 Networks on page
1165.
To delete a network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> network check box, and then select Delete
or Schedule Delete from the Delete drop-down menu.
2. To delete the network now, in the Delete Confirmation dialog box, click Yes. To schedule the deletion, see
Scheduling Deletions on page 90.
The appliance puts the deleted network in the Recycle Bin, if enabled.

About IPv6 Shared Networks

You can combine two or more contiguous IPv6 networks into a shared network. When you do, the DHCP server
allocates IP addresses from both subnets. To create a shared network, create the individual subnets, and then create
the shared network and add the subnets to it. For more information about shared networks, see About Shared
Networks on page 1055.

Adding IPv6 Shared Networks

To add an IPv6 shared network:
1. Select the Data Management tab.
2. If you have more than one network view in the system, select the network view in which you want to add the
network.
3. Select the DHCP tab -> Networks tab.
4. In the Shared Networks section, select IPv6 Shared Network from the Add drop-down menu.
5. In the Add IPv6 Shared Network wizard, do the following:
— Name: Enter the name of the shared network.
— Comment: Enter information about the shared network.
— Disabled: Select this if you want to enable the shared network at a later time. You can disable and enable
existing networks instead of removing them from the database. This feature is especially helpful when you
have to move or repair the server for a particular network.
6. Click Next and do the following to add networks:
a. Click the Add icon.
b. In the Network Selector, select the networks that you want to include in the shared network. Ensure that the
networks are served by the same Grid members to avoid DHCP inconsistencies.
7. Click Next to configure DHCP properties described in Defining General IPv6 Properties on page 1089.
8. Click Next to enter values for required extensible attributes or add optional extensible attributes for the shared
network. For information, see Using Extensible Attributes on page 427.

1166 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv6 Shared Networks

9. Save the configuration or click the Schedule icon at the top of the wizard to schedule this task. In the Schedule
Change panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.
For information on viewing shared networks, see Viewing Shared Networks on page 1120.

Modifying IPv6 Shared Networks

To modify a shared network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Shared Networks section ->
shared_network check box, and then click the Edit icon.
2. The IPv6 Shared Network editor contains the following tabs from which you can modify data:
— General: Modify the fields Name, Comments, and Disabled as described in Adding IPv6 Shared Networks
on page 1166.
— Networks: Displays the networks that are currently assigned to the shared network. You can add or
delete a network. To add a network, click the Add icon. To delete a network, select the network check
box, and then click the Delete icon.
— IPv6 DHCP Options: Keep the inherited DHCP properties or override them and enter unique settings for the
shared network. For information, see Defining General IPv6 Properties on page 1089.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific network. You
can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify
advanced data.
— IPv6 DDNS: Keep the inherited DDNS settings or override them and enter unique settings for the shared
network. Note that you must click Override and select Enable DDNS updates for the DDNS settings you
configure in this tab to take effect. For information, see Enabling DDNS for IPv4 and IPv6 DHCP Clients on
page 915.
Note that Grid Manager displays both the basic and advanced tabs the next time you log in to the GUI.
4. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting IPv6 Shared Networks

Though you can delete the networks in a shared network, a shared network must have at least one network in it.
To delete a shared network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Shared Networks section ->
shared_network check box, and then select Delete or Schedule Delete from the drop-down menu.
2. To delete the shared network now, in the Delete Confirmation dialog box, click Yes. To schedule the deletion, see
Scheduling Deletions on page 90.
The appliance puts the deleted shared network in the Recycle Bin, if enabled.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1167

Managing IPv6 DHCP Data

Configuring IPv6 Address Ranges

You can configure IPv6 ranges that are used to delegate IPv6 prefixes only, to assign IPv6 addresses only, or to
delegate IPv6 prefixes and assign IP v6 addresses. When you define a DHCP range to delegate prefixes, the prefixes
can be outside of the network where they are being defined. IPv6 ranges inherit their properties from their network,
so each range in a subnet provides the same set of options to their DHCP clients.
Note that when an Infoblox DHCP server grants IPv4 leases, it starts from the last IP address in the range to the first.
When the server grants IPv6 leases, it uses an algorithm based on the DUID of the client.

Adding IPv6 Address Ranges

To add a an IPv6 address range:
1. Navigate to the IPv6 network to which you want to add an address range, and then select Range from the Add
drop down menu.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> Range -> IPv6.
2. In the Add IPv6 Range wizard, select one of the following and click Next:
— Add IPv6 Range: Select this to add an address range from scratch.
or
— Add IPv6 Range Using Template
Click Select Template and select the template that you want to use. Note that when you use a template to
create a DHCP range, the configurations of the template apply to the new range. The appliance
automatically populates the address range properties in the wizard. You can then edit the pre-populated
properties. For more information, see About IPv6 Range Templates on page 1151.
3. Complete the following:
— Network: Click Select Network. Grid Manager displays the network address here if you have only one
network configured. When there are multiple networks, Grid Manager displays the Select Network dialog
box from which you can select one.
Specify one of the following:
— Address: Select this if the address range is used to allocate IPv6 addresses only to DHCP clients, and then
enter the start and end addresses in the range.
— Prefix Delegated: Select this if the DHCP server uses this address range to delegate IPv6 prefixes only to
DHCP clients. Enter the start and end prefixes, and the prefix length.
— Both: Select this if the DHCP server delegates IPv6 prefixes and allocates IPv6 addresses from this range.
Enter the start and end addresses in the range, and the start and end prefixes, and the prefix length.
Complete the following:
— Name: Enter a name for the address range.
— Comment: Enter additional information about the address range.
— Disabled: Select this if you want to save the configuration for the address range but do not want to activate
the address range yet. You can clear this check box when you are ready to allocate addresses from this
range.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. To delegate authority for this range,
complete the following:
Delegate authority from the Grid Master

1168 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv6 Address Ranges

— Delegate To: This field indicates whether the authority for the range you want to create has already been
delegated to a Cloud Platform Appliance. Click Select to choose the Cloud Platform Appliance to which you
want to delegate authority. The Member Selector displays only Cloud Platform Appliances in the Grid. Click
the member, and Grid Manager displays the member name next to this field. This cloud member now
assumes authority for this range, and the Grid Master does not have authority any more. You can also click
Clear to remove authority delegation from the selected Cloud Platform Appliance and return authority back
to the Grid Master.
4. Click Next and select one of the following to provide DHCP services for the DHCP range:
— None (Reserved Range): Select this if you want to reserve this address range for static hosts. Addresses in
this range cannot be allocated as dynamic addresses. You can allocate the next available IP from this range
to a static host. This is selected by default.
— Grid Member: Select this if you want a Grid member to serve DHCP for this DHCP range. Select a Grid
member from the drop-down list. The drop-down list displays only the Grid members that are associated
with the network to which the DHCP range belongs.
5. (Applies only to Network Insight) Click Next to initiate or disable discovery of the new DHCP range.
— Configuring one network: Discovery settings include the following: Enable Discovery and Immediate
Discovery, selecting a Probe member to perform the discovery; and Polling Options, which define how the
network will be discovered by the Probe member using SNMP and CLI credentials. By default, all Polling
Options discovery settings are inherited from the parent network unless you click Override. Polling Options
govern the protocols used to query and collect information about the network devices being discovered.
See the section Configuring Discovery Properties on page 676 for a complete description of discovery
Polling Options.
6. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
7. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Setting the Priority of IPv6 Address Ranges

The DHCP server allocates IP addresses from the configured DHCP ranges according to the order in which the ranges
are listed. By default, ranges are listed according to their start addresses. You can move the ranges up and down in
the list to change their order. For information about viewing DHCP ranges and other objects in a network, see Viewing
IPv6 DHCP Objects on page 1175.
To change the order of DHCP ranges in a network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> network.
2. Expand the Toolbar and click Order DHCP Ranges.
3. In the Order DHCP Ranges dialog box, click the up and down arrows to move ranges up or down on the list. The
Priority value changes accordingly. Click OK to save the configuration.

Modifying IPv6 Address Ranges

To modify an IPv6 address range:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> addr_range check
box, and then click the Edit icon.
2. The DHCP Range editor contains the following basic tabs from which you can modify data:
— General: Modify the fields, except the network address, as described in Adding IPv6 Address Ranges on
page 1168.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1169

Managing IPv6 DHCP Data

When the Cloud Network Automation license is installed on the Grid Master, Grid Manager displays the
following information in the Cloud section: Cloud Usage, Owned By, and Delegated To. You cannot modify
these fields. For more information, see Adding IPv6 Address Ranges on page 1168.
— Member Assignment: Modify the Grid member that provides DHCP services for the DHCP range as described
in Adding IPv6 Address Ranges on page 1168.
— Discovery: You can enable and change discovery settings for the IPv6 range at any time after creating the
range. Discovery settings include the following: Enable Discovery and Immediate Discovery, selecting a
Probe member to perform the discovery; and Polling Options, which define how the network will be
discovered by the Probe member using SNMP and CLI credentials. By default, all Polling Options discovery
settings are inherited from the parent network unless you click Override. Polling Options govern the
protocols used to query and collect information about the network devices being discovered. See the
section Configuring Discovery Properties on page 676 for a complete description of discovery Polling
Options.
— Discovery Blackout: Define extended time periods and regularly scheduled times when discovery and/or
port configuration tasks will not take place on a network or DHCP range. Editing a network or range under
DHCP, blackout settings apply only to the specified network or range. You also specify the scheduled time
when the blackout period begins, and the duration of the blackout period. By default, the network inherits
its discovery blackout settings from the Grid level. For related information, see Defining Blackout Periods
on page 731 and its subsections.
— IPv6 DHCP Options: Keep active leases in a deleted DHCP range. For more information, see Keeping Leases
in Deleted IPv4 and IPv6 Networks and Ranges on page 1094.
— Extensible Attributes: You can add and delete extensible attributes that are associated with a specific DHCP
range. You can also modify the values of extensible attributes. For information, see Using Extensible
Attributes on page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Advanced Mode to display the following tabs from which you can modify
advanced data.
— Exclusion Ranges: Configure a range of IP addresses that the appliance does not use to assign to clients.
You can use these exclusion addresses as static IP addresses. For more information, see About Exclusion
Ranges on page 1056.
Note that Grid Manager displays both the basic and advanced mode tabs the next time you log in to the GUI.
4. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting IPv6 Address Ranges

To delete an IPv6 address range:
• From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> addr_range check
box, and then click the Delete icon.

1170 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv6 Fixed Addresses

Configuring IPv6 Fixed Addresses

You can configure IPv6 fixed addresses with either an IPv6 address or prefix. You can assign prefix-based fixed
addresses to routers so they can advertise the prefixes associated with a link. The fixed addresses also can be bound
to interfaces on a network device, such as a switch or a router, that is discovered and managed under IPAM. DHCP
hosts, in turn, use these prefixes to generate IP addresses using the stateless autoconfiguration mechanism defined
in RFC 2462, IPv6 Stateless Autoconfiguration. You can also create IPv6 fixed addresses from the Tasks Dashboard.
For information about the Tasks Dashboard, see The Tasks Dashboard on page 119.

Note: IPv6 fixed addresses do not support dynamic DNS updates.

Adding IPv6 Fixed Addresses

Note: At any time during the wizard, you can click Schedule for Later to schedule the task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85.

To add an IPv6 fixed address:

1. Navigate to the network to which you want to add a fixed address, and then select Fixed Address from the Add
drop down menu.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> Fixed Address -> IPv6.
2. In the Add Fixed Address wizard, select one of the following and click Next:
— Add IPv6 Fixed Address
or
— Add IPv6 Fixed Address Using Template
Click Select Template and select the template that you want to use. When you use a template to create a
fixed address, the configurations of the template apply to the new address. The appliance automatically
populates the fixed address properties in the wizard. You can edit the pre-populated properties.
3. In this panel, the displayed network address can either be the last selected network or the network from which
you are adding the fixed address. If no network address is displayed or if you want to specify a different network,
click Select Network. When there are multiple networks, Grid Manager displays the Select Network dialog box.
Specify one of the following:
— Select Address to assign an IPv6 address to a fixed address. You can either enter an IPv6 address or select
Next Available IP to obtain the next available IP address. Note that for Cloud Network Automation, Next
Available IP is not available if the fixed address you want to create is within a delegated range.
— Select Prefix Delegated to assign an IPv6 prefix. Enter the prefix and prefix length.
— Select Both to assign an IPv6 prefix and address. Enter the IPv6 address, prefix, and prefix length.
Complete the following:
— DUID: Specify the DHCP Unique Identifier (DUID) of the DHCP client assigned to this fixed address.
— Name: Enter a name for the fixed address.
— Comment: Optionally, enter additional information.
— Disabled: Select this if you do not want the DHCP server to allocate this IP address at this time.
The Cloud section appears when the Cloud Network Automation license is installed on the Grid Master. For
information, see Deploying Cloud Network Automation on page 361. This section displays the following
information:
• Cloud Usage: This field indicates whether this object is associated with any specific cloud extensible
attributes or within a scope of delegation. It can be one of the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1171

Managing IPv6 DHCP Data

— Cloud from adapter: Indicates that this object has been created by a cloud adapter and it may or may
not be within a scope of delegation at the moment.
— Cloud from delegation: Indicates that this object is within the scope of delegation or the object itself
defines a scope of authority delegation, and it is not created by a cloud adapter.
— Used by cloud: Indicates that this network or network container is associated with the extensible
attribute Is External or Is Shared and the value is set to True, which implies the network is a private or
shared network managed by the CMP, and it is not Cloud from adapter or Cloud from delegation.
— Non-cloud: The object is a regular NIOS object and is not within the scope of any authority delegation
nor is it associated with any of these extensible attributes: Cloud API Owned, Is External or Is Shared.
NIOS admin users can modify this object based on their permissions.
• Owned By: A cloud object can be owned by the Grid Master or the cloud adapter. When the object is created
by the Grid Master, this shows Grid. If the object is created by the cloud adapter, this shows Adapter.
Delegate authority from the Grid Master
— Delegate To: This field indicates whether the authority for the object you want to create has already been
delegated. If so, it displays the name of the delegation.
4. Click Next to configure or override DHCP options as described in Defining General IPv6 Properties on page 1089.
5. (Applies only with Network Insight) This step is not required for creating a new Fixed Address. In the current
Wizard step, you can optionally define the following identification values and settings for the new object’s port
reservation:
— Choose the Device Type: Router, Switch-Router, Switch, MSFT (Microsoft) Server, NetMRI, NIOS, VNIOS, or
ESX (VMware) Server.
The values on this page are not required for defining the actual port reservation in a later wizard step.
Certain device types could be descriptively relevant based on the type of object you are creating. As an
example, the MSFT Server designator helps identify the new object as a Microsoft Hyper-V Host. The ESX
Server designator can be used to identify the new object as a VMware ESX Host. These values are not
required and will not affect the functionality of the object.
— Choose the Device Vendor: Cisco, Juniper, Aruba, Dell, Infoblox, or HP.
— You can also enter a Location and a Description. These values are advisory and not required for
configuration.
After you define this group of settings, you will still need to define a device port reservation, which is done
in a later step.
6. Click Next to initiate or disable discovery of the new Fixed Address. (Applies only to Network Insight) This step is
not required for creating a new Fixed Address.
a. Choose either Exclude from Network Discovery or Enable Immediate Discovery. If you choose to Exclude,
discovery will not execute on the Fixed Address. If you choose Enable Immediate Discovery, discovery will
execute on the host after you save your settings. You may also choose to leave both options disabled.
b. By default, the new fixed address object inherits its SNMP credentials from those defined at the grid level.
Should you wish to override them for a local set of credentials, check the Override Credentials check box
and select the SNMPv1/SNMPv2 or SNMPv3 option and enter the locally used credentials.
c. You may also test the entered SNMP credentials by clicking Test SNMP Credential.

Note: For descriptions of SNMP credentials for discovery, see the section Configuring SNMP1/v2 Credentials for
Polling on page 680 and Configuring SNMPv3 Properties on page 680. These Grid-based values are
inherited, by default, by each new object you create.

— For the new object, you can check the Override CLI Credentials check box to override the inherited set of CLI
credentials taken from the Grid level. This set of credentials may be used for the device that is directly
associated with the new object in its Port Reservation.
— You can also click Test CLI Credentials to enter and test a set of CLI login credentials against a device based
on its IP address.

1172 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring IPv6 Fixed Addresses

Port control operations require CLI credentials for the involved devices. (If you are not using port control for
the new object, usage of CLI credentials is optional.) Because some IPAM and DHCP objects will use port
control features as part of object creation, CLI credentials are automatically leveraged as part of discovery.
Ensure you have the correct sets of CLI credentials for devices in your network. See the section Configuring
CLI Discovery Properties on page 681 for related information.
— SSH is the default for CLI operations. Check the Allow Telnet check box if you know the device involved in
the object assignment may support Telnet but may not support SSH, or if you want Telnet as an option.

Note: All port control operations require CLI credentials to be entered into Grid Manager. Because some IPAM
and DHCP objects will use port control features as part of object creation, CLI credentials are automatically
leveraged as part of discovery. Ensure you have the correct sets of CLI credentials for devices in your
network.

7. Click Next to define the port reservation for the device port that will be associated with the new Fixed Address.
This step is not required for creating a new Fixed Address. This feature set is also termed port control in the
NIOS/Grid Manager system. The device to which the new Fixed Address will be associated should already be
discovered and managed from the Grid Manager.
— Begin by checking the Reserve Port check box. Note that reserving a switch port does not guarantee its
availability.
Optionally, you can skip connecting port configuration by clicking Next.
Click the Clear button to remove the selected device from the configuration.
— Click the Select Device button to choose the device for which the port reservation will be associated. You
should know the identity of the device to whose interface the new object will be associated before taking
this step. For more information, see the section Using the Device Selector on page 689.
— After choosing the device, choose the Interface with which the port reservation will be bound. The
drop-down list shows only interfaces that are most recently found to be available by Grid Manager during
the last discovery cycle. This list will not include any ports that are Administratively Up and Operationally
Up, or that are otherwise already assigned to other networks or objects.
— The Wizard page also shows a list of any VLANs that are currently configured in the chosen device (The
following VLANs are configured). This Wizard page allows only the assignment of an existing VLAN in the
chosen device to the new port reservation.
— Check the Configure Port check box to define specific port control settings for the port reservation.
— Choose the Data VLAN and/or the Voice VLAN settings you may need for the port assignment. Depending
on the selected device, you may or may not be able to apply VLAN settings.
— Set the Admin Status to Up if you need to activate the port after assignment in the current task.
All port control operations require CLI credentials to be entered into Grid Manager. Because some IPAM and
DHCP objects will use port control features as part of object creation, CLI credentials are automatically
leveraged as part of discovery and definition of port configurations such as Admin Up/Down status. Ensure
you have the correct sets of CLI credentials for devices in your network.
— Enter a Description for the port assignment. Infoblox recommends doing so to help other technicians to
recognize the port assignment task.
8. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
9. As the final step in the Add Fixed Address wizard, you define when Grid Manager creates the new object by
scheduling it. You also schedule when the associated port configuration task executes.
— To create the new object and its associated port configuration immediately, select Now. The port control
event is automatically synchronized to take place at the same time as the activation of the new object.
— You can choose to have Grid Manager execute the port reservation task at the same time as the Fixed
Address object creation. To do so, select At same time as Host.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1173

Managing IPv6 DHCP Data

— You can choose to have Grid Manager execute the port reservation task at a later time by selecting Later.
Choose a Selected time by entering or selecting a Start Date (click the calendar icon to choose a calendar
date) and a Start Time, and choose a Time Zone.
10. Choose one of the following from the Save & ... drop-down button menu:
— Click Save & Close to add the new object and close the wizard (this is the default).
— Click Save & Edit to add the new object and launch the editor.
— Click Save & New to add the new object and launch the wizard again to add another Fixed Address object.
11. Save the configuration and click Restart if it appears at the top of the screen.

Note: At any step during the wizard, you can click Schedule for Later to schedule the task. In the Schedule Change
panel, enter a date, time, and time zone. For information, see Scheduling Tasks on page 85. You cannot
schedule this task when you are creating an object that is within a delegated scope.

For information on viewing IPv6 fixed addresses in a network, see Viewing IPv6 DHCP Objects on page 1175.

Modifying IPv6 Fixed Addresses

To modify a fixed address:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network ->
fixed_address check box, and then click the Edit icon.
2. The Fixed Address editor contains the following basic tabs from which you can modify data:
— General: You can modify all the fields you filled out in the first step of the wizard described in Adding IPv6
Fixed Addresses on page 1171.
— Device Information: You can change advisory Device Information settings for the object’s port reservation;
settings are described in the section Configuring IPv6 Fixed Addresses on page 1171.
— Discovery: Checking the Enable Discovery check box informs NIOS to begin discovering the network after
you click Save and Close. You manage discovery polling settings local to each fixed address from this page.
For a complete overview of features on this page, see Discovering Devices and Networks on page 687 and
its subsections.
— Port Reservation: Review and edit any device port reservations that may be defined for the current object, or
create a new port reservation and schedule it. For a closer look, see the section Port Control Features in
Network Insight on page 714, and steps 5-9 in the section Configuring IPv6 Fixed Addresses on page 1171.
— IPv6 DHCP Options: You can keep the inherited DHCP options or override them and enter unique settings for
the fixed address. For information, see Defining General IPv6 Properties on page 1089.
— Discovered Data: You can view discovered data of this address, if any, in this tab. For information, see
Viewing Discovered Data on page 642.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific network. You
can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

1174 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing IPv6 DHCP Objects

Deleting IPv6 Fixed Addresses

To delete a fixed address, from the Data Management tab, select the DHCP tab -> Networks tab -> Networks section ->
network -> fixed_address check box, and then click the Delete icon. You cannot delete multiple fixed addresses at the
same time if the authority for one of the fixed addresses is delegated to a Cloud Platform Appliance.

Viewing IPv6 DHCP Objects

You can view the DHCP objects in an IPv6 network by navigating to the DHCP tab -> Networks tab -> Networks panel,
and then clicking the network link. This panel displays the following information about DHCP objects in the selected
IPv6 network:
• IP Address: The IPv6 address of a DHCP object, such as a DHCP range, fixed address, or host configured for
DHCP, or roaming host with an allocated IP address. For a DHCP range, this field displays the start and end
addresses of the range. For a host that has multiple IP addresses, each IP address is displayed separately. Note
that the appliance highlights all disabled DHCP objects in gray.
• Type: The DHCP object type, such as IPv6 DHCP Range or IPv6 Fixed Address.
• Name: The object name. For example, if the IP address belongs to a host record, this field displays the
hostname.
• Comment: The information you entered for the object.
• Site: The site to which the DHCP object belongs. This is one of the predefined extensible attributes.
You can select the following additional columns for display:
• Priority: Displays the priority of the DHCP range.
• Disabled: Indicates whether the network is disabled.
You can also do the following in this panel:
• Modify some of the data in the table. Double click a row, and either modify the data in the field or select an item
from a drop-down list. Click Save to save the changes. Note that some fields are read only.
• Sort the data in ascending or descending order by column.
• Create a bookmark for the object.
• Click Go to IPAM View to view information about the object in the IPAM tab.
• Delete or schedule the deletion of a selected object or multiple objects.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Print or export the data.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1175

Managing IPv6 DHCP Data

1176 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 30 DHCP Failover
This chapter explains how to configure DHCP failover associations. It contains the following sections:
• About DHCP Failover on page 1178
— Failover Association Operations on page 1178
• Configuring Failover Associations on page 1179
— Adding Failover Associations on page 1180
• Managing Failover Associations on page 1182
— Modifying Failover Associations on page 1182
— Monitoring Failover Associations on page 1183
— Deleting Failover Associations on page 1184
— Setting a Peer in the Partner-Down State on page 1185
— Performing a Force Recovery on page 1185
— Recovering DHCP Failover Associations on page 1186

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1177

DHCP Failover

About DHCP Failover

You can create a failover association between two DHCP servers (a primary server and a secondary) and assign the
failover association to serve an IPv4 DHCP range. When you set up a failover association, you greatly reduce DHCP
service downtime if one of your DHCP servers is out of service. You can better manage IP address requests by making
two servers available for DHCP services. You can also configure one of the servers to assume full DHCP services when
you know the other server may go out of service for a period of time.
You can configure two NIOS appliances, or one appliance and one external server, to form a failover association. The
pairing of a primary and secondary server is called a peer association. The failover peers establish a TCP connection
for their communication. They share a pool of IP addresses that they allocate to hosts on their networks based on
load balancing. Load balancing is a technique to split the address allocation workload evenly across the two DHCP
servers. You can assign a DHCP failover association to serve DHCP ranges in a network. A DHCP failover association
can serve DHCP ranges that belong to one network view only. It cannot serve ranges in different network views.

Failover Association Operations

When a host broadcasts a DHCPDISCOVER message, it includes its MAC address. Both the primary and secondary
peers receive this message. To determine which server should allocate an IP address to the host, they each extract
the MAC address from the DHCPDISCOVER message and perform a hash operation. Each server then compares the
result of its hash operation with the configured load balancing split. The split is set to 50% by default to ensure an
even split between the two servers. When the split is 50%, the primary server allocates the IP address if the hash
result is between 1 and 127, and the secondary server allocates the IP address if the hash result is between 128 and
255. As a server allocates an IP address, it updates its peer so their databases remain synchronized.
As shown in Figure 30.1, when a host broadcasts a DHCPDISCOVER message, both the primary and secondary servers
receive the message. They perform a hash operation on the MAC address in the DHCPDISCOVER message, and the
result is 250. Since the load balancing split is 50% and the hash result is 250, the secondary server responds to the
host with a DHCPOFFER message. The secondary peer allocates an IP address from its assigned pool of IP addresses.
It then sends a lease update message to the primary server so that the primary server knows how the address is
assigned and can properly take over if the secondary server fails.

Figure 30.1 Load Balancing and IP Addresses Allocation

1 When a host broadcasts a Primary Server 2 Both servers receive the

DHCPDISCOVER DHCPDISCOVER message.
message, it includes its Each server performs a hash on
MAC address. the MAC address, and the result
is 250.

TCP Connection

= 250
Router

Secondary Server
3 The load balancing split is 128.
SInce the hash result is between
128 and 255, the secondary
server responds to the host and
allocates the IP address to the
host.

1178 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Failover Associations

Configuring Failover Associations

1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Click Toggle Advanced Mode if the editor is in basic mode. When the additional tabs appear, select the General
Advanced tab to complete the following:
— Failover Port: You can modify the port number that members use for failover associations. You can use any
available port from 519 to 647. The default is 647 for a new installation and 519 for an upgrade.
The following are tasks and guidelines for configuring a DHCP failover:
1. Identify the primary and secondary DHCP servers and ensure that the appliances are set up correctly for the
failover association, using the following guidelines:
— Configure a failover association using two NIOS appliances, or a NIOS appliance and an ISC DHCP
compliant server.
— One of the DHCP servers must be an independent appliance or in an Infoblox Grid.
— The DHCP servers do not have to be in the same geographic location.
— The clocks on both servers must be synchronized. This happens automatically when both servers are on the
same Grid.
— Both servers must use the same version of the DHCP configuration file. This happens automatically when
both servers are on the same Grid.
— If you use firewalls on your networks, ensure that the firewalls allow TCP port 519 between the servers, and
that TCP port 7911 is open for partner down operations.
— Each pair of DHCP servers can participate in only one failover association. An appliance can participate in
more than one failover association, as long as it is with a different peer.
Configure the same DHCP properties on the primary and secondary servers, as described in Configuring General
IPv4 DHCP Properties on page 1071.
— Both the primary and secondary servers must have the same operational parameters, and they must be
able to receive DHCPDISCOVER messages that hosts broadcast on the networks.
— If you change any of the DHCP failover parameters for a peer association definition, you must make the
same changes on both the primary and secondary servers.

Note: If both the primary and secondary servers are in a Grid, you configure the properties on the failover
association and the configuration applies to both servers.

2. Create a failover association and configure load balancing between the servers. For information, see Adding
Failover Associations on page 1180.
— Ensure that you use the same failover association name on both the primary and secondary servers.
— The appliance assigns default values to the failover timers and triggers. In general, these default values
serve the purpose of a failover. Do not change these values unless you understand the ramification of the
changes. For example, when one of the peers in a failover association fails, the other peer goes into a
COMMUNICATIONS-INTERRUPTED state, and the lease time changes to the MCLT (Maximum Client Lead
Time). You should consider how the MCLT affects the lease time when a failover occurs if you want to
change this value.
3. Assign the failover association to the DHCP ranges in the same network view. Failover associations can serve only
IPv4 DHCP ranges. For information, see Configuring IPv4 Address Ranges on page 1121.
— If you configure a shared network, and the subnets in the shared network contain ranges served by a DHCP
failover association, both the primary and secondary DHCP server must have the same shared networks
defined, containing the same networks and DHCP ranges.

Note: If you have multiple networks that are in a shared network and you plan to use a DHCP failover, you must
use the same failover association and specify the same peers on all the networks in the shared network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1179

DHCP Failover

4. Enable DHCP on the primary and secondary servers AFTER you complete all the configurations. For information,
see Managing Failover Associations on page 1182.

Note: When you set up a failover association for the first time, ensure that both servers are up and running and
their databases are synchronized before they can start assigning IP addresses.

When you configure a failover association, the appliance assigns default values for timers and triggers, such as the
MCLT and the maximum number of “unacked” packets. A failover may occur when some of the timers expire or when
a failover peer goes out of service. When a failover occurs, the functional peer takes over and assigns IP addresses
with the lease time set to the MCLT. When the server that is offline comes back online, it synchronizes its database
with its peer before it starts allocating IP addresses.

Adding Failover Associations

To add a DHCP failover association, perform the following procedures on both the primary and secondary servers:
1. From the Data Management tab, select the DHCP tab -> Members tab -> IPv4 Failover Associations section, and
then click the Add icon.
or
Expand the Toolbar and click Add -> IPv4 Failover Association.
2. In the Add Failover Association wizard, complete the following:
— Name: Enter a unique name for the failover association. The failover association name is case sensitive.
Enter the same name on both the primary and secondary servers. The appliance validates the names on
both servers. The names must be exactly the same. If they do not match, the failover association goes into
disconnect mode.
— DHCP Failover Primary: Select one of the following. The default is Grid Member.
— Grid Member: Click Select member. In the Select Member dialog box, select the primary server and
click the Select icon.
— MS Server: Click Select Server. In the Microsoft Server Selector dialog box, select the Microsoft server
that supports DHCP failover. Note that only certain versions of Microsoft servers support failover. This
dialog box also displays the following columns: IP address, Comment, and Site.
The failover association requires at least two Microsoft servers. NIOS displays an error message when
you select MS Server if there is only one Microsoft server. When you add or modify a failover association
through Grid Manager, the appliance displays a message to ensure the connectivity between two
Microsoft servers. If you want a failover association to be in a normal state, you must ensure an
end-to-end connectivity. If the connectivity fails, you must re-establish connectivity between the two
Microsoft servers and the failover association follows the recovery states based on the DHCP failover
protocol.

Note: You can configure Microsoft primary and secondary servers using this wizard only. You cannot edit
Microsoft primary and secondary servers after you configure them. You must delete and reconfigure the
primary or secondary Microsoft server for a failover association.

— External Server IP Address: Select this to use an external ISC DHCP compliant server as the primary
server. Enter the IP address of the primary server in the field.
— DHCP Failover Secondary: Select one of the of following. The default is Grid Member.
— Grid Member: Click Select member. In the Select Member dialog box, select the secondary server and
click the Select icon.
— MS Server: NIOS selects this automatically when you set the DHCP Failover Primary to MS Server. Click
Select Server. In the Microsoft Server Selector dialog box, select the Microsoft server that supports
DHCP failover. Note that only Microsoft Windows Server 2012 or later versions support synchronization
of failover relationships. This dialog box also displays the following columns: IP address, Comment,
and Site.

1180 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Failover Associations

Note: The primary and secondary Microsoft servers that you select in a failover relationship must be in the same
network view. For more information, see About Microsoft DHCP Failover Relationships on page 1305.

— External Server IP Address: Select this to use an external ISC DHCP compliant server as the secondary
server. Enter the IP address of the secondary server in the field.

Note: You cannot select External Server IP Address for both the primary and secondary servers. One of the
servers must be an independent appliance or in an Infoblox Grid.

— Comment: Enter useful information about the failover association.

3. Click Next and do the following to control the IP address allocation between the peers and how they switch from
one to the other based on the configuration:
— Failover mode: This is valid for Microsoft Management only. Select a failover mode. You can either select
Hot standby or Loadbalancing. When you select Hot standby, the secondary server is set to Standby by
default and the slider move to the position at 95%. The slider moves to 50% when you set the failover
mode to Loadbalancing mode. You can synchronize and manage a failover mode that is operating in Hot
standby mode. The primary partner is the active server that first creates the relationship if you use the
Loadbalancing or the Hot standby mode.

Note: When you configure a failover association, the slider changes its position based on the Failover mode you
select. When you edit failover settings, the slider remains in the Balanced position, at 50%, by default.
For more information about modifying failover associations, see Modifying Failover Associations on page
1182.

— Load Balancing Data: Adjust the slider to determine which server should handle more IP address requests.
The default is 50%. When you adjust the slider, a tooltip window displays the percentage of available IP
addresses that each server can allocate. When you move the slider all the way to the left, the primary server
responds to all IP address requests, and the secondary server does not respond to any. The opposite
applies when you move the slider all the way to the right. Infoblox recommends that you use the default
(50/50) to enable the primary and secondary servers to respond to IP address requests on an equal basis.
— Lease Deletion: Select the following to override settings at the Grid and member levels.
— Keep leases from deleted ranges until one week after expiration: When you select this and delete a
DHCP range with active leases, the appliance stores these leases up to one week after they expire.
When you add a new DHCP range that includes the IP addresses of these active leases, the appliance
automatically restores the leases.
— Secondary role: This is valid for Microsoft Management only. Note that the secondary role is available only
in Hot standby mode. The appliance displays Standby by default and you cannot edit this value.
— Maximum client lead time: Specify the maximum client lead time in minutes or hours. The default is one
hour. Select Minutes or Hours from the drop-down list. This specifies the maximum amount of time the
server waits before assuming control.
— Enable switchover interval: This is valid for Microsoft Management only. Select this to automatically change
the state to partner down after a specified period. NIOS does not support the “partner down” state for
Microsoft DHCP failover association.
— State switchover interval (Minutes): This is valid for Microsoft Management only. Specify the amount of
time after which the server must change the state. The default is 60 minutes.
— Enable Authentication: This is valid for Microsoft Management only. Select this if you want to secure the
communication between failover partners.
— Shared Secret: This is valid for Microsoft Management only. Enter a shared secret that can be used to
authenticate the communication between failover partners. You can specify a shared secret only if you
enable authentication.
4. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1181

DHCP Failover

5. Save the configuration and click Restart if it appears at the top of the screen.

Best Practices for Restoring Microsoft DHCP Server Data

When you synchronize two Microsoft servers in read/write mode for a Microsoft DHCP failover association, the
appliance might override new data. For example, assume that you are synchronizing data from one Microsoft server,
which has latest data. But after the restore operation, the appliance will synchronize data from a Microsoft server that
has old data. If you synchronize old data, it might override new data. Infoblox recommends that you follow the steps
mentioned below to prevent new data being replaced with the old one:
1. Disable DHCP synchronization for the Microsoft server before you restore data to the Microsoft server.
2. Restore the Microsoft DHCP server.
3. From the Microsoft server, which has the latest data, replicate its DHCP failover association and scopes to the
restored Microsoft server. This ensures that both Microsoft servers have the same latest data.
4. Re-enable DHCP synchronization for the restored Microsoft server. NIOS will resynchronize with the Microsoft
server.

Managing Failover Associations

After you establish a failover association, you can monitor its status periodically to ensure that it is functioning
properly. You can also delete a failover association when it is not assigned to any DHCP range.
See the following sections on how to manage failover associations:
• Modifying Failover Associations
• Monitoring Failover Associations on page 1183
• Deleting Failover Associations on page 1184
Under special circumstances, you can manually adjust the configuration of a failover association. For example, when
you know in advance that a peer will be out of service for an extended period of time, you can manually set the
functional peer in a PARTNER-DOWN mode. This allows the functional partner to assume all leases and be able to
allocate addresses to client requests in full capacity. In addition, when you suspect the databases in a failover
association are not synchronized, you can consider doing a force recovery (after you consult with Infoblox Technical
Support or your Infoblox representative) so the secondary server can completely rebuild its lease table with updates
from the primary server.
See the following sections on how to set a peer to the partner-down mode and perform a force recovery:
• Setting a Peer in the Partner-Down State on page 1185
• Performing a Force Recovery on page 1185

Modifying Failover Associations

To modify a failover association:
1. From the Data Management tab, select the DHCP tab -> Members tab -> Failover Associations ->
failover_association check box, and then click the Edit icon.
2. The DHCP Failover Association editor contains the following tabs from which you can modify data:
— General: In the Basic tab, modify the fields as described in Adding Failover Associations on page 1180.
In the Advanced tab, complete the following to modify the port number you use for the failover association:
— Failover Port: Click Override to enter a port number for the failover association. You can use any
available port from 1 to 63999. The default is 647 for a new installation and 519 for an upgrade.

1182 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Failover Associations

— Triggers: Before editing the triggers and timers, ensure that you understand the ramification of the changes.
Improper configuration of the triggers can cause the failover association to fail. For information about the
fields in the Basic tab, see Adding Failover Associations on page 1180. The following are the triggers in the
Advanced tab:
— Max Response Delay Before Failover(s): Specifies how much time (in seconds) can transpire before a
failover occurs when a failover peer does not receive any communication from its peer. This number
should be small enough that the transient network failure does not leave the servers out of
communication for a long time, but big enough that the servers are not constantly connecting and
disconnecting. The default is 60 seconds.
— Max Number of Unacked Updates: Specifies the number of “unacked” packets the server can send
before a failover occurs. The default is 10 messages.
— Max Client Lead Time(s): Specifies the length of time that a failover peer can renew a lease without
contacting its peer. The larger the number, the longer it takes for the peer to recover IP addresses after
moving to the PARTNER-DOWN state. The smaller the number, the more load your servers experience
when they are not communicating. The default is 3600 seconds.
— Max Load Balancing Delay(s): Specifies the cutoff after load balancing is disabled. The cutoff is based
on the number of seconds since a client sent its first DHCPDISCOVER message. For instance, if one of
the failover peers gets into a state where it is busy responding to failover messages but is not
responding to other client requests, the other peer responds to the client requests when the clients
retry. This does not cause a failover. The default is three seconds.
— Failover Settings: This is valid for Microsoft Management only. Modify failover association settings. For
information, see Configuring Failover Associations on page 1179.
If you modify failover settings from secondary Microsoft server settings, the appliance does not update
failover settings on NIOS for the following reasons:
• When DHCP synchronization is disabled for primary Microsoft server, you must enable DHCP
synchronization for primary Microsoft server to reflect the settings on NIOS.
• The primary synchronization interval must be completed. For example, consider that you are
modifying failover settings from secondary Microsoft server settings where the synchronization
interval for primary server is five minutes, and the time interval for the secondary server is one
minute. In this case, failover settings are updated on NIOS only after the primary server
synchronization interval, which is five minutes.
— Extensible Attributes: Add and delete extensible attributes that are associated with a failover association.
You can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.

Monitoring Failover Associations

After you configure a failover association, the peers establish a TCP connection for communication. In a normal
operational state, they send keepalive messages and database updates every time they grant a lease. However, there
are times when the failover association experiences problems and goes into a state other than NORMAL. You can
monitor the overall state of a failover association and the individual status of the peers to verify that the servers are
operating and communicating properly.
Both peers in a failover association maintain the same DHCP fingerprinting state (enabled or disabled) even when
one of the peers fails or becomes operational again. Note that both peers must be in the same Grid for the
fingerprinting state to stay the same. For information about DHCP fingerprinting, see About DHCP Fingerprints on
page 1359.
In this panel, you can also modify some of the data in the table. Double click a row of data, and either edit the data
in the field or select an item from a drop-down list. Note that some fields are read-only. For more information about
this feature, see Modifying Data in Tables on page 70.
To monitor the failover association status:
1. From the Data Management tab, select the DHCP tab -> Members tab -> IPv4 Failover Associations section.
Grid Manager displays the list of failover associations and their overall status.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1183

DHCP Failover

2. To view detailed information about a failover association, select the failover_association check box, and then
click the Show Status icon.
3. In the Failover Association Status dialog box, Grid Manager displays the overall status of the failover association
and the status of both the primary and secondary servers.
The failover association can be in one of the following states:
— OK (green): The failover association is functioning properly.
— DEGRADED (yellow): The failover association is degraded when one of the peers is giving out limited
addresses.
— FAILURE (red): The failover association is not functioning, may be because it is not completely configured.
The peers are not assigning IP addresses.
For each peer, Grid Manager displays the hostname or IP address, the status, and event date. The peer can be in
one of the following states:
— STARTUP: The server is starting up.
— NORMAL: The server is in a normal operational state in which it responds to its load balancing subset of
DHCP clients.
— PAUSED: This state allows a peer to inform the other peer that it is going out of service for a short period of
time so the other peer can immediately transition to the COMMUNICATIONS-INTERRUPTED state and start
providing DHCP service to DHCP clients.
— COMMUNICATIONS-INTERRUPTED: The servers are not communicating with each other. Both servers provide
DHCP service to DHCP clients from which they receive DHCP requests.
— PARTNER-DOWN: The server assumes control of the DHCP service because its peer is out of service.
— RECOVER: The server is starting up and trying to get a complete update from its peer and discovers that its
peer is in the PARTNER-DOWN state.
— RECOVER-WAIT: The server has got a complete update from its peer and is waiting for MCLT period to pass
before transitioning to the RECOVER-DONE state.
— RECOVER-DONE: The server completed an update from its peer.
— POTENTIAL-CONFLICT: The peers are not synchronized due to an administrative error or an incorrect state
transition. Check the failover configuration and correct the error.
— CONFLICT-DONE: This is a temporary state that the primary server enters after it received updates from the
secondary server when it was in the POTENTIAL-CONFLICT state.
— RESOLUTION-INTERRUPTED: The server responds to DHCP clients in a limited way when it is in this state.
— UNKNOWN: The DHCP server is in an unknown state. The failover association is not functioning properly,
may be because it is configured improperly. For example, failover association is not assigned to any DHCP
range.
— SHUTDOWN: This state allows a peer to inform the other peer that it is going out of service for a long period
of time so the other peer can immediately transition to the PARTNER-DOWN state and completely assume
control of the DHCP service.

Note: NIOS does not support PARTNER-DOWN and Force Recovery for a Microsoft DHCP failover association.

Deleting Failover Associations

You cannot delete a failover association if it is currently assigned to a DHCP range. If you want to delete a failover
association, ensure that it is not assigned to any DHCP range.
To delete a failover association:
1. From the Data Management tab, select the DHCP tab -> Members tab -> Failover Associations ->
failover_association check box, and then click the Delete icon.
2. In the Delete Confirmation dialog box, click Yes.
The appliance puts the failover association in the recycle bin, if enabled.

1184 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Failover Associations

Setting a Peer in the Partner-Down State

If one of the peers in a failover association is out of service for an extended period of time, you should consider
putting the functional peer in the PARTNER-DOWN state. When you place the functional peer in the PARTNER-DOWN
state, it assumes full DHCP services for the networks. Since the functional server may not receive all the updates from
its peer, it extends all the leases on the MCLT. Once the following conditions are met, the functional peer provides
DHCP services autonomously:
• It has reclaimed all the leases that belonged to its peer.
• The MCLT has passed.
When the peer that is offline comes back online, it synchronizes with the functional peer and reestablishes the
communication before it provides DHCP services to the clients.

WARNING: Before you put a peer in the partner-down state, ensure that the other peer is indeed out of
service. If both the primary and secondary servers are operational when you place one of them in
the partner-down mode, both servers may stop issuing leases for a minimum of time defined in the
MCLT.

To set a peer in the PARTNER-DOWN state:

1. From the Data Management tab, select the DHCP tab -> Members tab-> Failover Associations ->
failover_association check box.
2. Expand the Toolbar and click Set Partner Down.
3. In the Set Failover Association Partner Down dialog box, select one of the following:
— Primary: Select this if the secondary server is out of service.
— Secondary: Select this if the primary server is out of service.
4. Click OK.

Note: You cannot place the functional peer in the PARTNER-DOWN state for a Microsoft DHCP failover in NIOS.

Performing a Force Recovery

When the primary and secondary peers are not synchronized, you can perform a force recovery to set the primary
server in the PARTNER-DOWN state while putting the secondary server in the RECOVER state. During a force recovery,
all leases in the databases are resynchronized. When you perform a force recovery, the secondary server does not
serve any DHCP leases for a minimum of the MCLT while it resynchronizes with the primary server. Before you perform
a force recovery, consult with Infoblox Technical Support or your Infoblox representative to ensure that the force
recovery is appropriate for the situation.
To perform a force recovery:
1. From the Data Management tab, select the DHCP tab -> Members tab-> Failover Associations ->
failover_association check box.
2. Expand the Toolbar and click Force Recovery State.
3. In the Force Secondary Peer Recovery State dialog box, click OK.
The appliance synchronizes the databases on the primary and secondary servers.

Note: You cannot place the functional peer in the PARTNER-DOWN state for a force recovery in NIOS.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1185

DHCP Failover

Recovering DHCP Failover Associations

During a conflict resolution, when the primary peer of the DHCP failover association is in the CONFLICT-DONE state
and the secondary peer in the POTENTIAL-CONFLICT state, the secondary peer might experience problems (such as
restarting, network outage, etc.) and goes into an invalid state. This results in a deadlock state for the failover
association, causing a DHCP service outage. When the failover association is in a deadlock state, you can perform a
recovery for the failover association. You can run the recovery for one failover association at a time and when the
primary member is in the CONFLICT-DONE state. This feature is supported for Infoblox appliances only and not for any
other external DHCP servers.

Note: When the failover recovery is in progress, the DHCP service on both peers are disabled and you cannot enable
the DHCP service until the failover recovery is successfully completed. You can view the logs of the failover
recovery process in the syslog and infoblox.log file.

To recover a DHCP failover association:

1. From the Data Management tab, select the DHCP tab -> Members tab-> Failover Associations ->
failover_association check box.
2. Expand the Toolbar and click Recovery from Deadlock State.
3. In the Failover Recovery Progress dialog box, click Start to start the recovery of the failover association from the
deadlock state.
4. In the confirmation dialog box, click Yes.

Note: After you start the failover recovery, you cannot revert the changes.

Grid Manager starts the failover recovery and you can view the following information in the Failover Recovery Progress
dialog box:
• Failover association: The name of the failover association.
• Primary: The hostname or IP address of the primary server.
• Secondary: The hostname or IP address of the secondary server.
• Number of leases to be processed: The total number of leases to be processed.
• Number of leases processed: The number of leases that have been processed.
• Current Status: Displays the current status of the failover recovery process. The current status can be one of the
following:
— Pending: The failover recovery is initiated for a failover association and the recovery process will start soon.
— Calculating: The appliance calculates the total amount of leases to be processed.
— Applying: The appliance looks for conflicts and tries to resolve the conflicts.
— Completed: The failover recovery is completed successfully.
— Failed: The failover recovery fails.
Grid Manager also displays the reason for the failure if that happens.
After successful completion of the failover recovery, you must restart both the primary and secondary peers to bring
them back to the CONFLICT-DONE state.
You can stop the failover recovery operation by clicking Stop in the Failover Recovery Progress dialog box before the
recovery process is complete.

Note: If for any reasons the recovery is blocked when the operation is in progress, you can cancel the current
operation and start the recovery for the failover association again.

1186 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 31 Configuring IPv4 DHCP Filters
This chapter explains how to configure IPv4 DHCP filters. It contains the following sections:
• About IPv4 DHCP Filters on page 1188
— IP Address Allocation on page 1188
— IP Address Allocation Using Filters on page 1191
• About MAC Address Filters on page 1193
— Defining MAC Address Filters on page 1194
— Adding MAC Address Filter Items on page 1195
• About Relay Agent Filters on page 1195
— Defining Relay Agent Filters on page 1196
• About Option Filters on page 1197
— Defining Option Filters on page 1198
— Configuring User Class Filters on page 1201
— Configuration Example: Using Option Filters on page 1201
• About DHCP Fingerprint Filters on page 1202
— Defining DHCP Fingerprint Filters on page 1204
• Applying Filters to DHCP Objects on page 1204
— Adding Filters to the Class Filter List on page 1204
— Adding Filters to the Logic Filter List on page 1205
— Configuration Example: Using the Class and Logic Filter Lists on page 1207
• Managing DHCP Filters on page 1210
— Modifying DHCP Filters on page 1210
— Viewing DHCP Filters on page 1211
— Deleting Filters on page 1212

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1187

Configuring IPv4 DHCP Filters

About IPv4 DHCP Filters

To control how the appliance allocates IPv4 addresses, you can define DHCP filters and apply them to Grid, members,
DHCP ranges, range templates, IPv4 network containers, IPv4 networks, shared networks, IPv4 network templates,
IPv4 fixed addresses, IPv4 fixed address templates, IPv4 reservations, IPv4 reservation templates, and IPv4 host
addresses. You can override filters set at an upper level and apply a new logic filter. Depending on your configuration,
DHCP filters screen requesting clients by matching MAC addresses, relay agent identifiers, DHCP options, or DHCP
fingerprints you define in the filters. If you configure DHCP servers in the Grid to send authentication requests to a
RADIUS authentication server group, you can also filter requests by matching the authentication results. (For
information about this feature, see Chapter 32, Authenticated DHCP, on page 1213.)
When you define DHCP filters, you classify DHCP clients based on the information provided by the clients or by the
RADIUS server. When you apply filters to an address range, the appliance responds to your address requests based
on your configuration. The appliance also decides which DHCP options to return to the matching clients based on how
you apply the filters. For more information, see Applying Filters to DHCP Objects on page 1204.
You can use filters to control address allocation based on your network requirements. For example, you can use DHCP
filters to screen unmanaged hosts on a network by denying their address and option requests. If you have multiple
DHCP address ranges on the same network and you want to assign IP addresses from specific address ranges to
specific clients, you can use filters to screen the address assignments. For information, see IP Address Allocation.
The appliance supports the following filters:
• MAC address filters: Use MAC addresses as matching criteria for granting or denying address requests. For
information, see About MAC Address Filters on page 1193.
• Relay agent filters: Identify remote hosts by matching the relay agent identifiers in the DHCPDISCOVER
messages. For information, see About Relay Agent Filters on page 1195.
• Option filters: Classify hosts by matching the DHCP options and values sent by the requesting hosts. For
information, see About Option Filters on page 1197.
• DHCP fingerprint filter: Identify remote clients by matching the option number sequence or vendor ID sent in
option 55 and 60 of the DHCP request against the DHCP fingerprints cached on the system. For information
about DHCP fingerprint filters, see About DHCP Fingerprint Filters on page 1202. For information about DHCP
fingerprint detection, see DHCP Fingerprint Detection on page 1357.
• NAC filters: Use authentication results from a RADIUS authentication server group as matching criteria for
granting or denying address requests. For information, see Chapter 32, Authenticated DHCP, on page 1213.
You can use MAC, option, and NAC filters to define DHCP options that matching clients can receive. Depending on
how you apply a filter, all DHCP clients with matching criteria can receive all or some of the DHCP options defined in
the filter. DHCP options defined for a matching filter supersede those defined at the Grid, member, network, and
DHCP range levels. Options defined for a filter that is in the Class Filter List of an address range supersede those
defined in the Logic Filter List. For more information about how the appliance returns options and how to apply DHCP
filters, see Applying Filters to DHCP Objects on page 1204.

IP Address Allocation
When a DHCP client requests an IP address, the NIOS appliance draws an address from an address range associated
with the network segment for that client. Because you define that range, you can thereby control the IP address
(within the defined range) and the associated TCP/IP settings that the client receives.
In Figure 31.1, three hosts—each in a different subnet—request an IP address. Each one broadcasts a DHCPDISCOVER
message, which includes its MAC address. When the router, which also functions as a DHCP relay agent, receives the
message, it adds the IP address of the interface on which the message arrives and forwards the message to the DHCP
server—or servers—previously configured on the router. When the NIOS appliance receives the message, it uses the
ingress interface IP address of the router to determine the network segment to which the host belongs and associates
the MAC address of the requesting host with an IP address from an address range for that network.

1188 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Filters

Figure 31.1 Requesting Addresses – DHCPDISCOVER Messages

1 When each host

broadcasts a
2 When the relay agent
DHCPDISCOVER
receives the
message, it includes 3 When the NIOS appliance
DHCPDISCOVER message,
its MAC address. receives the DHCPDISCOVER
it adds the IP address of the
message, it uses the ingress 
ingress interface to the
interface IP address on the relay
message. It then forwards
Hosts requesting agent to determine the network
the message using IP
IP addresses segment to which the host belongs. 
unicast to the DHCP server.
It then assigns an address to that 
host from the address range
DHCPDISCOVER belonging to that subnet. 
Furthermore, it associates the IP
address with the source MAC 
address of the host.
10.1.1.1

10.2.1.1 10.4.1.1

Router
DHCPDISCOVER (Relay Agent) NIOS Appliance
10.3.1.1
Networks

10.1.1.0/24
Address Range
10.1.1.20 -
10.1.1.200

10.2.1.0/24

Address Range
10.2.1.20 -
10.2.1.200

DHCPDISCOVER 10.3.1.0/24
Address Range
10.3.1.20 -
10.3.1.200

The NIOS appliance replies to DHCPREQUEST messages by sending DHCPOFFER messages through the relay agent to
the requesting hosts, as shown in Figure 31.2 on page 1190.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1189

Configuring IPv4 DHCP Filters

Figure 31.2 Requesting Addresses – DHCPOFFER Messages

1 The NIOS appliance associates the

MAC address of each requesting
2 When the relay agent receives host with an IP address from an
the DHCPOFFER messages, it address range in the same network
broadcasts each one from the segment as the ingress interface of
interface on which it originally the relay agent.
received the corresponding The appliance then sends unicast
Hosts requesting DHCPDISCOVER message (if
IP addresses DHCPOFFER messages to the
the broadcast flag is set to 1). ingress interface IP addresses of the
relay agent to return to each host.
DHCPOFFER

10.1.1.1

10.2.1.1 10.4.1.1

Router
DHCPOFFER (Relay Agent) NIOS Appliance

10.3.1.1 Networks

10.1.1.0/24
Address Range
10.1.1.20 -
10.1.1.200

10.2.1.0/24
Address Range
10.2.1.20 -
10.2.1.200

DHCPOFFER 10.3.1.0/24
Address Range
10.3.1.20 -
10.3.1.200

The addressing scheme depicted in Figure 31.1 on page 1189 and Figure 31.2 is fairly simple: each network has a
single address range. Consequently, address assignments are fairly straightforward. However, if you have multiple
address ranges in the same network and you want to assign addresses from specific address ranges to specific hosts,
you must screen the address assignments through the use of filters. If you do not apply a filter, the NIOS appliance
assigns addresses from the highest address range to the lowest range and within each range from the highest
address to the lowest address. That is, the appliance chooses the range with the highest addresses first (that is,
closest to 255) and begins assigning addresses exclusively from that range, starting with the highest address and
finishing with the lowest (closest to 0). When all the addresses from that range are in use, it then begins assigning
addresses from the next highest range, and so on, finishing with the range with the lowest addresses. This is shown
in Figure 31.3 on page 1191.

Note: After the DHCP server runs for a while, it assigns leases based on when it last used addresses, and not just on
their positions in the range.

1190 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IPv4 DHCP Filters

Figure 31.3 Multiple Address Ranges without Filters

The NIOS appliance assigns

addresses to both hosts from the
same address range—first to Host
A, and then to Host B. NIOS Appliance

1 Host A receives 10.1.1.200

2 Host B receives 10.1.1.199

Host A
Network
Host B

If more hosts request addresses, 10.1.1.0/24

the appliance continues to assign
them from address range 2— the
next address being 10.1.1.198, 
then 10.1.1.197, and so on—until  Address Range 1 Address Range 2
all the addresses in that range are 10.1.1.20 - 10.1.1.81 -
in use. 10.1.1.80 10.1.1.200
Then the appliance starts assigning
addresses from address range 1,
starting at 10.1.1.80, and stopping
at 10.1.1.20.

IP Address Allocation Using Filters

To control the assignment of addresses from specific address ranges to specific hosts, the NIOS appliance provides
the following filters:
• A MAC address filter to which you add MAC addresses as filter criteria. For information, see About MAC Address
Filters on page 1193.
• A relay agent filter with configured circuit ID and remote ID as specified by the relay agent (DHCP option 82). For
information, see About Relay Agent Filters on page 1195.
• An option filter in which you specify DHCP options and matching values. For information, see About Option
Filters on page 1197.
• A NAC filter in which you specify authentication results from a RADIUS authentication server group as filter
criteria. For information, see About NAC Filters on page 1238.
When the appliance receives an address request, it checks if the request matches a filter. If it does not, the appliance
assigns an address from the address range with the highest available IP address. If the request matches at least one
class filter for a range, the appliance applies the following rules:
• If there are grant address filters applied to that range, the request must match one of the class filters or the
appliance does not grant an address from that range.
• If there are deny address filters applied to that range, the request must not match any of the filters. If the
request matches a deny filter, the appliance does not grant an address from that range.
• If an address range has a combination of grant and deny filters, the request must:
— Match a grant filter
— Not match a deny filter
Two rules govern the behavior of the appliance in relation to DHCP filters:
1. Depending on your filter configuration, the appliance checks if any data in an address request (such as the MAC
address of the client, DHCP options 77 and 82, etc.) matches any filters applied to an address range.
2. The appliance checks for available addresses in the address ranges containing the highest addresses first.
(“Highest” means closest to 255.255.255.255, and “lowest” means closest to 0.0.0.0.)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1191

Configuring IPv4 DHCP Filters

These two rules can work in coordination. For example, when the appliance receives an address request, it first
checks if the request matches any filter. If it matches more than one filter assigned to different address ranges, the
appliance first applies the filter that belongs to the range with the highest IP addresses. If that address does not grant
an address lease (because the filter action is Deny or all address leases in that range are already in use), the
appliance then applies the matching filter for the range with the next higher set of IP addresses. If the appliance still
has not granted a lease from the address ranges whose filters match data in the request and there are unfiltered
address ranges, the appliance attempts to assign an address from one of these ranges, again beginning with the
range having the highest IP addresses.Figure 31.4 presents an example illustrating the sequence in which the
appliance assigns addresses when a request matches a MAC address filter. For information about MAC address
filters, see About MAC Address Filters on page 1193.

Figure 31.4 DHCP Address Assignment with Multiple Filters

NIOS Appliance

Four Address Ranges

No filter, but the NIOS

appliance cannot grant 10.4.4.10—
3 the lease because all Unfiltered
10.4.4.20
addresses are in use.

Address MAC address matches a

Request filter with action Grant, Filter: If MAC address =
1 but the appliance cannot 10.3.3.10—
aa:bb:cc:dd:ee:ff,
grant the lease because 10.3.3.20
grant lease
all addresses are in use.

DHCP Client MAC MAC address matches Filter: If MAC address =

Address: filter, but the filter action 10.2.2.10—
aa:bb:cc:dd:ee:ff
2 aa:bb:cc:dd:ee:ff,
is Deny. 10.2.2.20
deny lease

No filter and at least one

Address address is available, so 10.1.1.10—
4 the appliance grants an Unfiltered
Offer 10.1.1.20
address from this range.

1192 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About MAC Address Filters

The following explains how the NIOS appliance applies filters to DHCP address requests:

If then
the appliance receives a request that it applies the action specified in the filter for that address range. If it
matches a filter for one address range, does not assign an address from that range (the action is deny or the
action is grant but all addresses in that range are in use), the
appliance then checks if it can assign an address from an unfiltered
address range (if there are any), starting with the range with the
highest addresses first, as shown in Figure 31.3 on page 1191.
the same filter applies to multiple it checks the address range with the highest IP addresses matching
address ranges and the appliance that filter. If the appliance does not assign an address from that range,
receives an address request matching it checks the filtered address range with the next highest IP addresses,
that filter, and so on. If it still has not assigned an address, the appliance starts
checking unfiltered address ranges (if there are any), again beginning
with the range with the highest address first.
multiple filters for the same address the filter denying the lease takes precedence. For example, if a
range conflict with each other (one filter requesting client matches both a MAC address filter (granting a lease)
grants a lease and another denies it) and and a user class filter (denying a lease) for the same address range,
a requesting client matches both filters, the appliance denies the lease. When faced with a choice to either
allow or deny a lease based on equal but contradictory filters, the
appliance takes the more secure stance of denying it.

About MAC Address Filters

The appliance can filter an address request by the MAC address of a requesting host. Depending on how you apply
the MAC filter, the appliance can grant or deny the address request if the requesting host matches the filter criteria.
You can also define DHCP options that you want to return to the matching client if the options are so configured. The
client can also request specific options to be returned through DHCP option 55. The appliance returns DHCP options
to matching clients based on how you apply the filters. For information, see Applying Filters to DHCP Objects on page
1204.
You can configure a MAC address filter or specific MAC addresses within a filter to expire after a certain amount of
time has passed. Filter expiration is useful in situations where you want to keep filters running against updated MAC
addresses. The permission to use the MAC addresses assigned to an IP address may become invalid after a certain
period of time. For example, you can use a MAC address filter to restrict the right to use MAC addresses assigned to
IP addresses for visiting guests or temporary workers. You can avoid removing invalid addresses from address filters
manually by configuring the appliance to expire filters or to expire specific addresses within filters.
To apply a MAC address filter to an address range:
1. Define a MAC address filter. For information, see Defining MAC Address Filters.
2. Add a MAC address to the filter. For information, see Adding MAC Address Filter Items on page 1195.
3. Apply the filter to a DHCP address range or range template, and specify that if the MAC address of a requesting
host matches the filter definition, the appliance either grants or denies the address assignment. For information,
see Applying Filters to DHCP Objects on page 1204.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1193

Configuring IPv4 DHCP Filters

Defining MAC Address Filters

To define a MAC address filter:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and click
Add -> IPv4 MAC Address Filter.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> IPv4 MAC Address Filter.
2. In the Add IPv4 MAC Filter wizard, complete the following:
— Name: Enter a meaningful name for the filter. For example, if you want to filter address requests by
department, you can name one filter “Marketing”, another “Finance”, and so on. The name must be unique
within a specific network. If you want to specify option settings in the filter, the filter name must be unique
among all MAC filters.
— Comment: Enter useful information about the filter.
3. Click Next and complete the following to define the DHCP options to return to the matching client:
— Option Space: Select an option space from the drop-down list. This field is displayed only when you have
custom option spaces. The appliance uses the DHCP option space as the default.
— Lease Time: Enter the value of the lease time in the field and select the time unit from the drop-down list.
The lease time applies to hosts that meet the filter criteria.
Options to Merge with Object Options
Click the Add icon. Grid Manager adds a new row to the table with the default DHCP option space and option
name displayed. Complete the following:
— Option Space: Click the down arrow and select an option space from the drop-down list. The selected
option space contains the corresponding DHCP options.
— Option Name: Click the down arrow and from the drop-down list, select the DHCP option you want to return
to the requesting host.
— Value: Enter the value that you want the filter to return for the selected DHCP option. For example, enter the
value 255.255.255.0 for the subnet-mask option.
To add more options to the filter, click the Add icon and repeat the steps.
4. Click Next and complete the following to configure the expiration setting:
— Default MAC Address Expiration
Select one of the following to configure the expiration setting for the filter:
— Never Expires: Select this if you want the MAC address filter to never expire. This is selected by default.
— Automatically Expires in: Select this if you want the filter to expire after a specific time frame. You can
specify the time in seconds, minutes, hours, or days.
The filter expiration time you configure here affects how long the DHCP server grants a lease to a client.
It has an upper limit of 15 minutes on the lease time you configure for the Grid. For example, if both the
filter expiration time and the lease time are less than 15 minutes, the appliance uses the lease time. If
both the filter expiration time and lease time are greater than 15 minutes, the appliance uses the filter
expiration time. If the filter expiration time is less than 15 minutes and the lease time is greater than 15
minutes, the DHCP server grants a lease for 15 minutes. If the filter expiration time is greater than 15
minutes and the lease time is less than 15 minutes, the appliance uses the lease time.
— Enforce Expiration Times : Select this to enable the expiration setting.
— Enabled: The filter is enabled by default. Clear the check box to disable this filter.
5. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
6. Save the configuration and click Restart if it appears at the top of the screen.

1194 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Relay Agent Filters

Adding MAC Address Filter Items

To add a MAC address to a MAC address filter:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and click
Add -> IPv4 MAC Address Filter Item.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> IPv4 MAC Address Filter Item.
2. In the Add IPv4 MAC Address Filter Item wizard, complete the following:
— MAC Address Filter: Click Select Filter. In the DHCP Filter Selector dialog box, select the MAC address filter to
which you want to add a MAC address, and then click the Select icon. If you are adding a MAC address to a
filter that you have selected in the Filters panel, Grid Manager displays the selected filter in this field.
— MAC Address: Enter the MAC address in one of the following formats: aa:bb:cc:dd:ee:ff, aa-bb-cc-dd-ee-ff,
aabb.ccdd.eeff, aabbcc-ddeeff, and aabbccddeeff. The appliance displays the address in the
AA:BB:CC:DD:EE:FF format. You can also enter a vendor prefix in the three hexadecimal format using the
same separators supported in the MAC address format. For example, you can enter aa.bb.cc as the vendor
prefix. The appliance displays AA:BB:CC.
— Comment: Enter useful information about the filter item.
— Expiration Time: MAC addresses in a filter stay valid until you explicitly configure them to expire. You can
enable expiration for specific MAC addresses in the filter. Select one of the following:
— Never Expires: Select this if you want the MAC address to never expire. This is selected by default.
— Expires on: Select this and specify the Date and Time for the expiration. The fields display the current
date and time. If you have already configured an expiration time for the filter, the appliance displays
the time here by adding the filter expiration time to the current time. For example, if the expiration time
for the filter is two days and the current date is June 6, 2009, the appliance displays June 8, 2009 in the
Date field.
3. Click Next and select one of the following to configure user registration (optional):
— Register as User: Select this and enter a username in the field.
— Register as Guest: Select this and enter the first name, middle name, last name, email address, and phone
number of the guest user.
The appliance displays the information you enter here in the lease viewers.
4. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
5. Save the configuration and click Restart if it appears at the top of the screen.
After you define a MAC address filter and add MAC addresses to it, you can assign the filter to a DHCP range. The
appliance filters IP address requests based on the filter criteria. For information, see Applying Filters to DHCP Objects
on page 1204.

About Relay Agent Filters

The NIOS appliance can filter an address request by the circuit ID and remote ID of a requesting host. The filter
instructs the appliance either to grant or deny an address request if the requesting host matches the filter. For
information about the DHCP relay agent option, see About the DHCP Relay Agent Option (Option 82) on page 1085.
Option 82 assists the agent in forwarding address assignments across the proper circuit. When a relay agent receives
a DHCPDISCOVER message, it can add one or two agent IDs (circuit ID and remote ID) in the DHCP option 82 suboption
fields to the message, as illustrated in Figure 31.5. If the agent ID strings match those defined in a relay agent filter
applied to a DHCP address range, the appliance either assigns addresses from that range or denies the request based
on the configured parameters.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1195

Configuring IPv4 DHCP Filters

Figure 31.5 Relay Agent Filtering

Sample client ID types: Sample remote ID types:

• Unit-slot-port number of network • User name (as prompted by
access server network access server)
• ATM virtual circuit number • Remote caller ATM address
• Cable data virtual circuit number • Modem ID for a cable data modem

The Remote ID is Circuit ID

set on the relay Remote ID
agent to identify
the remote host.
Remote Host Network Access
DHCP Client Point
Switched Circuit Relay Agent

Internet
DHCPDISCOVER

DHCPDISCOVER +
Option 82 Data
• Remote ID
• Circuit ID

The relay agent adds option 82 data to The NIOS appliance checks for a
DHCPDISCOVER and DHCPREQUEST match between the remote and
messages that it receives from the DHCP client. circuit identifiers in the address
request and its filters for address
DHCP Option 82 suboptions can specify a ranges. When it finds a match, it
remote ID for the DHCP client and a circuit ID assigns the DHCP client an
for the connection between the client and the address from that address range.
access point. NIOS Appliance
DHCP Server

To apply a relay agent filter to an address range:

1. Define a relay agent filter. For information, see Defining Relay Agent Filters.
2. Apply the filter to a DHCP address range or range template, and specify that if the circuit ID or remote ID of a
requesting host matches the filter definition, the appliance either grants or denies the address assignment. For
information, see Applying Filters to DHCP Objects on page 1204.
3. Define the access privileges of limited-access admin group for relay agent filters. For information, see Managing
Administrators on page 183.

Defining Relay Agent Filters

To define a relay agent filter:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and click
Add -> IPv4 Relay Agent Filter.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> IPv4 Relay Agent Filter.
2. In the Add IPv4 Relay Agent Filter wizard, complete the following:
— Name: Enter a meaningful name for the filter. For example, you can enter the IP address or the name of the
router acting as the relay agent. The name must be unique within a specific network.
— Comment: Enter useful information about the filter.

1196 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Option Filters

3. Click Next to define the relay agent ID type. If you apply both ID types, the relay agent must provide both
identifiers when submitting a DHCP address request.
Select one of the following for both Circuit ID and Remote ID:
— Any: Select this and the filter matches any of the circuit identifiers for remote hosts. You cannot select this
for both circuit ID and remote ID at the same time.
— Not Set: Select this and no circuit identifier is set for remote hosts.
— Matches Values: Select this and enter the circuit ID or remote ID in the field. You can enter the ID in
hexadecimal format, such as 1f:cd, ab, or ef:23:56, or in string format, such as abcd or aa:gg. The appliance
matches the value you enter here with the value sent by the DHCP client in counted octet sequence format.
This field supports wildcard characters and regular expressions. You can also select to have an exact match
or a substring match, as follows:
— Exact Match: Select this to match the exact value sent by the DHCP client that contains the value you
entered in the Matches Values field.
— Substring: Select this to match a substring of the value sent by the DHCP client. Enter the Offset and
Length values for the substring match, as follows:
• Offset: Enter the number of characters at which the match value for the substring starts. Enter 0 to
start at the beginning of the value, enter 1 for the second position, and so on. For example, when
you enter 2 and have a substring value of AFTR, the appliance matches the value AFTR starting at
the third character of the match value.
• Length: Enter the length of the substring value. For example, if the match value is AFTR, the length
is 4.
4. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
5. Save the configuration and click Restart if it appears at the top of the screen.
After you define a relay agent filter, you can assign it to a DHCP range. The appliance responds to address requests
based on the filter criteria. For information, see Applying Filters to DHCP Objects on page 1204.

About Option Filters

You can use option filters to classify DHCP clients and decide which DHCP options each group of clients can receive.
By default, regardless of the networks in which the DHCP clients reside and whether an option filter is applied to a
DHCP range or range template, all DHCP clients that match the filter criteria receive the DHCP options and values you
define in the filter. You can change this configuration so the appliance does not use the filter to classify DHCP clients.
For information about how to configure this, see Defining Option Filters on page 1198.
You can add DHCP options and the Hardware Operator option to an option filter. (For information about the Hardware
Operator option, see DHCP Hardware Operator.) Depending on whether the options you add to the filter are also
defined at the Grid, member, network, and DHCP range levels, and whether you add the filter to the Class Filter List
or Logic Filter List, the appliance either appends them to the existing options or overwrites the option values before
returning them to the matching clients. For more information about how the appliance returns DHCP options, see
Adding Filters to the Logic Filter List on page 1205.
The appliance can filter an address request by the options (such as root-server-ip-address or user-class) of the
requesting host. Depending on how you apply an option filter, the appliance can grant or deny an address request if
the requesting host matches the filter criteria. You can also create complex match rules that use the AND and OR logic
to further define the filter criteria. When you select match rules in Grid Manager, you can preview the rules before
committing them to the filter. Grid Manager provides an expression builder that automatically builds the rules after
you define them. For information, see Defining Option Filters on page 1198.
To define an option filter and apply it to an address range:
1. Define an option filter based on either the predefined or custom DHCP options. For information, see Defining
Option Filters.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1197

Configuring IPv4 DHCP Filters

2. Apply the filter to a DHCP address range or range template in the Class Filter List or Logic Filter List. For
information, see Applying Filters to DHCP Objects on page 1204.
After you define an option space and add options to it, you can set up option filters and define option values. For
example, to handle two different client classes, you can define two option filters (vendor-class_1 and vendor-class_2)
and send different option values to different clients based on the vendor-class-identifier options that you obtain from
the clients.

DHCP Hardware Operator

You can define the Hardware Operator option and add it as a match rule to an option filter. This option enables the
appliance to match the hardware type and MAC address of the DHCP client, which it derives from the hardware type,
hlen (hardware length) and chaddr (client hardware address) fields of the client’s DHCP Discover and Renew packets.
To add Hardware Operator to an option filter, fill in the fields as follows:
• In the first drop-down list, select Hardware Operator. Note that because it is not a DHCP Option, it does not have
an actual option number.
• In the second drop-down list, select one of the following operators: equals, does not equal, substring equals
and substring does not equal.
If the operator is substring equals or substring does not equal, specify the offset and length.
• In the text field, enter the string that represents the hardware type and MAC address to match. For example, the
htype value is 1 for the Ethernet hardware type. The hardware types (hrd) are defined at
http://www.iana.org/assignments/arp-parameters/arp-parameters.xml#hardware-type-rules.
This filter rule assumes that the values exist in the DHCP packets.
The following table provides examples of rules that include the Hardware Operator option. The entry in the first
drop-down list for all rules is Hardware Operator.

Table 31.1 Hardware Operator Sample Rules

Second Drop-Down List Text Field

Rule Description Offset Length
(operator) (string)
Match a hardware type and MAC equals 01:00:C0:B0:AA:BB:CC
address.
Match hardware type only. substring equals 01 0 1
Match the vendor MAC prefix (first substring equals 00:C0:B0 1 3
three bytes of MAC address).

Defining Option Filters

To define an option filter:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and click
Add -> IPv4 Option Filter.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> IPv4 Option Filter.
2. In the Add IPv4 Option Filter wizard, complete the following:
— Name: Enter a meaningful name for the option filter. For example, you can enter Linux if you plan to use this
option filter to screen Linux systems. The name must be unique within a specific network. If you want to
specify option settings in the filter, the filter name must be unique among all option filters.
— Comment: Enter useful information about the filter.

1198 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Option Filters

— Apply this filter as a global DHCP class: This check box is selected by default. When you select this check
box, the appliance defines a global class statement in the dhcpd configuration file for members that have
DHCP enabled, regardless of whether the filter is applied to a DHCP range or range template. All DHCP
clients that belong to this class receive the DHCP options and values you define in the filter. When you clear
this check box, you cannot apply this filter to the Class Filter List of a range or range template. You cannot
clear this check box if the filter is currently applied to a range or range template. The appliance displays an
error message when you try to save this configuration.
3. Click Next and complete the following to add match rules:
— In the first drop-down list, select a DHCP option. For example, select user-class (77) for a specific user class,
such as mobile users.
— In the second drop-down list, select an operator.
If you select equals or does not equal, enter the value of the selected option you want the filter to match in
the field.
If your operator and match value include a substring of an option value, enter the offset and length of the
substring based on the following definitions:
— Offset: Enter the number of characters at which the match value substring starts in the option data.
Enter 0 to start at the beginning of the option data, enter 1 for the second position, and so on. For
example, when you enter 2 and have a match value of MSFT, the appliance matches the value MSFT
starting at the third character of the option data.
— Length: Enter the length of the match value. For example, if the match value is MSFT, the length is 4.
You can do the following and repeat the filter selection steps to add another rule:
— Click + to add another rule at the same level.
— Click |<- to add an all (logical AND) or any (logical OR) operator line and a parenthetical rule that is indented
one level and above the first rule.
— Click ->| to add an all (logical AND) or any (logical OR) operator line and a parenthetical rule that is indented
one level.
After you add all the match rules, you can click Preview to view the rules that are written to the dhcpd
configuration file or click Reset to remove the previously configured rules and start again. For information about
how to use match rules, see Using Match Rules in Option Filters on page 1200.
4. Click Next and complete the following to define which DHCP options to return to the matching client:
— Option Space: Select an option space from the drop-down list. This field is not displayed if you do not have
custom option spaces. The appliance uses the DHCP option space as the default.
— Lease Time: Enter the value of the lease time in the field and select the time unit from the drop-down list.
The lease time applies to hosts that meet the filter criteria.
Options to Merge with Object Options
Click the Add icon. Grid Manager adds a new row to the table with the default DHCP option space and option
name displayed. Complete the following:
— Option Space: Click the down arrow and select an option space from the drop-down list. The selected
option space contains the corresponding DHCP options that you can use as filter criteria.
— Option Name: Click the down arrow and from the drop-down list, select the DHCP option you want to use as
filter criteria.
— Value: Enter the match value that you want the filter to use for the selected DHCP option.
To add more options to the filter, click the Add icon and repeat the steps.
5. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
6. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1199

Configuring IPv4 DHCP Filters

Using Match Rules in Option Filters

Each match rule you define in an option filter further defines the filter criteria of a matching client. You can add
multiple match rules to an option filter. The appliance writes these rules to the dhcpd configuration file. You can also
create complex match rules that use the AND and OR logic to further define the filter criteria. After you define the
match rules, you can preview the rules before committing them to the filters.
For example, you can define the following rules in an option filter:
DHCP option = vendor-class-identifier
Substring offset = 0 (the match value starts at the beginning of the option data received from the client)
Substring length = 4 (the length of the match value MSFT)
Match value = MSFT
The appliance generates the following rules in the dhcpd configuration file:

class "microsoft-other" {
match if substring (option vendor-class-identifier,
0, 4) = "MSFT";
vendor-option-space MSFT;
DHCP option
}
Match value

Length of the match value

Substring offset

You can also define more complex rules using the AND and OR logic as follows:
DHCP option = vendor-class-identifier
Match value = infoblox2000a
OR
DHCP option = vendor-encapsulated-options
Substring offset = 0 (the match value starts at the first character of the option data received from the client)
Substring length = 8 (the length of the match value infoblox)
Match value = infoblox
AND
DHCP option = vendor-encapsulated-options
Substring offset = 10 (the match value starts at the ninth character of the option data received from the client)
Substring length = 5, the length of the match value 2000a
Match value = 2000a
The appliance generates the following rules in the dhcpd configuration file:
class "infoblox" {
match if (option vendor-class-identifier=infoblox2000a:) or
((substring(option vendor-encapsulated-options,0,8)="infoblox") and
(substring(option vendor-encapsulated-options,10,5)="2000a"));
vendor-option-space DHCP
}

1200 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Option Filters

Configuring User Class Filters

The NIOS appliance can filter DHCP address requests by user class filters. A user class indicates a category of user,
application, or device of which the DHCP client is a member. User class identifiers are configured on DHCP clients and
are sent during a DHCP address request operation. The client includes the user class identifier in DHCP option 77
when sending DHCPDISCOVER and DHCPREQUEST messages.
By using user class identifiers, a DHCP server can screen address requests and assign addresses from select address
ranges based on the different user class identifiers it receives. For example, if you assign a user class filter named
mobile to a range of addresses from 10.1.1.31–10.1.1.80, the appliance selects an address from that range if it
receives an address request that includes the user class name mobile and there are still addresses available in that
range. You might want mobile users to receive these addresses because you have given them shorter lease times
than other, more stationary DHCP clients. See Figure 31.6.

Figure 31.6 Applying User Class Filtering

The user class for laptop A is mobile. When it The NIOS appliance has a filter that screens
sends DHCPDISCOVER and DHCPREQUEST address requests by user class. If the user class
messages, it includes its user class in the for a DHCP client is mobile, the appliance assigns
DHCP option 77 field. it an address from address range 2.

Laptop A receives 10.1.1.80

from address range 2.
NIOS Appliance
Laptop A
User Class = mobile
Network
Note: The leases for addresses in
address range 2 are shorter than 10.1.1.0/8
those for more stationary
computers. The intended use for Address Range 1 Address Range 2
address range 2 is to provide IP 10.1.1.20 - 10.1.1.31 -
addresses for mobile users who log 10.1.1.30 10.1.1.80
in to the network for relatively short
periods of time and, therefore, do Address Range 3
not require longer leases. 10.1.1.81 -
10.1.1.160

If the NIOS appliance receives address requests with the user class mobile and there are no available addresses in
address range 2 but there are available addresses in ranges 1 and 3, the appliance begins assigning addresses from
address range 3 (because its addresses are higher than those in range 1). Then, if all addresses in range 3 are in use,
the appliance begins assigning addresses from address range 1. If you want the appliance to assign addresses to
mobile users (that is, those identified with the user class mobile) exclusively from address range 2, then you must
apply user class filters for “mobile” to address ranges 1 and 3 that deny lease requests matching that user class.

Configuration Example: Using Option Filters

The following example shows you how to create an option space, add custom options to it, create an option filter, and
a match rule to filter the options so that the NIOS appliance can filter an address request by the vendor options of the
requesting hosts. It can grant or deny an address request if the requesting host matches the filter.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1201

Configuring IPv4 DHCP Filters

1. Add an option space called MSFT, and then add the following options to it. For information, see Applying DHCP
Options on page 1083.

Option name Code Type

root-mount-options 1 Text
root-server-ip-address 2 IP address
root-server-host-name 3 Text
root-server-path-name 4 Text
swap-server-ip-address 5 IP address
swap-file-path-name 6 Text
boot-file-path-name 7 Text
posix-timezone-string 8 String
boot-read-size 9 16-Bit unsigned integer

2. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab and click the Add icon.
3. In the Add IPv4 Filter wizard, enter the filter name i86pc, and then select Options as the filter type.
4. Select MSFT as the option space, select an option, specify a value for it, and then add it to the i86pc option filter.
You can select multiple options. Add the following options to the i86pc option filter:

Option name Code Type

root-server-ip-address 2 IP address
root-server-host-name 3 Text
root-server-path-name 4 Text
boot-file-path-name 7 Text

5. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab -> filter_name, and then click the Add icon.
6. In the Add IPv4 Match Rule wizard, select i86pc as the option filter, select vendor-class-identifier (60) as the
matching option, and then enter MSFT as the matching value.
7. Add a DHCP range to the network. For information, see Configuring IPv4 Address Ranges on page 1121.
8. Apply the i86pc option filter to the DHCP address range. For information, see Applying Filters to DHCP Objects on
page 1204.
9. Click Restart to restart services.

About DHCP Fingerprint Filters

The appliance can filter an address request by the DHCP fingerprint of a requesting client. Depending on how you
apply DHCP fingerprint filters, the appliance can grant or deny the address request if the requesting client matches
the filter criteria. Note that only superusers can add, modify, and delete DHCP fingerprint filters. Limited-access users
cannot perform any DHCP fingerprint filter related tasks, though with the correct permissions they can apply DHCP
fingerprint filters to DHCP ranges and range templates. For information about how to apply filters to DHCP ranges, see
Applying Filters to DHCP Objects on page 1204.

1202 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About DHCP Fingerprint Filters

You can define a DHCP fingerprint filter by selecting one or multiple DHCP fingerprints from the existing list of DHCP
fingerprints, and then assign a grant or deny permission to the filter. You can then apply the filter to a DHCP address
range, if DHCP fingerprint detection is enabled. For information about how to enable DHCP fingerprint detection, see
Enabling and Disabling DHCP Fingerprint Detection on page 1360.
Note that once you apply a DHCP fingerprint filter to an address range, you cannot disable DHCP fingerprint detection
or disable individual DHCP fingerprints that have been included in the filter. You must first delete or disable the DHCP
fingerprint filter that you have applied to the address range before you can disable any fingerprint related tasks. For
information about how to delete a DHCP fingerprint filter, see Deleting Filters on page 1212.
On lease renewals, requesting clients must send the same DHCP fingerprint information in order for the appliance to
properly grant or deny leases based on the configured DHCP fingerprint filters. For example, if a client sends option
55 in the original request but does not send the same information in the renewal request, and you have configured
a DHCP fingerprint filter to grant a lease to this client, the appliance may not be able to properly grant a lease to this
client.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1203

Configuring IPv4 DHCP Filters

To apply a DHCP fingerprint filter to an address range:

1. Define a DHCP fingerprint filter. For information, see Defining DHCP Fingerprint Filters.
2. Apply the filter to a DHCP address range or range template, and specify that if the DHCP fingerprint of a requesting
host matches the filter definition, the appliance either grants or denies the address assignment. For information,
see Applying Filters to DHCP Objects on page 1204.

Defining DHCP Fingerprint Filters

To define a DHCP fingerprint filter:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and click
Add -> IPv4 Fingerprint Filter.
From any panel in the DHCP tab, expand the Toolbar and click Add -> IPv4 Fingerprint Filter.
2. In the Add IPv4 Fingerprint Filter wizard, complete the following:
— Name: Enter a meaningful name for the filter. For example, if you want to filter address requests by a
specific device class, you can name one filter “Gaming Console,” another “Android Phones,” and so on. The
filter name must be unique among all DHCP fingerprint filters.
— Comment: Enter useful information about the filter.
3. Click Next and then click the Add icon in the Select Fingerprints table. In the Fingerprint Selector dialog box,
select the DHCP fingerprint you want to include in this filter. Click Add icon to select another DHCP fingerprint.

Note: When you select No Match, the appliance applies the filter to all requesting clients that do not send option
55 and option 60 or to clients that send values in option 55 and 60 that do not match any existing DHCP
fingerprints.

4. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
5. Save the configuration.

Applying Filters to DHCP Objects

To further control how the appliance allocates IPv4 addresses to DHCP client requests, you can apply DHCP filters to
determine the following:
• The class statements
• The address ranges from which it assigns leases
• When to grant or deny leases to the matching clients
• Which DHCP options to return to the matching clients
You can apply IPv4 logic filters at the Grid DHCP or Member DHCP. You can choose to keep the inherited properties or
override them when you edit the IPv4 networks, IPv4 network containers, IPv4 network templates, IPv4 shared
networks, IPv4 DHCP ranges, IPv4 DHCP range templates, IPv4 fixed addresses, IPv4 reservations, IPv4 fixed address
templates, IPv4 reservation templates, or IPv4 host addresses.

Adding Filters to the Class Filter List

You can apply any DHCP filter to the Class Filter List of a DHCP range or range template. The appliance uses the
matching rules of these filters to select the address range from which it assigns a lease. You can define permissions
for these filters to instruct the appliance whether to grant or deny a lease to the matching client. When you add a filter
with a grant permission, the client must match the filter criteria to receive a lease. When you define a filter with a deny
permission, clients that do not match the filter criteria still receive leases. Only the client that matches the filter
criteria is denied a lease.

1204 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Applying Filters to DHCP Objects

Filters in the Class Filter List correspond to the class statement generated in the dhcpd configuration file, which is a
classification of the client packet. All DHCP clients that match the option filter and relay agent filter criteria become
members of the same class and are eligible to receive DHCP options for that class, regardless of the networks in which
the clients reside. However, a client can only become a member of the MAC or NAC filter class when it is granted a
lease from the DHCP range based on the filter criteria. Whether a client receives specific options and option values
depends on the hierarchy of the options and how you apply the filters. For information about how the appliance
returns DHCP options, see Adding Filters to the Logic Filter List.

Adding Filters to the Logic Filter List

The filters you add to the Logic Filter List correspond to the match rules that are written to the dhcpd configuration
file. The appliance uses these filters to identify DHCP options and values to return to the matching clients. You can
apply option, MAC, and NAC filters to the Logic Filter List. Note that a DHCP client is eligible to receive DHCP options
defined in a filter if it matches the filter criteria. Whether the client receives specific options and their corresponding
values depends on the hierarchy of the options and the list of options requested by the client through DHCP option
55. You can configure the appliance to ignore the option list requested by a matching client and return all the options
that the client is eligible to receive. For information about how to ignore the option list requested by a client, see
Configuring General IPv4 DHCP Properties on page 1071.

Note: The appliance allows you to add an empty IPv4 logic filter at the end of the logic filter list, which means that
you can add an IPv4 logic filter without defining DHCP options in it. In addition, you can change the order of
the filters in the logic filter list.

The appliance decides which options and values to return to a client based on the following:
• If you have different DHCP options defined in a range and any DHCP filters in the Class Filter and Logic Filter
lists, and these options do not overlap, the appliance merges and returns all options to the matching client. For
example, a DHCP client obtains a lease from a DHCP address range (R) through an option filter in the Class Filter
List (CF), which contains an option statement (O1) with a value of (S1). The appliance then matches a filter in
the Logic Filter List (LF) that contains an option statement (O2) with a value of (S2). In this case, option
statements O1 and O2 and their values S1 and S2 are merged and returned to the matching client.
• If there are overlapping DHCP options in a range and any DHCP filters in the Class Filter and Logic Filter lists, the
values defined in the Class Filter List filters take precedence over those defined in the range and filters in the
Logic Filter List. The appliance returns the option value defined in the class filters to the matching client. For
example, a DHCP client obtains a lease from a DHCP address range (R) through an option filter in the Class Filter
List (CF), which contains an option statement (O1) with a value of (S1). The appliance then matches a filter in
the Logic Filter List (LF) that contains the same option statement (O1) with a value of (S2). In this case, the
option value S1 defined in the option filter in the Class Filter List takes precedence and is returned to the DHCP
client.
• When you apply option, MAC, and NAC filters to the Logic Filter List, the appliance translates their match rules
into a DHCP if/elseif/else statement using the match rules of the first filter on the list as the “if” expression in
the statement. Match rules in subsequent filters are translated into the “elseif” statements, and the last filter
that does not contain any match rules is translated into the “else” statement. Note that a filter without any
match rules can only be added as the last filter in the Logic Filter List.
For more information about how the appliance grants and denies leases to requesting clients and determines which
DHCP options to return to the matching clients, see Configuration Example: Using the Class and Logic Filter Lists on
page 1207.
To apply IPv4 filters:
1. Grid: From the Data Management tab -> DHCP tab, select Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> member check box -> Edit icon.
Network: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box,
and then click the Edit icon.
DHCP Range: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
addr_range check box, and then click the Edit icon

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1205

Configuring IPv4 DHCP Filters

Fixed Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
fixed_address check box, and then click the Edit icon.
IPv4 Reservation: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
reservation check box, and then click the Edit icon.
Host Address: From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network ->
host_record check box, and then click the Edit icon. Select the host IP address, and then click the Edit icon.
IPv4 Network or Fixed Address Template: From the Data Management tab, select the DHCP tab -> Templates tab
-> (IPv4 network or fixed address) template check box, and then click the Edit icon.
2. In the editor, click Toggle Advanced Mode, and then select the IPv4 Filters tab.
3. Logic Filter List: You can keep the inherited IPv4 logic filters or override them. To override the value that has been
inherited from the upper level, click Override. Click the Add icon to add a filter to match a client based on the
match rules defined in the filter. For more information, see Adding Filters to the Logic Filter List on page 1205.
If you have only one configured DHCP filter, the appliance displays the filter in the table. Otherwise, in the DHCP
Filter Selector dialog box, click the filter you want to add. Use SHIFT+click and CTRL+click to select multiple
filters.
4. Complete the following to add the Class Filter to a DHCP address range:
— Click the Add icon to add a filter to identify the class of a matching client, and to grant or deny a lease to a
client. For more information, see Adding Filters to the Class Filter List on page 1204.
If you have only one configured DHCP filter, the appliance displays the filter in the table. Otherwise, in the DHCP
Filter Selector dialog box, click the filter you want to add. Use SHIFT+click and CTRL+click to select multiple
filters.
For each filter you add, click the Action column and select one of the following from the drop-down list:
— Grant lease:
For MAC address filters: Select this to assign an IP address from the address range to a requesting host
whose MAC address matches the MAC address in the filter.
For relay agent filters: Select this to assign an IP address from the address range when one or both of the
relay agent identifiers of the requesting host match the filter criteria.
For option filters: Select this to assign an IP address from the address range to a requesting host whose
DHCP options match the DHCP options and match rules defined in the filter.
For NAC filters: Select this to assign an IP address from the address range to a requesting host based on the
authentication results from a RADIUS authentication server group.
For DHCP fingerprint filters: Select this to grant a lease from the address range to a requesting host based
whose DHCP fingerprint matches the DHCP fingerprint in the filter.
— Deny lease:
For MAC address filters: Select this to deny an address request from a host whose MAC address matches a
MAC address in the filter.
For relay agent filters: Select this to deny an address request when one or both relay agent identifiers match
the filter criteria in the filter.
For option filters: Select this to deny an address request from a host whose DHCP options match the
options and match rules in the filter.
For NAC filters: Select this to deny an address request from a host based on the authentication results from
a RADIUS authentication server group.
For DHCP fingerprint filters: Select this to deny a lease request when the DHCP fingerprint of the requesting
host matches the DHCP fingerprint in the filter.
The appliance uses filters in both the Class Filter and Logic Filter lists to determine the DHCP options and values
it returns to the matching clients.

Note: You can only add a filter that does not contain any match rules as the last filter in the Logic Filter List.

5. Save the configuration and click Restart if it appears at the top of the screen.

1206 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Applying Filters to DHCP Objects

Configuration Example: Using the Class and Logic Filter Lists

The following example shows you how to define DHCP filters and apply them to the class and logic filter lists. It also
shows you the DHCP configuration file that is generated based on the configuration.
In this example, you first define a MAC filter, two option filters (one without match rules), and a NAC filter, and then
apply the MAC filter to the Class Filter List and the other filters to the Logic Filter List of the address range 10.34.34.6
- 10.34.34.55.
1. Configure and save a MAC filter as follows. For more information, seeDefining MAC Address Filters on page 1194.
a. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and
click Add -> IPv4 MAC Address Filter.
b. In the Add IPv4 MAC Filter wizard, complete the following:
— Name: Enter MAC1.
c. Click Next and complete the following to define the DHCP options to return to the matching client:
— Lease Time: Enter 1234 and select seconds from the drop-down list.
Options to Merge with Object Options: Click the Add icon. Grid Manager adds a new row to the table with
the default DHCP option space and option name displayed. Complete the following:
— Option Name: Click the down arrow and select log-server(7) from the drop-down list.
— Value: Enter 10.34.34.3 as the value for the log-server option that is sent to the client in the
OFFER/ACK message.
d. Save the configuration.
2. Add a MAC address filter item as follows. For more information, see Adding MAC Address Filter Items on page
1195.
a. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and
click Add -> IPv4 MAC Address Filter Item.
b. In the Add IPv4 MAC Address Filter Item wizard, complete the following:
— MAC Address Filter: Click Select Filter. In the DHCP Filter Selector dialog box, click MAC1.
— MAC Address: Enter AB:DE:CC:DD:EE:01 as the MAC address.
c. Save the configuration.
3. Configure and save an option filter with match rules as follows. For more information, see Defining Option Filters
on page 1198.
a. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and
click Add -> IPv4 Option Filter.
b. In the Add IPv4 Option Filter wizard, complete the following:
— Name: Enter Option1.
c. Click Next and complete the following to add match rules:
— In the first drop-down list, select vendor-class-identifier.
— In the second drop-down list, select substring equals, and then enter the following:
• Offset: Enter 0 to match the value starting at the first character of the option data.
• Length: Enter 4.
• Enter MSFT as the matching value.
Click Preview and the appliance displays the expression: (vendor-class-identifier,0,4="MSFT").
d. Click Next and complete the following to define the DHCP options to return to the matching client:
Options to Merge with Object Options: Click the Add icon. Grid Manager adds a new row to the table with
the default DHCP option space and option name displayed. Complete the following:
— Option Name: Click the down arrow and from the drop-down list, select time-server(4).
— Value: Enter 10.34.34.2 as the value for the time-server option that is sent to the client in the
OFFER/ACK message.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1207

Configuring IPv4 DHCP Filters

e. Save the configuration.

4. Configure and save another option filter without match rules as follows:
a. In the Add IPv4 Option Filter wizard, complete the following:
— Name: Enter Option2.
b. Click Next. Do not define any match rules.
c. Click Next again and complete the following to define the DHCP options to return to the matching client:
Options to Merge with Object Options: Click the Add icon. Grid Manager adds a new row to the table with
the default DHCP option space and option name displayed. Complete the following:
— Option Name: Click the down arrow and from the drop-down list, select domain-name(6).
— Value: Enter www.infoblox.com.
d. Save the configuration.
5. Configure and save a NAC filter as follows. For more information, see Defining NAC Filters on page 1239.
a. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and
click Add -> IPv4 NAC Filter.
b. In the Add Filter Wizard, complete the following and click Next:
— Name: Enter NAC1.
c. Create a rule as follows:
— In the first drop-down list, select Compliance State.
— In the second drop-down list, select equals.
— In the third drop-down list, select Compliant.
Click Preview and the appliance displays the expression: (Sophos.ComplianceState="Compliant").
d. Click Next and complete the following to define DHCP options:
— Lease Time: Enter 1000 and select seconds from the drop-down list.
Options to Merge with Object Options: Click the Add icon. Grid Manager adds a new row to the table with
the default DHCP option space and option name displayed. Complete the following:
— Option Name: Click the down arrow and from the drop-down list, select cookies-servers(8).
— Value: Enter 10.34.34.5.
e. Save the configuration.
6. Apply the filters to the address range as follows. For more information, see Applying Filters to DHCP Objects on
page 1204.
a. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> 10.34.34.6-10.34.34.55
check box, and then click the Edit icon.
b. In the DHCP Range editor, click Toggle Advanced Mode.
c. Click the IPv4 Filters tab and complete the following:
Class Filter List: Click the Add icon and add MAC1 as a class filter. Click the Action column and select Grant
lease from the drop-down list.
Logic Filter List: Click the Add icon and add Option1, NAC1, and Option2 respectively as logic filters.
d. Save the configuration.
The appliance generates the following information in the DHCP configuration file based on the filter configuration in
this example:
# MAC filter "MAC1"
class "MAC1" {
default-lease-time 1234;
min-lease-time 1234;
max-lease-time 1234;
option log-servers 10.34.34.3;
}

1208 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Applying Filters to DHCP Objects

# NAC filter "NAC1"

{option sophos.compliance
state=”compliant”
}
subnet 10.34.34.0 netmask 255.255.255.0 {
pool {
infoblox-range 10.34.34.6 10.34.34.55;
range 10.34.34.6 10.34.34.55;
option routers 10.34.34.1;
# INFOBLOXMACFILTERDEBUGINFO: allow members of "MAC1";

if (substring(option vendor-class-identifier,0,4)="MSFT") {
# Option filter "Option1"
option time-servers 10.34.34.2;
}
elsif (option Sophos.ComplianceState="Compliant") {
# NAC filter "NAC1"
default-lease-time 1000;
min-lease-time 1000;
max-lease-time 1000;
option cookie-servers 10.34.34.5;
}
else {
# Option filter "Option2"
default-lease-time 2500;
min-lease-time 2500;
max-lease-time 2500;
option domain-name "www.infoblox.com"; }
}
Depending on client requests and the matching criteria, the following scenarios can happen in this example:
If the requesting client matches the MAC1 and Option1 filters, the appliance returns the following:
• Lease time = 1234 seconds (from the MAC filter)
• Returned options:
— Router(3) with a value of 10.34.34.1 (from the address range)
— Log-server(7) with a value of 10.34.34.3 (from the MAC filter MAC1)
— Time-server(4) with a value of 10.34.34.2 (from the option filter Option1)
If the requesting client matches the MAC1 and NAC1 filters, the appliance returns the following:
• Lease time = 1234 seconds (from the MAC filter MAC1)Returned options:
— Router(3) with a value of 10.34.34.1 (from the address range)
— Log-server(7) with a value of 10.34.34.3 (from the MAC filter MAC1)
— Cookie-server(8) with a value of 10.34.34.5 (from the NAC filter NAC1)
If the client matches the MAC1 filter, but not the Option1 or NAC1 filters, the appliance returns the following:
• Lease time = 1234 seconds (from the MAC filter)
• Returned options:
— Router(3) with a value of 10.34.34.1 (from the address range)
— Log-server(7) with a value of 10.34.34.3 (from the MAC filter MAC1)
— Domain-name(6) with a value of www.infoblox.com (from the option filter Option2)
If the requesting client does not match the MAC1 filter, no lease is granted.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1209

Configuring IPv4 DHCP Filters

Managing DHCP Filters

You can do the following to manage DHCP filters:
• Modify filter settings. For information, see Modifying DHCP Filters.
• View a complete list of filters, MAC address items, and match rules. For information, see Viewing DHCP Filters
on page 1211.
• Delete filters that are not in use. For information, see Deleting Filters on page 1212.

Modifying DHCP Filters

To modify a filter:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab -> filter_name check box, and then click
the Edit icon.
2. For a MAC address filter, the DHCP MAC Filter editor provides the following tabs from which you can modify
information:
— General: Modify the fields as described in Defining MAC Address Filters on page 1194.
— DHCP Options: Add or delete DHCP options. For information, see Defining MAC Address Filters on page
1194.
— Extensible Attributes: Add or delete extensible attributes that are associated with a specific DHCP range.
You can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see About
Administrative Permissions on page 195.
For a relay agent filter, the Relay Agent Filter editor provides the following tabs from which you can modify
information:
— General: Modify the fields as described in Defining Relay Agent Filters on page 1196.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific DHCP range.
You can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.
For an option filter, the Option Filter editor contains the following tabs from which you can modify information:
— General: Modify the fields as described in Defining Option Filters on page 1198.
— Rules: Modify the match rules as described in Defining Option Filters on page 1198.
— DHCP Options: Modify option spaces and DHCP options in the Basic tab as described in Defining Option
Filters on page 1198. You must define the PXE Lease Time in the Advanced tab.
— BOOTP: Modify BOOTP settings as described in Configuring IPv4 BOOTP and PXE Properties on page 1076.
— Extensible Attributes: Add or delete extensible attributes that are associated with a specific DHCP range.
You can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.
For a DHCP fingerprint filter, the Add IPv4 Fingerprint Filter editor provides the following tabs from which you can
modify information:
— General: Modify general information, such as the name and device class, as described in Defining
DHCP Fingerprint Filters on page 1204.
— Fingerprints: Add or delete DHCP fingerprints as described in Defining DHCP Fingerprint Filters on page
1204.
— Extensible Attributes: Add and delete extensible attributes that are associated with the DHCP
fingerprint filter. You can also modify the values of extensible attributes. For information, see Using
Extensible Attributes on page 427.
For a NAC filter, the NAC Filter editor contains the following tabs from which you can modifying information:

1210 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing DHCP Filters

— General: Modify the name and comment.

— Rules: Modify the rules as described in Defining NAC Filters on page 1239.
— DHCP Options: Add or delete DHCP options. For information, see Defining NAC Filters on page 1239.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific DHCP
range. You can also modify the values of extensible attributes. For information, see Using Extensible
Attributes on page 427.
3. Save the configuration and click Restart if it appears at the top of the screen.
You can modify the MAC address filter items and match rules for corresponding MAC address filters and option filters.
For information, see Modifying MAC Address Filter Items on page 1211 and Viewing DHCP Filters on page 1211.

Modifying MAC Address Filter Items

To modify a MAC address filter item:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab -> filter_name -> mac_filter check box, and
then click the Edit icon.
2. The MAC Address Filter Item editor contains the following tabs from which you can edit data:
— General: Modify the fields as described in Adding MAC Address Filter Items on page 1195.
— Registration: Modify registration settings as described in Adding MAC Address Filter Items on page 1195.
— Extensible Attributes: Add or delete extensible attributes that are associated with a specific DHCP range.
You can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.
3. Save the configuration and click Restart if it appears at the top of the screen.

Viewing DHCP Filters

To view DHCP filters:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab.
2. Grid Manager displays the following for each filter:
— Name: The name of the filter.
— Filter Type: The filter type.
— Comment: The information about the filter.
— Site: The location to which the filter belongs. This is one of the predefined extensible attributes.

Viewing MAC Address Filter Items

To view a list of MAC addresses in a specific MAC address filter:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab -> filter_name.
2. Grid Manager displays the following:
— MAC Address: The DHCP fingerprint information of client’s device. This field is
displayed only when users use captive portal for authentication. MAC address assigned to the filter.
— Username: Grid Manager displays the username to which the MAC address belongs in the lease viewers.
— Comment: The information you entered about the filter item.
— Expiration Time: The expiration time you configured for the MAC address.
— Fingerprint: The DHCP fingerprint information of client’s device. This field is updated when users use
Captive Portal for authentication.
— Site: The location to which the filter belongs. This is one of the predefined extensible attributes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1211

Configuring IPv4 DHCP Filters

Deleting Filters
You can delete a filter that is not currently assigned to a DHCP range. You can also remove a filter from a DHCP range,
and then delete the filter if it is not in use.
To delete a filter:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab -> filter_name, and then click the Delete
icon.
2. In the Delete Confirmation dialog box, click Yes.
The appliance puts the deleted filters in the Recycle Bin, if enabled. You can later restore the filter if needed.
To schedule this task, click the Delete icon -> Schedule Delete. In the Schedule Deletion dialog box, click Delete Later,
and then specify a date, time, and time zone.

1212 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 32 Authenticated DHCP
This chapter includes the following sections:
• About Authenticated DHCP on page 1214
— DHCP Authentication Process on page 1214
• Configuring DHCP Authentication on page 1218
• About Authentication Server Groups on page 1218
— Configuring a RADIUS Authentication Server Group on page 1218
— Configuring an Active Directory Authentication Server Group on page 1219
• About the Captive Portal on page 1221
— Configuring Captive Portal Properties on page 1221
— Customizing the Captive Portal Interface on page 1222
— Managing Captive Portal Certificates on page 1223
— Starting the Captive Portal Service on page 1225
• Defining the IPv4 Network and DHCP Ranges on page 1225
• Defining MAC Address Filters on page 1226
• Using the Captive Portal Wizard on page 1226
• Adding and Modifying the Filters and Associations on page 1228
• Monitoring DHCP Authentication on page 1228
— Viewing DHCP Ranges and Filters on page 1228
• Configuration Example: Configuring Authenticated DHCP on page 1229
• NAC Integration on page 1234
• Configuring NAC with RADIUS Servers on page 1235
• About Authentication Servers on page 1236
— Adding a Server Group on page 1236
— Associating a Server Group with a Member on page 1237
— Managing Server Groups on page 1237
— Clearing the Authentication Cache on page 1237
• Configuring DHCP Ranges on page 1238
— Listing DHCP Ranges on page 1238
• About NAC Filters on page 1238
— Defining NAC Filters on page 1239
— Disabling NAC Filters on page 1241

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1213

Authenticated DHCP

About Authenticated DHCP

This feature provides the ability to control access to your IPv4 networks. (This feature does not support IPv6
networks.) You can divide a network into segments for unauthenticated, authenticated and guest users, and the
DHCP server assigns clients to the appropriate segment based on their MAC addresses and authentication
credentials.
For example, you can divide a network into one or more production segments for valid employees and systems, a
guest segment with access only to the Internet and/or limited public servers, and a quarantine segment with access
to a captive portal only. A captive portal is a web page that can provide an option to register as an authenticated user
or as a guest.
On a member DHCP server, configure DHCP ranges for each access level—quarantine, authenticated, and guest—and
create MAC address filters for the DHCP ranges. You can use DHCP options and Access Control Lists (ACLs) on your
routers and firewall policies to define the appropriate services for each access level. On another Grid member,
configure the captive portal and specify the authentication server group that authenticates the users. You can
configure an authentication server group for external servers running RADIUS, LDAP, or Active Directory (AD).
When a DHCP client first sends a request for an IP address, the DHCP server offers an IP address from the quarantine
range and directs the client to the captive portal, where the user can register either as an authenticated user or as a
guest. When users sign in as guests or are successfully authenticated, the member automatically adds their MAC
addresses to the appropriate MAC address filters and assigns addresses out of the appropriate address range.

DHCP Authentication Process

This section illustrates the DHCP authentication process. As illustrated in Figure 32.1, the DHCP authentication
process begins when a DHCP client attempts to connect to the network. The member DHCP server checks if the MAC
address of the DHCP client matches a MAC address in the guest or authenticated MAC address filters. If the member
does not find a match, it assigns an IP address from the quarantine range to the DHCP client. When the client tries to
access a web site, it is redirected to the captive portal page.

1214 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authenticated DHCP

Figure 32.1 Stage 1: Quarantining an Unauthenticated DHCP Client

Grid Master

Captive Portal
DHCP client sends a DHCP request Server
DHCP 1
to the member DHCP server. DHCP Server
Client

Authenticated authenticated
The MAC address filters for the MAC Address Filter 192.168.1.50 -
2
authorized and guest IP address ranges Grant Leases 192.168.1.150
do not contain the MAC address of the
DHCP client.
Guest guest
MAC Address Filter 192.168.1.151 -
Grant Leases 192.168.1.170

Guest and Authenticated quarantine

Quarantined The NIOS appliance assigns an IP MAC Address Filters 192.168.1.225 -
192.168.1.250 3 address from the quarantine range. Deny Leases 192.168.1.254

Note that the quarantine range in Figure 32.1 contains MAC address filters to deny leases in the quarantine range to
DHCP clients with MAC addresses that match those in the Guest and Authenticated MAC address filters.
When the client connects to the captive portal IP address through its web browser, the user can register and continue
the authentication process to obtain an IP address from the authenticated DHCP range, or register as a guest and
obtain an IP address from the guest DHCP range.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1215

Authenticated DHCP

If the user chooses to continue the authentication process, as shown in Figure 32.2, the member authenticates the
user with the authentication service that you configured, which can be RADIUS, LDAP, or AD.

Figure 32.2 Stage 2a: Authenticating the User

Grid Master

Quarantined DHCP Server Captive Portal RADIUS/LDAP /AD

DHCP Client Server Authentication
Servers
HTTP Connection

1 The quarantined DHCP client is redirected to the The member authenticates

2 the user through the
captive portal.The user enters login information, such
as user name and password. method that you configured.

3 The captive portal server

sends the authentication
result to the member DHCP
server.

MAC Address Filter

Authenticated
Grant Leases

authenticated
Authenticated 192.168.1.50 -
192.168.1.75 192.168.1.150
4 The member adds the MAC
address of the client to the MAC
address filter for the
authenticated range and assigns
the client system an IP address in
the authenticated range.

After the client successfully passes the authentication stage, the appliance stores the MAC address of the client in
the MAC address filter for the authenticated range. When the client tries to renew its IP address, it receives a new IP
address from the authenticated DHCP range.
Note that if the MAC address filter has an expiration period, the member automatically deletes expired MAC
addresses from the filter. Therefore, if a DHCP client tries to renew its IP address after the expiration period, the client
is redirected to the captive portal because its MAC address is no longer in the MAC address filter. For more
information, see Defining MAC Address Filters on page 1194.

1216 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authenticated DHCP

If the user chooses to sign in as a guest, as shown in Figure 32.3, the user can fill in the guest registration page
provided by the captive portal.

Figure 32.3 Stage 2b: Registering as a Guest

Grid Master

Quarantined Infoblox DHCP

Infoblox Captive
DHCP Client Server
Portal Server

HTTP Connection

1 The quarantined DHCP client connects to the captive portal.

2 The user chooses to register as a guest, so the server displays the guest
registration page. The user enters information on the guest registration page.

MAC Address Filter

Guest
Grant Leases

Guest guest
192.168.1.165 192.168.1.151 -
192.168.1.170
3 The server adds the MAC address of
the client to the MAC address filter for
the guest range and assigns an IP
address from the guest DHCP range.

After the user signs in as a guest, the appliance stores the MAC address of the client in the MAC address filter for the
guest range. When the DHCP client tries to renew its IP address, it receives a new IP address from the guest DHCP
range, unless the MAC address of the client expired and was removed from the filter. In this case, the DHCP client is
redirected to the captive portal.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1217

Authenticated DHCP

Configuring DHCP Authentication

Following are the tasks to configure the DHCP Authentication feature:
1. Configure the authentication server group which the captive portal uses to authenticate DHCP clients. For more
information, see About Authentication Server Groups on page 1218.
If the captive portal is used to register guest users and does not authenticate users, then you do not have to
configure an authentication server group.
2. Configure the captive portal properties and associate the captive portal with the authentication server group. For
more information, see Configuring Captive Portal Properties on page 1221.
3. Optionally, customize the captive portal interface and guest registration page, as described in Customizing the
Captive Portal Interface on page 1222. Additionally, if you enabled SSL encryption, upload the required
certificates, as described in Managing Captive Portal Certificates on page 1223.
4. Enable the captive portal, as described in Starting the Captive Portal Service on page 1225.
5. Configure the network and a DHCP range for quarantine DHCP clients. Configure DHCP ranges for authenticated
and guest DHCP clients, depending on whether you are allowing either one or both types of users to access your
network. For information about configuring these DHCP ranges, see Defining the IPv4 Network and DHCP Ranges
on page 1225.
6. Run the Captive Portal wizard to create MAC address filters for the quarantine range and for the authenticated,
and guest DHCP ranges, if configured; and to associate the captive portal server with the member that serves the
DHCP ranges. To accomplish these tasks and set other properties, see Using the Captive Portal Wizard on page
1226. Alternatively, you can perform these tasks separately or modify the configured properties, as described in
Adding and Modifying the Filters and Associations on page 1228.
7. Enable the DHCP service. For more information, see Starting DHCP Services on a Member on page 1103.
For information about monitoring the captive portal and the DHCP service, see Monitoring DHCP Authentication on
page 1228.

About Authentication Server Groups

Create an authentication server group if you want the captive portal server to authenticate users when they register.
You can create an authentication server group with RADIUS servers, LDAP servers, or Active Directory servers, and
then associate the group with the member that runs the captive portal and sends the authentication requests. You
can associate an authentication server group with multiple captive portals, but you can associate a captive portal
with only one authentication server group.
The following sections provide instructions for creating a RADIUS authentication server group, an AD authentication
server group and an LDAP server group:
• Configuring a RADIUS Authentication Server Group
• Configuring an Active Directory Authentication Server Group on page 1219
• Configuring an LDAP Server Group on page 224

Configuring a RADIUS Authentication Server Group

You can add multiple RADIUS servers to an authentication server group and prioritize them. When the member sends
an authentication request, it always selects the first RADIUS server in the list. It only sends authentication requests
to the next server on the list if the first server goes down.
To configure the RADIUS authentication server group to which a captive portal server sends authentication requests:
1. From the Administration tab, click the Authentication Server Groups tab.
2. Expand the Toolbar and click Add -> RADIUS Service.

1218 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authentication Server Groups

3. In the Add RADIUS Authentication Service wizard, complete the following:

— Name: Enter the name of the server group.
— RADIUS Servers: Click the Add icon and enter the following:
— Server Name or IP Address: Enter the RADIUS server FQDN or IP address.
— Comment: You can enter additional information about the server.
— Authentication Port: The destination port on the RADIUS server. The default is 1812.
— Authentication Type: Select the authentication method of the RADIUS server from the drop-down list.
You can specify either PAP (Password Authentication Protocol) or CHAP (Challenge Handshake
Authentication Protocol). The default is PAP.
— Shared Secret: Enter the shared secret that the member DHCP server and the RADIUS server use to
encrypt and decrypt their messages. This shared secret must match the one you entered on the RADIUS
server.
— Connect through Management Interface: Select this to enable the member to use its MGMT port to
communicate with just this server.
— Disable server: Select this to disable the RADIUS server if, for example, the connection to the server is
down and you want to stop the DHCP server from trying to connect to this server.
— Click Test to validate the configuration and check that the Grid Master can connect to the RADIUS
server. Before you can test the configuration though, you must specify the authentication and
accounting timeout and retry values.
If the Grid Master connects to the RADIUS server using the configuration you entered, it displays a
message confirming the configuration is valid. If it is unable to connect to the RADIUS server, the
appliance displays a message indicating an error in the configuration.
— Click Add to add the RADIUS server to the group.
When you add multiple RADIUS servers to the list, you can use the up and down arrows to change the
position of the servers on the list. The member DHCP server connects to the RADIUS servers in the order
they are listed.
— Authentication
— Timeout: The time that the member DHCP server waits for a response from a RADIUS server before
considering it unreachable. You can enter the time in milliseconds or seconds. The maximum is 10 seconds.
— Retries: The number of times the member DHCP server retries connecting to a RADIUS server before it
considers the server unreachable. The default is five.
— Accounting
— Timeout: The time that the member DHCP server waits for a response from a RADIUS server before
considering it unreachable. You can enter the time in milliseconds or seconds. The maximum is 10 seconds.
— Retries: The number of times the member DHCP server retries connecting to a RADIUS server before it
considers the server unreachable. The default is five.
— Recovery Interval: Specifies the duration of time a RADIUS server stays inactive after being down, before
becoming eligible to have RADIUS requests sent to it. The recovery interval starts when a RADIUS server is
first discovered to be down.
— Comment: You can enter additional information about the server group.
— Disable: Select this to disable the authentication server group.
4. Save the configuration and click Restart if it appears at the top of the screen.

Configuring an Active Directory Authentication Server Group

You can add multiple Active Directory servers running Windows Server 2003 or Windows Server 2008 or Windows
Server 2012 to an authentication server group and prioritize the servers. When the member sends an authentication
request, it always selects the first AD server in the list. It only sends authentication requests to the next server on the
list if the first server goes down.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1219

Authenticated DHCP

To configure an Active Directory authentication server group for a captive portal server:
1. From the Administration tab, click the Authentication Server Groups tab.
2. Click the Active Directory Services subtab and click the Add icon.
3. In the Add Active Directory Authentication Service wizard, complete the following:
— Name: Enter a name for the service.
— Active Directory Domain: Enter the AD domain name.
— Domain Controllers: Click the Add icon and complete the following to add an AD domain controller:
— Server Name or IP Address: Enter the FQDN or the IP address of the AD server that is used for
authentication.
— Comment: Enter additional information about the AD server.
— Authentication Port: Enter the port number on the domain controller to which the member sends
authentication requests. The default is 389.
— Encryption: Select SSL from the drop-down list to transmit through an SSL (Secure Sockets Layer)
tunnel. When you select SSL, the appliance automatically updates the authentication port to 636.
Infoblox strongly recommends that you select this option to ensure the security of all communications
between the member and the AD server. If you select this option, you must upload a CA certificate from
the AD server. Click CA Certificates to upload the certificate. In the CA Certificates dialog box, click the
Add icon, and then navigate to the certificate to upload it.
— Connect through Management Interface: Select this so that the member uses the MGMT port for
administrator authentication communications with just this AD server.
— Disable server: Select this to disable an AD server if, for example, the connection to the server is down
and you want to stop the Grid member from trying to connect to this server.
— Click Test to test the configuration. If the Grid member connects to the domain controller using the
configuration you entered, it displays a message confirming the configuration is valid. If it is unable to
connect to the server, the appliance displays a message indicating an error in the configuration.
— Click Add to add the domain controller to the group.
— Timeout(s): The number of seconds that the Grid member waits for a response from the specified
authentication server. The default is 5.
— Comment: Enter additional information about the service.
— Disable: Select this to retain an inactive AD authentication service profile.
4. Save the configuration and click Restart if it appears at the top of the screen.

Managing Multiple Domain Controllers

You can create multiple domain controllers on the Microsoft server and associate it with a single Active Directory
Domain, which is synchronized by multiple Grid members within the same Grid:
• Synchronization happens from only one Grid member that is a Microsoft server, which is referred as the master,
at a time in a given network view.
• If the master Microsoft server fails the synchronization three times in a row, it loses its master status.
• The Grid Master will periodically ensure that for each Active Director Domain there is one Microsoft server with
the master status. Otherwise, the appliance selects a new master, based on the following:
— Microsoft server that has been designated as the Grid Master for the longest time previously.
— Microsoft server configured in read/write synchronization mode.
• The master server is indicated within the Active Directory Domain object.
• Synchronization mode changes based on the master.
• When synchronization happens in two separate network views, respective Grid members synchronize data
simultaneously.

1220 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About the Captive Portal

About the Captive Portal

The captive portal can be used to register users for authentication, guest users, or both types of users. When a DHCP
client attempts to connect to the network and its MAC address is not in any of the configured MAC filters, the member
DHCP server assigns it an IP address in the quarantine range. When the quarantined client tries to reach any web site,
it is redirected to the captive portal. The captive portal runs a limited DNS server that is used solely to redirect queries
to the captive portal web interface.
You can enable the captive portal as a service on any Grid member, except the Grid Master or Grid Master candidate.
The Grid member that runs the captive portal cannot run any other service, such as DHCP and DNS. Note that the
limited DNS service that the captive portal runs is different from the full-scale DNS service on an Infoblox appliance.
The full-scale DNS service must be explicitly disabled on the member that runs the captive portal. For information on
disabling DNS service, see Starting and Stopping the DNS Service on page 763.
You can configure one or more captive portals in the Grid. You can also configure one or more member DHCP servers
to use a captive portal to register users. For example, if your organization has two sites, you can configure a captive
portal for each site and configure the DHCP servers in each site to use their respective captive portals to authenticate
users.
In order for clients to reach the captive portal, you must specify a route to the captive portal. In a network where all
IP addresses are on the same subnet, you can configure Option 33 for the quarantine DHCP range. For additional
information, see Quarantine DHCP Range on page 1225. On a routed network, you must configure a default route on
the router for the subnet.
Following are the tasks to configure a captive portal:
1. Select the Grid member that runs the captive portal and configure its properties, as described in Configuring
Captive Portal Properties on page 1221.
2. Optionally, customize the captive portal and registration page. For information about these tasks, see
Customizing the Captive Portal Interface on page 1222.
3. If you enabled SSL, generate the CA certificate, as described in Managing Captive Portal Certificates on page
1223.
4. Start the captive portal, as described in Starting the Captive Portal Service on page 1225.

Configuring Captive Portal Properties

When you configure the captive portal properties of a member, you specify if it is used to register users for
authentication, guests, or both. If it is used to register guests only, then do not associate it with an authentication
server group.
You can specify the VIP address of the Grid member or configure an additional IP address on the loopback interface
as the captive portal IP address. Alternatively, if the Grid member supports the LAN2 port and it is enabled, but the
NIC failover feature is disabled, you can use the IP address of the LAN2 port as the captive portal IP address. To
configure an IP address on the loopback interface, see Configuring IP Addresses on the Loopback Interface on page
1032. For information on the LAN2 port, see Using the LAN2 Port on page 457.
In addition, you can configure the port on which the appliance listens for authentication requests redirected from the
captive portal. When a user logs in to the captive portal, the member sends an authentication request to its
associated authentication server group. The member determines future DHCP replies to client requests based on the
authentication result.
To configure the properties of the captive portal:
1. From the Grid tab, select the Grid Manager tab, and then click Captive Portal.
Grid Manager lists all the members, except for the Grid Master and Grid Master candidate.
2. Select the member that runs the captive portal and click the Edit icon.
3. In the General Basic tab of the Member Captive Portal Properties editor, complete the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1221

Authenticated DHCP

— Use This Authentication Server Group for Authenticating Captive Portal Users: Select the authentication
server group that authenticates users for this captive portal. For information about authentication server
groups, see About Authentication Server Groups on page 1218.
— Captive Portal User Types: Specify whether the captive portal is used to register Authenticated users only,
Guest users only, or Both.
— Portal IP Address: Select the IP address of the captive portal server. The appliance lists the VIP address and
the IP addresses of the loopback interface and the LAN2 port, if enabled. You can select any of these
addresses as the portal IP address.
— Enable SSL on Portal: Select this to support encrypted web traffic through SSL/TLS. If you select this option,
you must upload a certificate or generate a self-signed certificate. For information about creating and
uploading a certificate for the captive portal, see Managing Captive Portal Certificates on page 1223.
— Network View: This field displays if there are multiple network views configured. Select the network view in
which the authenticated, quarantine, and guest DHCP ranges belong.
— Log Registration Success: Select to enable the member to log successful registrations in syslog, and then
select the logging level from the drop-down list.
— Log Registration Failure: Select to enable the member to log failed registrations in syslog, and then select
the logging level from the drop-down list.
4. In the General Advanced tab of the editor, you can specify the port on which the member listens for
authentication requests redirected from the captive portal. The default port is 4433. Depending on your firewall
and network policies, you can configure an unused port greater than 1 and less than 63999.
5. Save the configuration and click Restart if it appears at the top of the screen.

Customizing the Captive Portal Interface

You can customize the captive portal, and if configured, the guest registration page as well. You can upload image
files to the appliance and display your own logo, header and footer. In addition, you can upload the acceptable use
policies that are displayed on the captive portal and guest registration page.
Following are guidelines for each item you can customize:
• Logo Image: The maximum size is 200 pixels wide by 55 pixels high, and the images can be in JPEG, GIF, or PNG
format. It displays on top of the header image.
• Header Image: The optimal size is 600 pixels wide by 137 pixels high. The image can be in JPEG, GIF, or PNG
format. The header displays at the top of the page.
• Footer Image: The optimal size is 600 pixels wide by 20 pixels high. The image can be in JPEG, GIF, or PNG
format. The footer displays at the bottom of the page.
• Acceptable Use Policy: The policy must be saved as a UTF-8 encoded file. It appears below the welcome
message in the captive portal. Users can scroll through the policy when they review it. This is used in the captive
portal and guest registration page. It must be a .txt file with a maximum of 8000 characters, including white
space.
If any of the customizable fields are not configured, then the factory defaults are displayed.
To customize the captive portal:
1. From the Grid tab, select the Grid Manager tab, and then click Captive Portal.
2. Select the member that is running the captive portal and click the Edit icon.
3. Select the Customization tab of the Member Captive Portal Properties editor.
4. In the General Captive Portal Customization section, complete the following:
— Company Name: Enter the name of your company. The company name displays on the title bar of the
browser. You can enter a maximum of 256 characters.
— Welcome Message: Type the message that displays on the captive portal. The message can contain a
maximum of 300 characters.
— Help Desk Message: Type a message that provides Helpdesk information, such as contact information for
technical assistance. The message can contain a maximum of 300 characters.

1222 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About the Captive Portal

— Logo Image, Header Image, Footer Image, Acceptable Use Policy: To display the image files and the
acceptable use policy on the captive portal, click Select beside the item you want to upload. In the Upload
dialog box, click Select File and navigate to the image or text file. Select the file you want to display and
click Upload. Note that these files have size requirements, as listed earlier in this section.
5. In the Guest Users Web Page Customization section, complete the following:
— The appliance displays certain fields on the guest registration page. Select the check boxes of the fields
that users are required to complete: Require First Name, Require Middle Name, Require Last Name, Require
Email, and Require Phone.
— Custom Field 1 — Custom Field 4: You can display up to four additional fields on the guest registration page.
To add a field to the guest registration page, enter a label for that field. The label can have a maximum of 32
characters. Select Require to require users to complete the field.
Users can enter a maximum of 128 characters in each of the fields in the captive portal login page and the guest
registration page.
6. Save the configuration and click Restart if it appears at the top of the screen.

Managing Captive Portal Certificates

When you enable support for encrypted web traffic sent over SSL/TLS, you can do any of the following:
• Generate a self-signed certificate and save it to the certificate store of your browser.
• Request a CA-signed certificate. When you receive the certificate from the CA, upload it on the member running
the captive portal.

Generating Self-Signed Certificates

You can generate a self-signed certificate for the captive portal. When you generate a self-signed certificate, you can
specify the hostname and change the public/private key size, enter valid dates and specify additional information
specific to the captive portal. If you have multiple captive portals, you can generate a certificate for each captive
portal with the appropriate hostname.
To generate a self-signed certificate:
1. From the Grid tab, select the Grid Manager tab, and then click Captive Portal.
2. Select the member that is running the captive portal, and then click HTTPS Cert -> Generate Self-signed Certificate
from the Toolbar.
3. In the Generate Self-signed Certificate dialog box, complete the following:
— Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256
(SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
— Days Valid: Specify the validity period of the certificate.
— Common Name: Specify the domain name of the captive portal.
— Organization: Enter the name of your company.
— Organizational Unit: Enter the name of your department.
— Locality: Enter a location, such as the city or town of your company.
— State or Province: Enter the state or province.
— Country Code: Enter the two-letter code that identifies the country, such as US.
— Admin E-mail Address: Enter the email address of the captive portal administrator.
— Comment: Enter additional information about the certificate.
4. Click OK.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1223

Authenticated DHCP

Generating Certificate Signing Requests

You can generate a CSR (certificate signing request) that you can use to obtain a signed certificate from your own
trusted CA. Once you receive the signed certificate, you can import it in to the Grid member that runs the captive
portal, as described in Uploading Certificates on page 1224.
To generate a CSR:
1. From the Grid tab, select the Grid Manager tab, and then click Captive Portal.
2. Select the member that is running the Captive Portal, and then click HTTPS Cert -> Create Signing Request from
the Toolbar.
3. In the Create Signing Request dialog box, enter the following:
— Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256
(SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
— Common Name: Specify the domain name of the captive portal.
— Organization: Enter the name of your company.
— Organizational Unit: Enter the name of your department.
— Locality: Enter a location, such as the city or town of your company.
— State or Province: Enter the state or province.
— Country Code: Enter the two-letter code that identifies the country, such as US.
— Admin E-mail Address: Enter the email address of the captive portal administrator.
— Comment: Enter information about the certificate.
4. Click OK.

Uploading Certificates
When you upload a certificate, the NIOS appliance finds the matching CSR and takes the private key associated with
the CSR and associates it with the newly uploaded certificate. The appliance then automatically deletes the CSR.
If the CA sends an intermediate certificate that must be installed along with the server certificate, you can upload
both certificates to the appliance. The appliance supports the use of intermediate certificates to complete the chain
of trust from the server certificate to a trusted root CA.
To upload a certificate:
1. From the Grid tab, select the Grid Manager tab, and then click Captive Portal.
2. Select the member that is running the captive portal, and then click HTTPS Cert -> Upload Certificate from the
Toolbar.
3. In the Upload dialog box, click Select File, navigate to the certificate location, and click Open.
The appliance imports the certificate . When you log in to the appliance again, it uses the certificate you
imported.

Downloading Certificates
You can download the current certificate or a self-signed certificate so users can install it in their browsers.
To download a certificate:
1. From the Grid tab, select the Grid Manager tab, and then click Captive Portal.
2. Select the member that is running the captive portal, and then click HTTPS Cert -> Download Certificate from the
Toolbar.
3. Navigate to where you want to save the certificate and save it.

1224 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Defining the IPv4 Network and DHCP Ranges

Starting the Captive Portal Service

Before you start the captive portal service, ensure that the member is not running any other service.
To start the captive portal service:
1. From the Grid tab, select the Grid Manager tab, and then click Captive Portal.
2. Select the member that is configured to run the captive portal service and click the Start icon.

Defining the IPv4 Network and DHCP Ranges

First define the IPv4 network that uses DHCP authentication, and then define the DHCP ranges and services for each
access level that you want to provide on the network:
• Quarantine
• Authenticated
• Guest
For information about configuring DHCP IPv4 networks, ranges and services, seeChapter 27, Managing IPv4 DHCP
Data, on page 1107 and Chapter 26, Configuring DHCP Properties, on page 1069.

Quarantine DHCP Range

You must configure a DHCP range for the quarantine level so the member DHCP server can assign IP addresses within
that range to unauthenticated DHCP clients. An unauthenticated client is allowed to access the captive portal only
and must successfully pass the authentication process before it can receive an IP address from the authenticated
range.
Infoblox recommends 30-second leases for addresses in the quarantine DHCP range. This provides enough time for
the user authentication process, so when the client attempts to renew the lease at the midpoint of its lease time, the
member can then assign the client a new IP address, depending on the result of the authentication process.
When you configure the quarantine DHCP range, you must specify the captive portal IP address as the DNS server for
the address range. The captive portal runs a limited DNS server that resolves all queries with the IP address assigned
to the web interface on the captive portal.
Note that you can run the Captive Portal wizard to automatically set the lease time of the quarantine range to 30
seconds and to add the captive portal IP address as the DNS server. For information about the Captive Portal wizard,
see Using the Captive Portal Wizard on page 1226. Alternatively, you can set the lease time and the DNS server IP
address in the DHCP tab of the DHCP Range editor. For information about the DHCP Range editor, see Configuring IPv4
Address Ranges on page 1121.
To ensure that clients can reach the captive portal, you must specify a route to the captive portal. On a network where
all systems can reach each other without going through a router, that is, all IP addresses are on the same subnet, you
must configure Option 33 for the quarantine DHCP range. This option specifies a list of static routes that the client
should install in its routing cache. The routes consist of a list of IP address pairs. For clients to reach the captive portal,
specify the portal IP address first (destination address), and the LAN address of the NIOS appliance second. When
the appliance assigns an IP address from the quarantine DHCP range, it also includes the static route that you
specified in option 33. For information about configuring DHCP options, see Configuring IPv4 DHCP Options on page
1081. On a routed network, you must configure a default route via the router on the subnet.

Authenticated DHCP Range

Configure a DHCP range for authenticated users if you want the Grid member to assign IP addresses within that range
to authenticated DHCP clients. Users that receive an IP address in this range typically are allowed full access to the
network.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1225

Authenticated DHCP

When a client successfully passes authentication, the member automatically stores its MAC address in the
corresponding MAC address filter. When the client attempts to renew the lease at the midpoint of its lease time, the
member matches the source MAC address in the request with a MAC address in the filter for the authenticated DHCP
address range. The member then assigns the client a new IP address from the authenticated DHCP range.

Guest DHCP Range

Configure a guest DHCP range if you want to provide guest access privileges. You can configure and customize a guest
registration page when you configure the captive portal. For information about this feature, see Customizing the
Captive Portal Interface on page 1222.

Defining MAC Address Filters

After you configure the network and DHCP ranges, you must then configure the MAC address filters and add them to
the appropriate DHCP ranges. If you configured DHCP ranges for authenticated and guest users, you must configure
MAC address filters for each range with an action of Allow. You must also add those filters to the quarantine range
with an action of Deny, to ensure that the member does not allocate an address from the quarantine range to a host
whose MAC address matches an entry in the MAC filters for the authenticated and guest DHCP ranges.
When you create the filters, you also specify whether the MAC address entries expire. The member automatically
deletes expired MAC address entries from the filter. If a client that registered earlier attempts to renew its IP address
or to register after its MAC address has expired, it is redirected to the captive portal because its MAC address is no
longer in the filter.
You can run the Captive Portal wizard to automatically create the MAC address filters, as described in the next section,
Using the Captive Portal Wizard, or you can configure each filter as described in Defining MAC Address Filters on page
1194.

Using the Captive Portal Wizard

After you configure the captive portal and the DHCP ranges for each access level, you can use the Captive Portal
wizard to accomplish the following tasks:
• Associate the captive portal member with the member that serves the DHCP ranges you configured.
• Create MAC address filters and add them to the appropriate DHCP ranges. The wizard allows you to create MAC
address filters for the quarantine DHCP range, and for the authenticated and guest DHCP ranges, depending on
whether the captive portal is used to register users for authentication, guests, or both. This was specified, when
you configured the captive portal properties, described in Configuring Captive Portal Properties on page 1221.
For example, if you indicated that the captive portal is used for authenticated users only, then the wizard allows
you to create a MAC filter for the authenticated DHCP range only.
— If the captive portal is used to register users for authentication, the wizard allows you to create a MAC
address filter for the authenticated range. The wizard then automatically adds the filter to the authenticated
DHCP range with an action of Allow. It also adds the filter to the quarantine range with an action of Deny.
This ensures that the member does not allocate an address from the quarantine range to a host whose MAC
address matches an entry in the MAC filter.
— If the captive portal is used to register guest users, the wizard allows you to create a MAC address filter for
the guest range. The wizard then automatically adds the filter to the guest DHCP range with an action of
Allow. It also adds the filter to the quarantine range with an action of Deny. This ensures that the member
does not allocate an address from the quarantine range to a host whose MAC address matches an entry in
the MAC filter.
• Add the captive portal IP address as the DNS server for the quarantine address range.
• Set the lease time of the quarantine range to 30 seconds.

1226 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using the Captive Portal Wizard

To use the Captive Portal wizard to complete the tasks for the DHCP authentication feature:
1. From the Data Management tab, select the DHCP tab, or from the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and click Configure Captive Portal.
3. In the Captive Portal wizard, complete the following and click Next:
— Member DHCP: Select the member DHCP server that uses this captive portal to authenticate users.
— Captive Portal: Select the member that runs the captive portal. Note that the member that runs the captive
portal cannot run any other service, such as DHCP or DNS, and cannot be the Grid Master or Grid Master
candidate.
4. This panel allows you to create MAC filters for the authenticated and guest DHCP ranges. The MAC filters you can
create depend on your entry in the Captive Portal properties of the Grid member. For example, if you indicated
that the captive portal is used for authenticated users only, then this panel allows you to create a MAC filter for
the authenticated DHCP range only.
You can also specify existing MAC filters, if you want to apply them to the authenticated and guest DHCP ranges.
Complete the following and click Next:
— Authenticated MAC Filter: Specify a name for the MAC filter that is used for authenticated users.
— Expiration Time: Specify how long a MAC address is stored in the MAC address filter for authenticated
users.
— Never: Select this option to store MAC addresses in the MAC address filter until they are manually
removed.
— Expires in: Select this option to store MAC addresses in the MAC address filter for the specified period
of time.
— Guest MAC Filter: Specify a name for the MAC filter that is used for guest users.
— Expiration Time: Specify how long a MAC address is stored in the MAC address filter for guest users.
— Never: Select this option to store MAC addresses in the MAC address filter until they are manually
removed.
— Expires in: Select this option to store MAC addresses in the MAC address filter for the specified period
of time.
5. In this panel, you specify the network and address ranges, so the wizard can apply the MAC address filters to the
appropriate ranges. Complete the following:
— Network: Select the network that uses DHCP authentication.
— Authenticated Range: Select the IP address range that the appliance uses for authenticated users. The
wizard applies the authenticated MAC address filter you specified in the preceding step to this DHCP range
with an action of Allow. This effectively allows the member to assign an IP address from the address range
to a requesting host whose MAC address matches the MAC address in the filter.
— Guest Range: Select the IP address range that the appliance uses for guest users.The wizard applies the
guest MAC address filter you specified in the preceding step to this DHCP range with an action of Allow. This
effectively allows the member to assign an IP address from the address range to a requesting host whose
MAC address matches the MAC address in the filter.
— Quarantine Range: Select the IP address range that the appliance uses for quarantined addresses. The
wizard applies the authenticated and guest MAC address filters to the quarantine DHCP range with an
action of Deny. This effectively denies an address request from a host whose MAC address matches an
entry in the MAC filters for the authenticated and guest DHCP ranges.
6. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1227

Authenticated DHCP

Adding and Modifying the Filters and Associations

The Captive Portal wizard simplified the configuration process by accomplishing a number of tasks simultaneously.
To accomplish each task separately, or to modify the filters or associations after you have run the wizard:
• To define the MAC address filters for each range, see Defining MAC Address Filters on page 1194.
• To bind each filter to the appropriate DHCP range, see Applying Filters to DHCP Objects on page 1204.
• To specify the DNS server IP address for the quarantine range and set the lease time to 30 seconds, see
Configuring General IPv4 DHCP Properties on page 1071.
• To associate a member DHCP server with a captive portal and specify the MAC filters for the authenticated and
guest DHCP ranges:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box -> Edit icon.
2. In the Member DHCP Properties editor, click the IPv4 Authenticated DHCP tab and complete the following:
— Use this Captive Portal for Infoblox Authenticated DHCP: Select this check box and select the captive
portal that you want to associate with the member.
— Authenticated User MAC Filter: Select the MAC filter used for authenticated users. To change your
section, click Clear and click Select again.
— Guest User MAC Filter: Select the MAC filter for guest users. To change you selection, click Clear and
click Select again.
3. Save the configuration and click Restart if it appears at the top of the screen.

Monitoring DHCP Authentication

You can monitor the status of the captive portal service, as described in Monitoring Services on page 1333. You can
check its status in the Grid Status widget and the Member Status widget on the Dashboard. For information about
these widgets, see Chapter 2, Dashboards, on page 117.
You can also view the MAC addresses that were added to each MAC address filter, as described in Viewing MAC
Address Filter Items on page 1211.

Viewing DHCP Ranges and Filters

To view the newly created MAC address filters:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab.
Grid Manager lists all the configured filters.
2. You can select a filter and view or configure its properties, such as extensible attributes.
For more information about the filters and editing their properties, see Managing DHCP Filters on page 1210.
To view the DHCP ranges and the newly added filters:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network .
2. Select the DHCP range you want to view and click the Edit icon.
3. If the editor is in Basic mode, click Toggle Expert Mode.
4. Click the Filters tab to view the filters.
To verify that the captive portal is the DNS server in the quarantine range:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section -> network.
2. Select the quarantine DHCP range and click the Edit icon.
3. In the DHCP Range editor, click the DHCP tab.
The captive portal IP address is listed in the DNS Servers table.

1228 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring Authenticated DHCP

Configuration Example: Configuring Authenticated DHCP

In this example, a school (school.edu) has two locations, its main campus, campus1.schoool.edu, and a satellite
campus, campus2.school.edu. It has a captive portal server in each location. In the main campus, the Grid Master
also functions as a DHCP server and uses a captive portal server to register DHCP clients. In the satellite campus, two
members serve DHCP and use the same captive portal server. The captive portal servers use the same RADIUS
authentication server group to authenticate users.

Figure 32.4

Grid Master DHCP

authenticated Server
10.2.1.50 - gm.campus1.school.edu
10.2.1.150 10.2.1.10
guest
10.2.1.151 -
10.2.1.170

quarantine Captive Portal

10.2.1.225 - cp1.campus1.school.edu
10.2.1.254 10.2.2.10

RADIUS ASG

Captive Portal
cp2.campus2.school.edu
10.1.3.10
DHCP Server DHCP Server
ds1.campus2.school.edu ds2.campus2.school.edu
10.1.1.10 10.1.2.10

authenticated authenticated
10.1.1.50 - 10.1.2.50 -
10.1.1.150 10.1.2.150
guest guest
10.1.1.151 - 10.1.2.151 -
10.1.1.170 10.1.2.170

quarantine quarantine
10.1.1.225 - 10.1.2.225 -
10.1.1.254 10.1.2.254

Create the RADIUS Authentication Server Group

Create the RADIUS authentication server group and add two RADIUS servers to the group.
1. From the Administration tab, click the Authentication Server Groups tab.
2. Expand the Toolbar and click Add -> RADIUS Service.
3. In the Add RADIUS Authentication Service wizard, complete the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1229

Authenticated DHCP

— Name: Enter RADIUS ASG.

— RADIUS Servers: Click the Add icon and enter the following:
— Server Name or IP Address: Enter the RADIUS server FQDN, which is rs1.school.edu.
— Authentication Port: Accept the default port (1812).
— Authentication Type: Select the PAP authentication method.
— Shared Secret: Enter no1nose.
— Authentication
— Timeout: Enter 5 seconds.
— Retries: Accept the default, which is five.
— Accounting
— Timeout: Enter 5 seconds.
— Retries: Accept the default, which is five.
— Click Test to validate the configuration and check that the Grid Master can connect to the RADIUS
server.
Grid Manager displays a message confirming the configuration is valid.
Click Add to add another RADIUS server to the group, and then enter the following:
— Server Name or IP Address: Enter the RADIUS server FQDN, which is rs2.school.edu.
— Authentication Port: Accept the default port (1812).
— Authentication Type: Select the PAP authentication method.
— Shared Secret: Enter no1nose.
— Authentication
— Timeout: Enter 5 seconds.
— Retries: Accept the default, which is five.
— Accounting
— Timeout: Enter 5 seconds.
— Retries: Accept the default, which is five.
— Click Test to validate the configuration and check that the Grid Master can connect to the RADIUS
server.
Grid Manager displays a message confirming the configuration is valid.
4. Click Save & Close.

Configure the Captive Portal Properties

Configure the captive portal properties of cp1.campus1.school.edu.
1. From the Grid tab, select the Grid Manager tab.
2. Click the Captive Portal tab -> Services tab.
3. Select the member cp1.campus1.school.edu and click the Edit icon.
4. In the General Basic tab of the Member Captive Portal Properties editor, complete the following:
— Use This Authentication Server Group for Authenticating Captive Portal Users: Select RADIUS ASG.
— Captive Portal User Types: Select Both.
— Portal IP Address: Select 10.2.2.10.
— Enable SSL on Portal: Select this option.
— Log Registration Success: Select Informational.
— Log Registration Failure: Select Informational.
5. Click Save & Close.

1230 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring Authenticated DHCP

Configure the captive portal properties of cp2.campus2.school.edu.

1. From the Grid tab, select the Grid Manager tab.
2. Click the Captive Portal tab -> Services tab.
3. Select the member cp2.campus2.school.edu and click the Edit icon.
4. In the General Basic tab of the Member Captive Portal Properties editor, complete the following:
— Use This Authentication Server Group for Authenticating Captive Portal Users: Select RADIUS ASG.
— Captive Portal User Types: Select Both.
— Portal IP Address: Select 10.1.3.10.
— Enable SSL on Portal: Select this option.
— Log Registration Success: Select Informational.
— Log Registration Failure: Select Informational.
5. Click Save & Close.

Customize the Captive Portals

Customize the captive portal cp1.campus1.school.edu.
1. From the Grid tab, select the Grid Manager tab.
2. Click the Captive Portal tab-> Services tab.
3. Select cp1.campus1.school.edu and click the Edit icon.
4. Select the Customization tab of the Member Captive Portal Properties editor.
5. In the General Captive Portal Customization section, complete the following:
— Company Name: Enter School.
— Welcome Message: Type the following: Welcome to School. Please sign in.
— Help Desk Message: Type: To reach the Helpdesk, call (408) 111-2222 or email [email protected].
— Logo Image: Click Select beside the logo file and upload it.
6. In the Guest Users Web Page Customization section, complete the following:
— Select the check boxes beside Require First Name, Require Last Name, Require Email.
7. Click Save & Close.
Select the other captive portal server, cp2.campus2.school.edu, and enter the same information.

Generate a Self-Signed Certificate and Upload It

To generate a self-signed certificate for cp1.campus1.school.edu:
1. From the Grid tab, select the Grid Manager tab.
2. Click the Captive Portal tab from the Services tab.
3. Select cp1.campus1.school.edu, and then click HTTPS Cert -> Generate Self-signed Certificate from the Toolbar.
4. In the Generate Self-signed Certificate dialog box, complete the following:
— Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256
(SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
— Days Valid: Enter 60 days.
— Common Name: Enter cp1.campus1.school.edu.
5. Click OK.
6. Click Save & Close.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1231

Authenticated DHCP

To generate a self-signed certificate for the captive portal cp2.campus2.school.edu:

1. From the Grid tab, select the Grid Manager tab.
2. Click the Captive Portal tab from the Services tab.
3. Select cp2.campus2.school.edu, and then click HTTPS Cert -> Generate Self-signed Certificate from the Toolbar.
4. In the Generate Self-signed Certificate dialog box, complete the following:
— Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256
(SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
— Days Valid: Enter 60 days.
— Common Name: Enter cp2.campus2.school.edu.
5. Click OK.
6. Click Save & Close.

Start the Captive Portal Service

1. From the Grid tab, select the Grid Manager tab.
2. Click the Captive Portal tab from the Services tab.
3. Select cp1.campus1.school.edu and cp2.campus2.school.edu, and then click the Start icon.

Configure the Networks and DHCP Ranges

Configure the network on the Grid Master.
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section.
2. Click the Add drop-down list and select IPv4 Network.
3. In the Add IPv4 Network wizard, select one of the following and click Next:
— Add Network: Click this.
4. Complete the following and click Next:
— Address: Enter 10.2.1.0/24.
5. Complete the following to assign the network to the Grid Master:
— Add Infoblox Member: Select gm.campus1.school.edu.
6. Click Save & Close.
Configure the ranges on the Grid Master.
To create the authenticated range:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks section.
2. Click the 10.2.1.0/24 network link, and then click the Add drop-down list and select DHCP Range.
3. In the Add IPv4 Range wizard, select Add DHCP Range and click Next:
4. Complete the following:
— Network: Click Select Network and select 10.2.1.0/24.
— Start: Enter 10.2.1.50.
— End: Enter 10.2.1.150.
— Name: Enter authenticated range.
5. Click Next and complete the following:
— Grid Member: Select this option and select gm.campus1.school.edu.
6. Click Save & Close.
To create the guest range:
1. Click the 10.2.1.0/24 network link, and then click the Add drop-down list and select DHCP Range.
2. In the Add IPv4 Range wizard, select Add DHCP Range and click Next:

1232 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuration Example: Configuring Authenticated DHCP

3. Complete the following:

— Network: Click Select Network and select 10.2.1.0/24.
— Start: Enter 10.2.1.151.
— End: Enter 10.2.1.170.
— Name: Enter guest range.
4. Click Next and complete the following:
— Grid Member: Select this option and select gm.campus1.school.edu.
5. Click Save & Close.
To create the quarantine range:
1. Click the 10.2.1.0/24 network link, and then click the Add drop-down list and select DHCP Range.
2. In the Add IPv4 Range wizard, select Add DHCP Range and click Next:
3. Complete the following:
— Network: Click Select Network and select 10.2.1.0/24.
— Start: Enter 10.2.1.225.
— End: Enter 10.2.1.254.
— Name: Enter quarantine range.
4. Click Next and complete the following:
— Grid Member: Select this option and select gm.campus1.school.edu.
5. Click Save & Close.
Create the network and DHCP ranges for the DHCP servers ds1.campus1.school.edu and ds2.campus2.school.edu.

Run the Captive Portal Wizard

Run the Captive Portal wizard to associate the Grid Master with its captive portal, and to configure the MAC address
filters:
1. From the Data Management tab, select the DHCP tab, or from the Grid tab, select the Grid Manager tab.
2. Expand the Toolbar and click Configure Captive Portal.
3. In the Captive Portal wizard, complete the following and click Next:
— Member DHCP: Select the Grid Master, gm.campus1.school.edu.
— Captive Portal: Select cp1.campus1.school.edu.
4. Complete the following and click Next:
— Authenticated MAC Filter: Enter Auth_MAC_Filter.
— Expiration Time: Select Never.
— Guest MAC Filter: Enter Guest_MAC_Filter.
— Expiration Time: Select Never.
5. Complete the following:
— Network: Select 10.2.1.0/24.
— Authenticated Range: Select 10.2.1.50 - 10.2.1.150.
— Guest Range: Select 10.2.1.151 - 10.2.1.170.
— Quarantine Range: Select 10.2.1.225 - 10.2.1.254.
6. Click Save & Close.
Run the Captive Portal wizard to associate ds1.campus2.school.edu with the captive portal server
cp2.campus2.school.edu, and then run it again to associate ds2.campus2.school.edu with the same captive portal
server.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1233

Authenticated DHCP

Start the DHCP Service

To start the DHCP service on the Grid Master:
1. From the Data Management tab, select the DHCP tab -> Members tab.
2. Select the Grid Master gm.campus1.school.edu, and the two members, ds1.campus2.school.edu and
ds2.campus2.school.edu.
3. Expand the Toolbar and click Start.
4. In the Start Member DHCP Service dialog box, click Yes.
5. Grid Manager starts DHCP services on the Grid Master and on the selected members.

NAC Integration
You can configure member DHCP servers to send authentication requests to RADIUS servers and to allocate
addresses based on the authentication results. This allows you to place DHCP clients into separate network
segments.
You can divide your network into different segments by configuring address ranges and applying NAC filters to them.
NAC filters use authentication results from RADIUS servers as matching criteria for granting or denying address
requests.
When a DHCP client requests a lease, the member DHCP server can query a remote backend RADIUS server such as
the Sophos NAC Advanced server to determine if the DHCP client is authorized to access the network. A Sophos NAC
Advanced server is an access-control and compliance server that supports the RADIUS protocol.
The RADIUS server then checks its database and provides the compliance state and user class, if configured, of the
DHCP client. The member DHCP server matches the response with the configured NAC filters, and grants a lease to
the appropriate network segment.
Figure 32.5 presents an example illustrating the authentication process and how a member DHCP server matches the
response with NAC filters to determine whether to grant or deny a lease. In the example, there are two DHCP ranges
configured, each with a NAC filter that specifies RADIUS compliance state of DHCP clients allowed in each range.

Figure 32.5

Sophos NAC Advanced Server

DHCP Client Infoblox DHCP Server RADIUS Server

1 2

NAC Filters DHCP Ranges

Non-Compliant
4 192.168.1.50-
192.168.1.150

5 Compliant
192.168.1.151-
192.168.1.200

1234 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring NAC with RADIUS Servers

The following steps relate to Figure 32.5.

1. A DHCP client sends a DHCPDISCOVER, DHCPREQUEST, or DHCPINFORM to the Infoblox DHCP server.
2. The DHCP server sends the RADIUS server a RADIUS Access-Request packet that includes RADIUS VSAs (Vendor
Specific Attributes) with the MAC address and DHCP transaction ID of the DHCP client.
3. When the RADIUS server receives the Access-Request packet, it does the following:
a. It looks up the MAC address in its database to retrieve the associated compliance state and user class.
b. The RADIUS server sends back a RADIUS Access-Accept packet that includes RADIUS VSAs with the
compliance status and user class.
4. The DHCP server receives the Access-Accept packet and tries to match the response with a NAC filter.
5. The DHCP server matches the response with the NAC filter for compliant DHCP clients and sends the DHCP client
a DHCPOFFER that contains an IP address from the corresponding DHCP range. The server also provides the
configuration and options associated with that range.

Configuring NAC with RADIUS Servers

Complete the following tasks to configure the RADIUS server and the member DHCP server.
On an already functioning RADIUS server:
• Add the member DHCP server as a RADIUS client. Make sure that the shared secret you enter on the RADIUS
server matches the shared secret that you specify when you add the server to the authentication server group in
Grid Manager.
Note that on Grid Manager, you can enter only one shared secret for each RADIUS server. Therefore, on a RADIUS
server, you must define the same shared secret for all Grid members that connect to it.
For information about adding RADIUS clients, refer to the documentation for the RADIUS server.
• Add the Infoblox Grid Master as a RADIUS client, even if it is not going to perform NAC authentication. This
enables you to test the connection to the RADIUS server.
On the member DHCP server:
1. Configure the authentication server group for the RADIUS servers. For information, see Adding a Server Group on
page 1236.
2. Associate the authentication server group with the Grid member. For information, see Associating a Server Group
with a Member on page 1237.
3. Configure the network and the DHCP ranges. For information, see Configuring DHCP Ranges on page 1238.
4. Configure the NAC filters, as described in About NAC Filters on page 1238
5. Apply the NAC filters to the DHCP ranges, as described in Applying Filters to DHCP Objects on page 1204.
6. Enable the DHCP service. For information, see Starting DHCP Services on a Member on page 1103.
Optionally, you can do the following:
• Manage the authentication cache, as described in Clearing the Authentication Cache on page 1237.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1235

Authenticated DHCP

About Authentication Servers

You can create a RADIUS authentication server group for Sophos NAC Advanced servers, and then associate the group
with the member DHCP server that sends authentication requests. The member DHCP server tries to connect to each
Sophos NAC Advanced server in the group using one of the following methods: Ordered List or Round Robin.
In the Ordered List method, the member DHCP server always selects the first Sophos NAC Advanced server in the list
when it sends an authentication request. It only sends authentication requests to the next server on the list if the first
server goes down.
In the Round Robin method, the member DHCP server selects the first Sophos NAC Advanced server for the first
request, the second server for the next request, and so on until it selects the last server in the list. Then it starts with
the first server in the list and continues the same selection process.
Each member DHCP server can have only one RADIUS server group assigned, but a RADIUS server group can be
assigned to multiple member DHCP servers.

Adding a Server Group

To create a RADIUS authentication server group for Sophos NAC Advanced servers:
1. From the Administration tab, click the Authentication Server Groups tab.
2. Expand the Toolbar and click Add -> RADIUS Service.
3. In the Add RADIUS Authentication Service wizard, complete the following:
— Name: Enter the name of the server group.
— RADIUS Servers: Click the Add icon and enter the following:
— Server Name or IP Address: Enter the Sophos NAC Advanced server FQDN or IP address.
— Comment: You can enter additional information about the server.
— Authentication Port: The destination port on the Sophos NAC Advanced server. The default is 1812.
— Authentication Type: Select the authentication method of the RADIUS server from the drop-down list.
You can specify either PAP (Password Authentication Protocol) or CHAP (Challenge Handshake
Authentication Protocol). The default is PAP.
— Shared Secret: Enter the shared secret that the member DHCP server and the Sophos NAC Advanced
server use to encrypt and decrypt their messages. This shared secret must match the one you entered
on the Sophos NAC Advanced server.
— Enable Accounting: Leave this blank. RADIUS accounting is not supported.
— Connect through Management Interface: Select this so that the NIOS appliance uses the MGMT port for
communications with just this server.
— Disable server: Select this to disable the Sophos NAC Advanced server if, for example, the connection
to the server is down and you want to stop the DHCP server from trying to connect to this server.
— Click Test to validate the configuration and check that the Grid Master can connect to the Sophos NAC
Advanced server. Before you can test the configuration though, you must specify the authentication
and accounting timeout values.
If the Grid Master connects to the Sophos NAC Advanced server using the configuration you entered, it
displays a message confirming the configuration is valid. If it is unable to connect to the Sophos NAC
Advanced server, the appliance displays a message indicating an error in the configuration.
— Click Add to add the Sophos NAC Advanced server to the server group.
When you add multiple Sophos NAC Advanced servers to the list, you can use the up and down arrows to
change the position of the servers on the list. The member DHCP server connects to the Sophos NAC
Advanced servers in the order they are listed.
— Authentication
— Timeout: The time that the member DHCP server waits for a response from a Sophos NAC Advanced server
before considering it unreachable. You can enter the time in milliseconds or seconds.

1236 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Authentication Servers

— Retries: The number of times the member DHCP server retries connecting to a Sophos NAC Advanced server
before it considers the server unreachable. The default is five.
— Mode: Specifies how the member DHCP server selects the first Sophos NAC Advanced server to contact.
— Ordered List: The member DHCP server always selects the first Sophos NAC Advanced server in the list
when it sends an authentication request. It queries the next server only when the first server is
considered down. This is the default.
— Round Robin: The member DHCP server selects the first Sophos NAC Advanced server for the first
request, the second server for the next request, and so on. If the last server is reached, then the DHCP
server starts with the first server in the list, and so on.
— Enable Authentication Cache: The member DHCP server automatically caches authentication results for 120
seconds. When you enable this option, you can override this default in the Cache Time to Live field. You
must enable this option to clear the cache, as described in Clearing the Authentication Cache on page
1237.
— Cache Time to Live: Specifies the duration of time an authentication result is stored. The default is one
hour. The maximum is 259200 seconds (3 days).
— Recovery Interval: Specifies the duration of time a Sophos NAC Advanced server stays inactive after being
down, before becoming eligible to have RADIUS requests sent to it. The recovery interval starts when a
Sophos RADIUS server is first discovered to be down.
— Comment: You can enter additional information about the server group.
— Disable: Select this to disable the authentication server group.
4. Save the configuration and click Restart if it appears at the top of the screen.

Associating a Server Group with a Member

To associate an authentication server group with a member DHCP server:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box, and click the Edit icon.
2. If the Member DHCP Properties editor is in Basic mode, click Toggle Expert Mode.
3. Select the IPv4 Authenticated DHCP tab.
4. Click the Use this Authentication Server Group for Sophos/RAIDIUS Authenticated DHCP check box, and then
select a group from the drop-down list.
5. Save the configuration and click Restart if it appears at the top of the screen.

Managing Server Groups

To view the list of authentication server groups, from the Administration tab, click the Authentication Server Groups
tab and expand the RADIUS Service subtab. For each server group, you can view the server group name, comments,
and whether the group is available or disabled. You can then select a server group to modify or delete it.
To modify a server group, select it and click the Edit icon. You can modify any of its properties, and add or delete
servers from the group. When you delete a Sophos NAC Advanced server from a group, the appliance permanently
deletes it.
To delete a server group, select it and click the Delete icon. When you delete an authentication server group, the
appliance permanently deletes it.

Clearing the Authentication Cache

The authentication cache can store authentication results for up to 20,000 DHCP clients. When the cache reaches its
limit, the DHCP member logs a message in syslog. To clear the entire cache or the cache entry of a specific MAC
address, you must enable the authentication cache in the RADIUS Service wizard or editor.
To clear the entire authentication cache:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1237

Authenticated DHCP

2. Expand the Toolbar and select Clear -> Authentication Cache.

3. When the Clear Authentication Cache confirmation dialog appears, click Purge.
To delete a specific entry:
1. From the Data Management tab, select the DHCP tab -> Members tab -> member check box.
2. Expand the Toolbar and select Clear -> Authentication Record.
3. In the Clear Authentication Record dialog box, enter the DHCP client MAC address, and then click Purge.

Configuring DHCP Ranges

Create the IPv4 network and DHCP ranges as described in Chapter 27, Managing IPv4 DHCP Data, on page 1107. You
can create multiple DHCP ranges and apply one or more NAC filters to each of them.

Listing DHCP Ranges

By default, DHCP ranges are listed according to their start addresses. You can reorder them according to the order in
which you want the member DHCP server to evaluate the ranges.
Consider the following sample DHCP ranges:
— 10.20.30.100-10.20.30.199 (NAC filter that allows leases for compliant DHCP clients)
— 10.20.30.0-10.20.30.99 (No filters)
If the DHCP range with the NAC filter is listed before the range with no filters, then the DHCP server consults the
Sophos NAC Advanced server and applies the NAC filter before it grants a lease. It grants leases from the range with
no filters only if no NAC filters matched or after all leases from the first range are exhausted. If the first range is the
production range and the second range is for the quarantine group, then the server applies the NAC filters for the
production range, before it grants leases to the quarantine range.
To change the order of DHCP ranges in a network:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> network.
2. Expand the Toolbar and click Order DHCP Ranges.
3. In the Order DHCP Ranges dialog box, click the up and down arrows to move ranges up or down on the list. The
Priority value changes accordingly.
4. Click OK.
You can view the DHCP objects in a network, including its DHCP ranges by navigating to the DHCP tab -> Networks tab
-> Networks panel, and then clicking the network link. You can select the Priority column for display to view the order
of the DHCP ranges. For information about editing the columns, see Customizing Tables on page 69.

About NAC Filters

You can define NAC filters that specify authentication results from a remote, backend RADIUS server such as the
Sophos NAC Advanced server. You can then apply each filter to a DHCP range or range template and indicate whether
the DHCP server grants or denies a lease when the authentication result matches the filter. You can apply NAC filters
to any DHCP range and DHCP range template.
NAC filters are enabled by default. When necessary, you can disable them for the entire Grid so you can perform
maintenance on your RADIUS server. When you disable NAC filters, no service interruptions, service down times,
configuration changes, or server restarts are required. For information about how to disable NAC filters, see Disabling
NAC Filters on page 1241.
In a NAC filter, you can define rules that specify the following:
• The status of the RADIUS authentication server group:

1238 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About NAC Filters

— Success: At least one of the servers in the RADIUS authentication server group is up.
— Fail: The MAC address in the DHCP request is not in the authentication cache and all servers in the server
group are down.
— Disabled: The RADIUS authentication server group is disabled, all the servers in the group are disabled, or
the member is not assigned a server group.
• The response from the RADIUS server:
— Accept: The response is an Access-Accept packet.
— Reject: The response is an Access-Reject packet.
• Whether the Access-Accept packet contains an error. The Infoblox DHCP server expects certain RADIUS VSAs in
the Access-Accept packet. An error occurs when any of the RADIUS VSAs are missing. For information about the
Access-Accept packet and the RADIUS VSAs, refer to the documentation for the specified RADIUS server.
— Yes: The Access-Accept packet does not include one or more RADIUS VSAs.
— No: There are no errors in the Access-Accept packet.
• A compliance state: unknown, non-compliant, compliant or partially compliant
• A RADIUS server user class
When the member DHCP server receives an address request, it checks the DHCP ranges in their priority order. For
information about the order of DHCP ranges, see Listing DHCP Ranges on page 1238.
For each DHCP range, it checks if the request matches any MAC filters, relay agent filters, or DHCP option filters that
apply to the range. (For information about these filters, see Chapter 31, Configuring IPv4 DHCP Filters, on page 1187.)
If any of those filters match, then the member either grants or denies a lease to the DHCP client, based on the filter.
If none of those filters match and there are NAC filters defined, then the member tries to send an authentication
request to a server in the RADIUS authentication server group.
If you want the member DHCP server to grant leases to specific DHCP ranges in case the RADIUS authentication server
group is considered disabled (server state = disabled) or if all RADIUS servers are down (server state = failure), create
a NAC filter for each situation and apply it to the appropriate range.
Note that when you create a NAC filter, you do not have to include rules that specify prerequisite conditions. For
example, when you create a filter that specifies a RADIUS server compliance state or user class, you do not have to
include rules that specify the following: server state=success, server response=accept, and server error = no.

Defining NAC Filters

To define a NAC filter:
1. From the Data Management tab, select the DHCP tab -> IPv4 Filters tab, and then expand the Toolbar and click
Add -> IPv4 NAC Filter.
or
From any panel in the DHCP tab, expand the Toolbar and click Add -> IPv4 NAC Filter.
2. In the Add Filter Wizard, complete the following and click Next:
— Name: Enter a name for the filter. You can enter a maximum of 255 characters. The name must be unique
within a specific network. If you want to specify option settings in the filter, the name must be unique
among all NAC filters.
— Comment: Optionally, enter additional information about the NAC filter.
3. Create a rule as follows:
— In the first drop-down list, select one of the following criterion: Compliance State, Server Error, Server
Response, Server State or User Class.
— In the second drop-down list, select an operator: equals or does not equal.
— The selections in the third drop-down list depend on the criterion you selected:
Compliance State: Select one of the following compliance states: Unknown, Non-compliant, Compliant or
Partially Compliant.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1239

Authenticated DHCP

Server Error: The Infoblox DHCP server expects certain RADIUS VSAs in the Access-Accept packet. When any
of the VSAs are missing, then the DHCP server considers this an error. For information about the
Access-Accept packet and the VSAs, refer to the documentation for the specified RADIUS server. Select one
of the following:
— Yes: Create a rule that matches when the RADIUS server sends an Access-Accept packet with a missing
VSA.
— No: Create a rule that matches when the RADIUS server sends an Access-Accept packet with no errors.
Server Response: Select one of the following:
— Accept: Create a rule that matches when the server sends back an Access-Accept packet.
— Reject: Create a rule that matches when the server sends back an Access-Reject packet.
Server State: Select one of the following:
— Success: Create a rule that matches when at least one RADIUS server in the group is up.
— Fail: Create a rule that matches when the MAC address of the DHCP client is not in the cache and all
RADIUS servers in the server group are down.
— Disable: Create a rule that matches when the RADIUS authentication server group is disabled, all
servers in the group are disable, or the member was not assigned a server group.
User Class: Enter the RADIUS user class value, for example, NACDeny. The member DHCP server does not
validate the entry. Therefore, you must make sure that the user class you enter matches the user class name
on the RADIUS server.
To add another rule:
— Click + to add another rule at the same level.
— Click |<- to add an all (logical AND) or any (logical OR) operator line and a parenthetical rule that is indented
one level and above the first rule.
— Click ->| to add an all (logical AND) or any (logical OR) operator line and a parenthetical rule that is indented
one level.
After you add all the match rules, you can click Preview to view the rules or click Reset to remove the previously
configured rules and start again.
4. Click Next and complete the following to define DHCP options:
— Option Space: Select an option space from the drop-down list. This field is not displayed if you do not have
custom option spaces. The appliance uses the DHCP option space as the default.
— Lease Time: Enter the value of the lease time in the field and select the time unit from the drop-down list.
The lease time applies to hosts that meet the filter criteria.
Options to Merge with Object Options
Click the Add icon. Grid Manager adds a new row to the table with the default DHCP option space and option
name displayed. Complete the following:
— Option Space: Click the down arrow and select an option space from the drop-down list. The selected
option space contains the corresponding DHCP options.
— Option Name: Click the down arrow and from the drop-down list, select the DHCP option you want to return
to the matching client.
— Value: Enter the match value that you want the filter to use for the selected DHCP option. For example, enter
the value 172.124.3.0 for the SUNW.SrootIP4 option.
To add more options to the filter, click the Add icon and repeat the steps.
5. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
6. Save the configuration and click Restart if it appears at the top of the screen.
After you add NAC filters, you must then apply them to DHCP ranges, as described in Applying Filters to DHCP
Objects on page 1204. You can also list, modify or delete NAC filters, as described in Managing DHCP Filters on
page 1210.

1240 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About NAC Filters

Disabling NAC Filters

NAC filters are enabled by default. When you disable them, the appliance bypasses evaluations of all NAC filters for
the entire Grid. There are no configuration changes, service restarts, or service down times when you disable the NAC
filters. The appliance keeps the filter configurations so you can enable them at a later time.
To disable NAC filters for the Grid:
1. From the Data Management tab -> DHCP tab, select Grid DHCP Properties from the Toolbar.
2. In the Grid DHCP Properties editor, click Toggle Advanced Mode, select the General tab -> Advanced tab, and then
complete the following in the Common Properties section:
— Disable All NAC Filters: Select this to disable all NAC filters in the Grid. The appliance keeps the filter
configurations so you can enable them when needed.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1241

Authenticated DHCP

1242 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 33 Managing Leases
This chapter explains how to manage IPv4 and IPv6 leases. It contains the following sections:
• About DHCP Leases on page 1244
• Viewing Current Leases on page 1244
• Viewing Detailed Lease Information on page 1246
• Viewing Lease History on page 1247
• Viewing Lease Event Detailed Information on page 1247
• Exporting Lease Records on page 1248
• Clearing Leases on page 1248

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1243

Managing Leases

About DHCP Leases

Historical DHCP lease records complement the real-time DHCP lease viewer by allowing the appliance to store and
correlate DHCP lease information over the lifetime of a lease. You can see critical information such as when the
appliance issued or freed an IPv4 or IPv6 address, the MAC address or DUID and host name of the device that received
the IP address, the Grid member that supplied the lease, and the start and end dates of the lease.
You can view current leases and lease history in the Data Management -> DHCP -> Leases tab in Grid Manager. To view
lease history, you must first enable lease logging at the Grid level. For information, see Configuring DHCP Logging on
page 1096 and Configuring the Lease Logging Member on page 1096. You can also export the DHCP lease history log
in CSV format for archival and reporting purposes.
In the Leases tab, you can do the following:
• View current leases. For information, see Viewing Current Leases on page 1244.
• View detailed information about a specific lease. For information, see Viewing Detailed Lease Information on
page 1246.
• View historical lease records. For information, Viewing Lease History on page 1247.
• View detailed information about a lease event. For information, see Viewing Lease Event Detailed Information
on page 1247.
• Export current leases and lease history logs. For information, see Exporting Lease Records on page 1248.
• Clear leases. For information, see Clearing Leases on page 1248.
You can also use the filter and Go to functions in the lease panels to retrieve lease information for specific hosts, MAC
addresses, and IP addresses. These capabilities are crucial for security auditing and for meeting new compliance
regulations such as SOX and HIPAA. You can also sort the lease information by column.

Viewing Current Leases

To view current IPv4 and IPv6 leases:
1. From the Data Management tab, select the DHCP tab -> Leases tab -> Current Leases.
2. Grid Manager displays the following information:
— IP Address: The IPv4 address or IPv6 prefix or address that the appliance assigned to a DHCP client for this
lease.
— Protocol: Indicates whether the lease is for an IPv4 or IPv6 address.
— Members/Servers: The Grid member or Microsoft server (for IPv4 leases only) that granted the lease.
— MAC address: The MAC address of the IPv4 DHCP client that received the lease for an IPv4 address.
— DUID: The DHCP Unique Identifier (DUID) of the IPv6 DHCP client that received the lease for an IPv6 address.
— Host Name: The hostname that the DHCP client sent with its DHCP request. For IPv4 leases, this field
displays the hostname of the DHCP client. For IPv6 leases, this field typically displays the FQDN.
— Fingerprint: The name of the DHCP fingerprint or vendor ID of the DHCP client that was identified through
DHCP fingerprint detection. This field displays No Match for devices that do not have any DHCP fingerprint
information. For information about DHCP fingerprints, see DHCP Fingerprint Detection on page 1357.
— State: The binding state of the current lease. The lease state can be one of the following:
— Free: The lease is available for clients to use.
— Active: The lease is currently in use by a DHCP client.
— Static: The lease is a fixed address lease.
— Expired: The lease was in use, but the DHCP client never renewed it, so it is no longer valid.
— Released: The DHCP client returned the lease to the appliance.

1244 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Current Leases

— Abandoned: The appliance cannot lease this IP address because the appliance received a response
when pinging the address.
— End: The day, date, and time when the state of the lease ends.
— Start: The day, date, and time when the state of the lease starts.
— Username: Displays the name of the user who receives the lease for the IP address. The username enables
you to differentiate between guest users and authenticated users. If you log in as an authenticated user,
your username is whatever you choose when you log in. If you log in as a guest, your username is First:
first_name Last: last_name. 
For example, if your first name is John and last name is Doe and your username is jdoe, when you log in as
an authenticated user, your username is jdoe. If you log in as a guest user, your username is First: John,
Last: Doe.
— ClientID: The DHCP client identifier (option 61) in an IPv4 lease. The client sends the client identifier as
option 61 in the DHCP DISCOVER and REQUEST packets, as described in RFC2132, DHCP Options and
BOOTP Vendor Extensions. The client identifier is either the MAC address of the network interface card
requesting the address or any string uniquely identifying the client. This field is not displayed by default.

Note: The dates and timestamps in the Leases tab are determined by the time zone setting of the admin account that
you use to log in to the appliance.

You can display the following discovered data for IPv4 leases:
— Last Discovered: The timestamp when the IP address was last discovered. This data is read-only.
— OS: The operating system of the detected host or virtual entity. The OS can be one of the following:
— Microsoft for all discovered hosts that have a non-null value in the MAC addresses using the NetBIOS
discovery method.
— A value that a TCP discovery returns.
— The OS of a virtual entity on a vSphere server.
— NetBIOS Name: The name returned in the NetBIOS reply or the name you manually register for the
discovered host.
— Discovered Name: The name of the network device associated with the discovered IP address.
— Discoverer: Specifies whether the IP address was discovered by a PortIQ or NIOS discovery process.
You can do the following in this tab:
• Sort the data in ascending or descending order by column.
• View the lease detailed information of a current lease by selecting the check box of the lease, and then clicking
the Open icon.
• Change a current lease state to Free by selecting the check box of a current lease, and then clicking the Delete
icon.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Print and export the data in this tab.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1245

Managing Leases

Viewing Detailed Lease Information

You can view detailed information about a specific lease.
To view detailed information of a specific lease:
1. From the Data Management tab, select DHCP tab -> Leases -> Current Leases -> lease check box, and then click the
Lease Details icon.
or
From the Data Management tab, select the IPAM tab, drill down to the IP Map, IP List, or IP address panel, and
then click Lease Details from the Toolbar.
2. In the Lease Detailed Information viewer, Grid Manager displays the following for each type of lease:
For IPv4 leases, it displays the fields Member, MAC address, Host, Start, End, Binding State, Username, Binding
State, as described in Viewing Current Leases on page 1244, plus the following information:
— Lease Issue: The date and time when the lease was issued. Displayed in the lease event details report only.
— Event: The action taken. This can be one of the following: Issued, Renewed, Freed, or Abandoned.
Displayed in the lease event details report only.
— Served by: The member that provides DHCP services to the lease.
— Next Binding State: The subsequent binding state when the current lease expires. The lease state and the
next binding state can be one of the following:
— Free: The lease is available for clients to use.
— Active: The lease is currently in use by a DHCP client.
— Static: The lease is a fixed address lease.
— Expired: The lease was in use, but the DHCP client never renewed it, so it is no longer valid.
— Released: The DHCP client returned the lease to the appliance.
— Abandoned: The appliance cannot lease this IP address because the appliance received a response
when pinging the address.
— Billing Class: The billing class of the lease.
— Option 82 Agent ID: The agent ID of the relay agent filter (option 82). A relay agent can append DHCP option
82, relay agent information, to a message that it forwards from a DHCP client to a DHCP server.
— Option 82 Circuit ID: The circuit ID of the relay agent filter (option 82).
— Option 82 Remote ID: The remote ID of the relay agent filter (option 82).

Note: The agent, circuit, and remote IDs for option 82 can be displayed in hexadecimal or plain text format. By
default, Grid Manager displays them in hexadecimal format. You can change the logging format, as
described in Defining Logging Format for DHCP Option 82 on page 1086.

— Option: Agent circuit ID and remote ID data sent by a DHCP relay agent in all DHCP options.
— UID: (User ID) The client identifier that the DHCP client sends the appliance (in DHCP option 61) when it
acquires the lease. Not all DHCP clients send a UID.
— TSFP: (Time Sent From Partner) The time—from the point of view of a remote DHCP failover peer—when the
current lease state ends.
— CLTT: (Client Last Transaction Time) The time of the last transaction with the DHCP client for this lease.
— TSTP: (Time Sent To Partner) The time—from the point of view of the local DHCP failover peer—that the
current lease state ends.
For IPv6 leases, it displays most of the same fields as IPv4 leases, plus the following information:
— DUID: The DUID of the IPv6 DHCP client that received the lease for an IPv6 address.
— Prefix Bits: The prefix length.
— Preferred Lifetime: The length of time that a valid address is preferred. A preferred address can be used with
no restrictions. When this time expires, the address becomes deprecated.

1246 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Lease History

Viewing Lease History

To view lease history:
• From the Data Management tab, select the DHCP tab -> Leases tab -> Lease History.
Grid Manager displays a table of historical leases that have been archived in the system. You can export the
information in the lease history table. You can also search by the IP address or MAC address of the lease. Grid
Manager displays the following read-only information:
• Lease Issue: The date and time when the lease was issued.
• Protocol: Indicates whether the lease is for an IPv4 or IPv6 address.
• IP Address: The IPv4 address or IPv6 prefix or address of the lease.
• MAC Address: The MAC address of the IPv4 lease.
• DUID: The DUID of the DHCP client that received the lease for an IPv6 address.
• Fingerprint: The name of the DHCP fingerprint or vendor ID of the DHCP client that was identified through DHCP
fingerprint detection. This field displays No Match for devices that do not have any DHCP fingerprint
information. For information about DHCP fingerprints, see DHCP Fingerprint Detection on page 1357.
• Host Name: The host name that the DHCP client sent to the appliance.
• Action: This can be one of the following: Issued, Renewed, Freed, or Abandoned.
• User Name: The name of the user who received the lease for the IP address.
• Start: The start date of the lease.
• Stop: The end date of the lease.
• Member/Server: The DHCP member or Microsoft server that granted the lease.
• Member IP Address: The IP address of the DHCP member that granted the lease.
You can do the following in this section:
• View the lease event detailed information of a historical lease by selecting the check box of a lease, and then
clicking the Open icon.
• Print or export the information in this section.

Viewing Lease Event Detailed Information

You can view detailed information about a historical lease record by clicking the lease in the Data Management tab
-> DHCP tab -> Leases tab -> Lease History. Grid Manager displays the event, the date and time when the event
occurred, plus detailed information about the historical lease record. For information about the fields, see Viewing
Detailed Lease Information on page 1246.
You can also export and print the information in this panel. For information, see Exporting Lease Records on page
1248.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1247

Managing Leases

Exporting Lease Records

The DHCP lease history log holds a maximum of 100,000 entries. After that maximum is reached, the appliance
begins deleting entries, starting with the oldest. To archive DHCP lease history logs, you can export them and save
them as CSV (comma separated variables) files. You do not need to export the entire log. You can selectively export
a section of the log, such as the lease events for a single day.
As a conservative approach to archiving DHCP lease data, Infoblox recommends exporting the log on a daily basis,
perhaps through API (application programming interface) scripting. By exporting the daily log entries every day over
a certain period of time and then opening the exported files with a spreadsheet program, you can see the number of
entries for each day. You can then estimate how often you need to export the log to ensure that you save all of the
entries before the log fills up (at 100,000 entries). As a result, you might discover that you need to export the log more
or less frequently than once a day to archive all the records.
A limited-access admin group can view and export the DHCP lease history if it has read-only permission to the DHCP
lease history. For information on setting permissions for the DHCP lease history, see Administrative Permissions for
the IPv4 and IPv6 DHCP Lease Histories on page 262. In addition, you can export the displayed DHCP current lease
information or you can export them to a CSV file.
To export displayed current lease information:
1. From the Data Management tab, select the DHCP tab -> Leases tab -> Current Leases.
2. Click the Export icon and select Export visible data. For more information on how to export, see Exporting
Displayed Data on page 111.
To export DHCP current lease information to a CSV file:
1. From the Data Management tab, select the DHCP tab -> Leases tab -> Current Leases.
2. Click the Export icon and select Export data in Infoblox CSV Import format. For more information on how to export,
see Exporting Data to Files on page 108.
To export a lease history log:
1. From the Data Management tab, select the DHCP tab -> Leases tab -> Current Leases or Lease History.
2. Click the Export icon and select.
3. In the Export dialog box, click Start
4. Click Download when the export is complete. Ensure that you turn off the pop-up blocker in your browser.
5. In the File Download dialog box, select the appropriate action to either open or save the CSV file.

Clearing Leases
You can clear active leases for which you have read/write permission. When you clear an active lease, its IP address
becomes available and its status changes to “Free”. To clear an active lease:
1. From the Data Management tab, select the DHCP tab -> Leases tab -> Current Leases.
2. Click the check boxes beside the IP addresses of the leases you want to clear, and then click the Clear Lease icon.
Grid Manager clears the selected leases. You can view information about a cleared lease, by selecting it in the
Lease History panel and clicking the Edit icon.

1248 NIOS Administrator Guide (Rev. A) NIOS 7.3

Part 6 Managing Microsoft Windows
Servers

This section describes how you can centrally manage Microsoft Windows® DNS and DHCP servers from Grid
Manager. You can synchronize your DNS and DHCP data from the Microsoft servers to the Grid, and then use IPAM
tools to facilitate DHCP and DNS configuration and data management. This section includes the following chapters:
• Chapter 34, Managing Microsoft Windows Servers, on page 1251
• Chapter 35, Managing Microsoft DNS Services, on page 1283
• Chapter 36, Managing Microsoft DHCP Services, on page 1301

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1249

1250 NIOS Administrator Guide (Rev. A) NIOS 7.3
Chapter 34 Managing Microsoft Windows
Servers
This chapter explains how to configure Grid members to manage Microsoft Windows DNS and DHCP servers from Grid
Manager. It includes the following sections:
• About Managing Microsoft Servers on page 1253
— Requirements on page 1254
— Deployment Guidelines on page 1255
— Limitations for Scheduling Full Upgrades on page 1256
• Configuring Members to Manage Microsoft Servers on page 1256
— Setting Microsoft Server Credentials on page 1257
— Configuring a Managing Member on page 1258
• Configuring Grid Properties for Managing Microsoft Servers on page 1262
— Defining Monitor and Control Settings for DNS and DHCP Services on page 1263
— Output Destination for Log Messages on page 1263
— Maximum Simultaneous Connections for Microsoft Servers on page 1263
— Configuring RPC Timeout Settings on page 1264
— Setting Grid Properties for Managing Microsoft Servers on page 1264
— Viewing DNS and DHCP Service Status on Microsoft Servers on page 1265
• Managing Microsoft Servers on page 1265
— Setting Microsoft Server Properties on page 1265
— Changing the Managing Member or Management Mode on page 1266
— Backing Up Synchronized Data on page 1266
— Disabling Synchronization on page 1266
— Removing a Managed Microsoft Server on page 1266
• About Active Directory Sites and Services on page 1267
— Best Practices for Configuring Active Directory Sites and Services on page 1267
— Configuring and Managing Server Permissions on page 1268
• Configuring Active Directory Sites and Associated Networks on page 1269
• Managing Active Directory Sites on page 1269
— Viewing Active Directory Domains and Sites on page 1270
— Modifying Active Directory Sites and Networks on page 1270
— Deleting Active Directory Sites on page 1270

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1251

Managing Microsoft Windows Servers

— Moving Networks Between Active Directory Sites on page 1271

— Associating Active Directory Sites with Networks on page 1272
— Configuring Microsoft Server and LDAP Connections on page 1273
— Configuring Server Site Links on page 1273
• Managing Active Directory Sites and Associated Networks on page 1274
— Managing an Active Directory Site from the Microsoft server on page 1274
— Managing an Active Directory Site from NIOS on page 1274
— Managing Network Operations from Microsoft server on page 1274
— Managing Network Operations from NIOS on page 1275
— Restoring Server Data on page 1275
• Configuring Identity Mapping on page 1275
— Administrative Permissions on page 1276
— About User Sessions on page 1276
— Login and Logout Timestamps on page 1277
• Monitoring Managed Microsoft Servers on page 1278
— Viewing the Status of Servers on page 1278
— Viewing Detailed Status Information on page 1280
— Viewing Synchronization Logs on page 1281

1252 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Managing Microsoft Servers

About Managing Microsoft Servers

You can configure Grid members to manage Microsoft Windows DNS and DHCP servers, and synchronize their DNS
and DHCP data to the Grid database, so you can view and optionally, manage the data from Grid Manager. After the
data is synchronized, you can use the IPAM tools of Grid Manager to simplify DNS and DHCP configuration and
troubleshooting. You can use Smart Folders to organize your data, and monitor your networks and Microsoft servers
from the Dashboard. In addition, you can control the DNS and DHCP services of the Microsoft servers from Grid
Manager and configure server properties as well. You can use the Identity Mapping feature to get visibility of user
interaction with their environments. For more information about the Identity Mapping feature, see Configuring
Identity Mapping on page 1275.
Figure 34.1 illustrates a Grid that includes a member that provides DNS and DHCP services, and two other members
that manage multiple Microsoft DNS and DHCP servers. Assuming the admin has the appropriate permissions, the
admin can centrally manage the Microsoft DNS and DHCP servers and Infoblox DNS and DHCP server from a single
interface, Grid Manager.

Figure 34.1 Managing Microsoft and Infoblox DNS and DHCP Servers from the Grid Master

Admin Grid Master HA Grid Member HQ Site

DNS and DHCP
Server 10.1.0.0/16
Grid Manager

corp100.com

10.3.0.0/16 10.1.0.0/16

site3.corp100.com site1.corp100.com
MS DNS and Managing Managing MS DNS and
DHCP Server Member Member DHCP Server

10.4.0.0/16 10.2.0.0/16

MS DHCP Server
site4.corp100.com
MS DNS and site2.corp100.com
DHCP Server

MS DNS Server

You do not have to configure or install any application on the Microsoft servers for the Grid members to communicate
with the servers. Infoblox uses MS-RPC (Microsoft Remote Procedure Calls) to manage Microsoft servers.
A Grid member can manage a Microsoft server in either of two modes, Read-only or Read/Write. In Read-only mode,
the Grid member synchronizes data from the Microsoft server to the Grid so admins can use Grid Manager to view the
synchronized data, but not update it. Read/Write mode allows admins to update the synchronized data as well.
Updates from Grid Manager are then synchronized to the Microsoft server, and updates from the Microsoft server are
synchronized to the Grid.
Configuration changes and data synchronized from the Grid to the Microsoft server apply immediately after the
synchronization. You do not have to restart the Microsoft server or for DNS, reload the zones.
Note that due to a field length limit set on the Microsoft DHCP server, after you synchronize DHCP data on the
Microsoft server, the “Comment” and “Description” fields for a fixed address and reservation can display only up to
128 characters even though NIOS allows up to 256 characters for these fields.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1253

Managing Microsoft Windows Servers

Requirements
A Grid member must have a Microsoft Management license installed to manage a Microsoft server. The license allows
the member to synchronize data with Microsoft servers. It also activates the tabs, dialog boxes and other elements
in Grid Manager that you need to manage a Microsoft server.
Note that If you do not see the Microsoft Servers tab after you add a member that has a Microsoft Management
license, you might have to restart the Grid Master to view the tab and to manage Microsoft DNS and DHCP servers in
the Grid.

Supported Windows Versions

Infoblox Grid members can manage Microsoft servers that support the following Windows versions:

OS Levels Platforms
Microsoft Windows 2003 SP2 32 bits
Standard and Datacenter
Microsoft Windows 2003 R2 Initial Release 32 bits, 64 bits
Standard and Datacenter
Microsoft Windows 2008 SP2 32 bits, 64 bits
Standard and Datacenter
Microsoft Windows 2008 R2 Initial Release 64 bits
Standard and Datacenter
Microsoft Windows 2012 Initial Release 64 bits
Standard and Datacenter
Microsoft Windows 2012 R2 Initial Release 64 bits
Standard and Datacenter

Grid members check the Windows version of the Microsoft servers before each synchronization. If a Microsoft server
reports an unsupported version before a synchronization, the member logs an error and the synchronization fails.
Note that some Windows versions require certain updates and hotfixes installed, so the Microsoft server can
synchronize with the Grid member. Following are the current requirements:
• Windows Server 2003, Enterprise x64 Edition requires the installation of security update 935966.
• Windows Server 2008 R2 requires the hotfix referenced in the Knowledge Base article 981776.
• Windows Server 2008-based DNS servers might not display delegations for reverse lookup zones. For
information about this issue, including the available hotfix, refer to Knowledge Base article 958190.
For information about the updates, enter their IDs in the Search field of the Microsoft Support website at
http://support.microsoft.com.

Administrative Permissions
By default, only superusers can configure Grid members to manage Microsoft servers. Superusers can give
limited-access users Read-only or Read/Write permission to Microsoft servers. Read-only permission allows admins
to view the properties and data of a Microsoft server from Grid Manager. Write permission is required to configure
Grid members to manage Microsoft servers, edit their properties, and start or stop their DNS and DHCP services. For
additional information, see Administrative Permissions for Microsoft Servers on page 239.

1254 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Managing Microsoft Servers

Note that to view and manage the DNS and DHCP data synchronized from Microsoft servers, admins must have
permissions to the applicable DNS and DHCP resources. For example, to view DNS zones synchronized from Microsoft
servers, admins must have Read-only permission to zones, and to edit the zones, admins need Read/Write
permission to them. Similarly, to view DHCP ranges synchronized from Microsoft servers, admins must have
Read-only permission to DHCP ranges, and to edit the DHCP ranges, admins need Read/Write permission to the DHCP
ranges. For information, see Administrative Permissions for DNS Resources on page 241 and Administrative
Permissions for DHCP Resources on page 253.
The administrative permissions on the Grid are different from those on the Microsoft server. These permissions are
independent of each other and are not synchronized.

Deployment Guidelines
Following are some recommendations and considerations when configuring Grid members to manage Microsoft
servers:
• Infoblox recommends that you schedule the initial synchronization at a time when your network is less busy,
especially if you are synchronizing a large amount of data. In addition, if a Microsoft server reconnects after
being disconnected for a long period of time, it could synchronize a significant amount of data and this could
impact the Grid Master performance.
• vNIOS Grid members and Grid members running on Infoblox-250, Trinzic 100, and Trinzic 810 appliances do not
support being configured as managing members.
• The managing member must be close, in terms of network hops, latency and bandwidth, to the Microsoft
servers that it manages. This will help reduce the synchronization time and potential retries due to network
delays.
• Although a Grid member that manages Microsoft servers can run other protocols and services, to optimize
performance, Infoblox recommends that you configure one or more members solely for managing Microsoft
servers.
• Grid members connect to Microsoft servers using RPC calls over TCP/IP. You must adjust your firewall policies to
allow traffic between the managing Grid member and its assigned Microsoft servers. Grid members use the VIP
as their source port. In Windows Server 2003, RPC uses the dynamic port range 1025-5000, by default. In
Windows Server 2008, RPC uses the dynamic port range 49152-65535, by default. You can reduce the number
of available ports as follows:
— In Windows Server 2003, use the rpccfg.exe tool. For information, refer to
http://support.microsoft.com/kb/908472.
— In Windows Server 2008 and later, use the netsh tool. For information, refer to
http://support.microsoft.com/kb/929851.
The minimum number of ports required in the range is 255.
Note that TCP ports 135 and 445 must be open on the Microsoft server, in addition to the dynamic port range.
Ports 135 and 445 are used by the port mapper interface, which is a service on the Microsoft server that
provides information to clients on which port to use to connect to a specific service, such as the service that
allows the management of the DNS service.
• The capacity of the managing member must be greater than or equal to the sum of all its assigned Microsoft
servers.
• The capacity of the Grid Master must be greater than or equal to the sum of all managed Microsoft servers
• A Microsoft server can synchronize its data to only one network view, and for DNS data, only one DNS view.
• Multiple Microsoft servers can synchronize their data into the same network view and DNS view, unless there is
a conflict in their data. For example, two Microsoft servers in different locations could serve the same private IP
address space, such as 10.1.0.0/16, or serve reverse-mapping zones with the same name, such as
10.in-addr.arpa. Synchronizing their data to the same network view and DNS view would cause conflicts which
result in the Grid member synchronizing the data of only one Microsoft server and logging an error for the other
Microsoft server. In such situations, Infoblox recommends that you synchronize each Microsoft server to a
different network view and DNS view to ensure that data from both servers are synchronized.
• This release supports the following Microsoft IPAM enhancements:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1255

Managing Microsoft Windows Servers

— Monitor and control settings for DNS and DHCP services for Microsoft servers
— Synchronization of IP addresses with invalid MAC addresses
— Output destination for Microsoft server log messages in the syslog
— Synchronization and configuration of Microsoft DHCP failover relationships
— RPC (Remote Policy Call) timeout setting
— Maximum concurrent connections for Microsoft servers
— Enabling and Disabling DNS zone synchronization
— The ability to allow GSS-TSIG based DDNS updates from multiple clients in a single forest or multiple forests
using keys that are appropriate for their respective domains.
Earlier NIOS releases do not support these features. When you modify settings related to these features on
Microsoft servers assigned to Grid members running a NIOS release earlier than NIOS 6.11, the NIOS appliance
displays an error message.

Limitations for Scheduling Full Upgrades

When you schedule a full upgrade to NIOS 6.11 and later, you can set the RPC (Remote Procedure Calls) timeout
settings and maximum concurrent connections immediately on any member as soon as you upgrade the Grid Master.
When you disable the synchronization of a DNS zone, NIOS displays an error message if any Microsoft server that is
a potential synchronization master, which is assigned to a Grid member, has not been upgraded to NIOS 6.11.0 or
later versions.
The following happens if a DHCP failover configuration exists:
• Any Microsoft server configured to manage DHCP and assigned to a Grid member, which has not been
upgraded, synchronizes the DHCP configuration without any failover related data.
• You cannot assign a Microsoft server that is assigned to a Grid member, which has not been upgraded, to any
Microsoft failover relationship.
• NIOS manages any DHCP scope that is identified to be part of a Microsoft failover relationship but is managed
by a Grid member that has not been upgraded, in Read-only mode.

Configuring Members to Manage Microsoft Servers

You can manage Microsoft DNS and DHCP servers on any Grid member. To avoid performance issues, Infoblox
strongly recommends that you do not configure Microsoft DNS and DHCP servers on the Grid Master and Grid Master
candidate.
When an HA pair manages Microsoft servers, the active node handles synchronization. If an HA failover occurs during
a synchronization, the failing node immediately aborts the synchronization. The new active node resumes the next
synchronization. Changes that occurred on the Grid since the end of the last synchronization are lost.
For Microsoft DHCP failover, NIOS supports both the hot standby and load sharing modes in both Read/Write and
Read-only modes on DHCP servers running Microsoft Windows 2012 and 2012 R2. For more information about
Microsoft DHCP failover, refer to the Microsoft documentation.

1256 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Members to Manage Microsoft Servers

Complete the following tasks to configure a Grid member to manage a Microsoft server:
1. On the Microsoft server, create a user account for the Grid member. For information, see Setting Microsoft Server
Credentials.
2. On the Grid Master, configure the managing member, as described in Configuring a Managing Member.

Setting Microsoft Server Credentials

To enable a Grid member to synchronize data with a Microsoft server and control DNS and DHCP services, you must
do the following on the Microsoft server:
1. Create a user account for the Grid member.
2. Grant the user account the necessary permissions.
You can either add the user account to the Administrators Group or add the user account to specific groups and
explicitly set only the permissions necessary to access the DHCP and DNS services of the Microsoft server. The
following sections provide general instruction on each method.

Adding User Account to the Administrators Group

Adding the user account of the Grid member to the Administrators Group provides total control over the Active
Directory Domain. Do one of the following:
• If the managed Microsoft server is a standalone server or a member server in a domain, open Computer
Management, click Groups, and add the user account to the Administrators Group.
• If the managed Microsoft server is a domain controller, open Active Directory Users and Computers, select the
domain name, click Builtin, and add the user account to the Administrators Group.

Setting Specific Group Memberships and Permissions

If your security policy precludes adding user accounts to the Administrators group, you can add the user account to
individual groups and grant only the required permissions. For guidelines and more information, see the following:
http://support.microsoft.com/kb/325349
http://support.microsoft.com/kb/914392
To add the user account of the Grid member to individual groups and grant specific permissions:
• To enable the member to synchronize DNS data with the Microsoft server, add its user account to the
DnsAdmins Group.
• To enable the member to synchronize DHCP data with the Microsoft server, add its user account to the Dhcp
Administrators Group.
• To enable the Grid member to monitor, start, and stop the DNS and DHCP services, grant the user account
permissions on the Service Control Manager (SCM), as follows:
1. Grant permissions to the SCM on each managed Microsoft server. For more information, refer to the section
DNS Server Service Permissions at http://technet.microsoft.com/en-us/library/gg638675.aspx.
To find additional information, you can also search for "Least Privilege Setup" on the Microsoft sites.
2. Grant permissions to the DNS and/or DHCP service on each managed server by doing one of the following:
— Use the sc command line utility to remotely configure each managed DNS or DHCP server.
Note that you need to know the SID of the user account and its current permissions. You can retrieve the
SID of the user account by using the dsquery and dsget commands.
— Use the Domain Controller Policy editor to define a global policy that applies to all DNS or DHCP
services running in a domain or on domain controllers. For additional information, refer to
http://support.microsoft.com/kb/324802.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1257

Managing Microsoft Windows Servers

Configuring a Managing Member

When you configure a member to manage Microsoft servers, you must specify the following:
• The management mode of the Microsoft server. For information, see Setting the Management Mode on page
1258.
• A network view, if there is more than one in the Grid, and a DNS view, if there is more than one in the network
view. For information, see Synchronizing to a Network View and DNS View on page 1258.
For the steps on configuring the managing member, see Assigning Grid Members to Microsoft Servers on page 1259.

Setting the Management Mode

A Grid member can manage a Microsoft server in Read-only mode, which is the default, or in read-write mode. In
Read-only mode, the Grid member copies the DNS and DHCP data from the Microsoft server to the Grid so Grid
Manager admins can view the synchronized data. They cannot update the data, control the DNS and DHCP service of
the Microsoft server, or configure any properties.
When you select Read-only mode for Active Directory sites, you can view the sites and networks that are present on
the Microsoft server through Grid Manager. Note that you cannot manage the Active Directory sites and networks
directly from the Grid, but you can manage an object within the Grid that is associated with a Read-only Active
Directory Site or an Active Directory network. The synchronization process is Read-only and you cannot write into the
Microsoft server in this mode. For more information, see Assigning Grid Members to Microsoft Servers on page 1259.
In Read/Write mode, Grid Manager admins are allowed to update the data of the Microsoft server. Therefore during
each synchronization, the Grid member applies changes from the Grid to the Microsoft server and vice versa.
Read/Write mode also allows admins to control DNS and DHCP services of the Microsoft server and configure some
of their properties.
When you select Read/Write mode for Active Directory Sites, you can view and manage the sites and networks that
are present on the Microsoft server through Grid Manager. When you update an object that is associated with the
Active Directory Site or an Active Directory network, the changes reflect on the Microsoft server. For more information,
see Assigning Grid Members to Microsoft Servers on page 1259.
Note that the management mode of a Microsoft server is separate from the admin permissions that the appliance
requires to access the Microsoft servers and DNS and DHCP resources. An admin must still have the applicable
permissions to the Microsoft servers and DNS and DHCP resources they want to access. For information on admin
permissions, see Administrative Permissions for Microsoft Servers on page 239.

Synchronizing to a Network View and DNS View

A Microsoft server can synchronize its data only to a single network view and a DNS view. Grid Manager automatically
assigns Microsoft servers to the default view when a Grid contains only the default network view and DNS view. If a
Grid has more than one network view, you must select a network view for the Microsoft server to synchronize its data;
and if there are multiple DNS views, you must select a DNS view as well.
You cannot modify the assigned network view or DNS view of a Microsoft server after its data has been synchronized.
Instead, you must remove the Microsoft server and then add it again. For information about removing a server, see
Removing a Managed Microsoft Server on page 1266.
Microsoft servers do not support network views and DNS views. Therefore, network view and DNS view properties
have no effect on the DNS and DHCP data that are synchronized from Microsoft servers.

1258 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Members to Manage Microsoft Servers

Assigning Grid Members to Microsoft Servers

To configure a Grid member to manage one or more Microsoft servers:
1. Grid: From the Grid tab -> Microsoft Servers tab -> Servers tab, click the Add icon.
Standalone appliance: From the System tab -> Microsoft Servers tab -> Servers tab, click the Add icon.
2. In the Add Microsoft Server(s) wizard, complete the following:
— Which features do you want to configure?: This section appears only when you have selected the Enable MS
AD feature check box for mapping network users. For more information, see Enabling Identity Mapping on
page 615. You can select multiple options in this section:
• Network Users: Select this check box to enable the Grid member to synchronize user information
with the managed Microsoft servers.
• DNS and DHCP Services: Select this check box to enable the Grid member to synchronize DNS and
DHCP services with the Microsoft servers.
• Active Directory Sites: Select this check box to enable the Grid member to synchronize Active
Directory sites.
— In the General Settings section, complete the following:
— Managing Member: Click Select Member and select the Grid member that manages Microsoft servers.
Select None if you do not want to associate a Microsoft server with a Grid member.
— Credentials to Connect to the Microsoft Server(s): Enter the login name and password that the
appliance uses to connect to the Microsoft servers. These must be the same as those you specified
when you created the user account for the Grid member on the Microsoft servers. Note that you must
specify the domain name and the user name in the following format: domain_name\user_name.
— Manage Server(s) in: Select the management mode, which is either Read-only or Read/Write. You can
choose to manage the DNS and DHCP synchronization services in either Read-only or Read/Write
mode. For more information, see Setting the Management Mode on page 1258.
— Minimum Synchronization Interval (min): The default synchronization interval is two minutes. This is
the time between the completion of one synchronization and the start of a new one. Synchronizing
large data sets could take longer than the synchronization interval, causing a delay in the start of the
next synchronization. For example, if the synchronization interval is two minutes but a synchronization
takes five minutes, the time between the start of the first synchronization and the start of the next one
is approximately seven minutes.

Note: The synchronization of Microsoft DHCP servers running Microsoft Windows 2012 or later includes the
synchronization of DHCP failover relationships. Note that the DNS and DHCP failover synchronization rules
do not have an impact on the Microsoft servers running a Windows version that is earlier than 2012.

— Logging Level: Select a logging level for the Microsoft server log from the drop-down list: Low, Normal,
High, and Debug. NIOS logs the messages based on the logging level you set.
• Low: Logs only error messages.
• Normal: Logs warning and error messages.
• High: Logs warning, error and information messages.
• Debug: Logs messages about all events associated with synchronization.
See Viewing Synchronization Logs on page 1281 for a description of each level.
— Logging output destination: From the drop-down list, select an output destination to which the
appliance saves log messages for Microsoft servers. When you select Microsoft Log, the appliance logs
the messages that are generated for the respective Microsoft server in the existing Microsoft log. This is
selected by default. For more information, see Viewing Synchronization Logs on page 1281. When you
select Syslog, NIOS logs the messages that are generated for the respective Microsoft server in the
syslog. For more information about the syslog, see Viewing the Syslog on page 1341.
— Synchronize Data into Network View: This field appears only when there is more than one network view
in the Grid. Specify to which network view the data from the Microsoft servers is synchronized.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1259

Managing Microsoft Windows Servers

— Synchronize DNS Data into DNS View: This field appears only when there is more than one DNS view in
the network view. Specify to which DNS view the data from the Microsoft servers is synchronized.
— Comment: You can enter additional information about the servers.
— Disable Synchronization: Select this to disable the Microsoft servers. This allows you to preprovision
the Microsoft servers and then enable them at a later time.
3. Click Next.

Note: Depending on your configuration in the Which features do you want to configure? section, the Add
Microsoft Server(s) wizard displays the Microsoft server setting options.

4. Complete the following:

— If you have selected the Network Users check box, complete the following in the Select your across-server
settings for Network Users page:
— Use General credentials (from first page of wizard): Select this check box if you want to use the same
credentials that you specified for connecting the Microsoft servers.
— Credentials for synchronizing Network User service information: Specify a username and password to
synchronize user information from Active Directory domain controllers. The username you specify here
must belong to the Domain User group and Event Log Reader group in Microsoft. For information, see
Prerequisites on the Microsoft Server on page 1276.
— Use General synchronization interval (from first page of wizard): Select this check box to use the same
synchronization interval that you specified in the Minimum Synchronization Interval for synchronizing
the user and device mapping information from the Microsoft Active Directory authentication logs.
— Minimum synchronization interval: The default synchronization interval is two minutes. This is the time
between the completion of one synchronization and the start of a new one. Specify an interval to
synchronize user information from the Microsoft Active Directory authentication logs.
— If you have selected the DNS and DHCP Services check box, complete the following in the Select your
across-server settings for DNS and DHCP Services page:
— Use General credentials (from first page of wizard): Select this check box if you want to use the same
credentials that you specified for connecting the Microsoft servers.
— Credentials to connect to DNS and DHCP Services: Specify a username and password to synchronize
DNS and DHCP services. You must use the same username and password that you specify here when
the appliance prompts for credentials during DNS or DHCP synchronization.
— Use General synchronization interval (from first page of wizard): Select this check box to use the same
synchronization interval that you specified in the Minimum Synchronization Interval for synchronizing
the DNS and DHCP services as well.
— Minimum Synchronization interval: The default synchronization interval is two minutes. This is the time
between the completion of one synchronization and the start of a new one. Specify an interval to
synchronize the DNS and DHCP data from the Microsoft server.
— Manage DNS and DHCP services in: Select a value from the drop-down list. You can choose to manage
the DNS and DHCP synchronization services in either Read-only or Read/Write mode. For more
information, see Setting the Management Mode on page 1258.
— If you have selected the Active Directory Sites check box, complete the following in the Select your
across-server settings for Active Directory Sites page:
— Use General credentials (from first page of wizard): Select this check box if you want to use the same
credentials that you specified for connecting the Microsoft servers. Clear the check box to specify a new
username and password for managing Active Directory sites.
— Credentials for synchronizing Active Directory information: Specify a username and password to
synchronize Active Directory sites. You must specify the same username and password that you specify
here when the appliance prompts for credentials while synchronizing Active Directory sites.

1260 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Members to Manage Microsoft Servers

— Use General synchronization interval (from first page of wizard): Select this check box to use the same
synchronization interval that you specified in the Minimum Synchronization Interval for synchronizing
Active Directory sites.
— Minimum Synchronization interval: The default synchronization interval is two minutes. This is the time
between the completion of one synchronization and the start of a new one. Specify an interval to
synchronize the Active Directory sites.
— Manage Active Directory sites in: Select a value from the drop-down list. You can choose to manage the
Active Directory Site in either Read-only or Read/Write mode. For more information, see Setting the
Management Mode on page 1258.
— Encryption: You can encrypt the network traffic between the Grid member and the managed Microsoft
server using SSL. Select a value, None or SSL, from the drop-down list. Infoblox strongly recommends
that you select SSL from the drop-down list to ensure the security of all communications between the
NIOS appliance and the Active Directory server. When you select SSL, the appliance automatically
updates the TCP port to 636. When you select this option, you must specify the FQDN of the Microsoft
server instead of the IP address and you must upload a CA certificate from the Active Directory server.
Click CA Certificates to upload the certificate. In the CA Certificates dialog box, click the Add icon, and
then navigate to the certificate to upload it.
— TCP port for LDAP connections: The appliance displays the port number by default based on the
encryption type that you select. When you select None, the appliance automatically updates the TCP
port to 389.
5. Click Next and do the following in the Managed Servers table:
— Name or IP Address: Enter either the FQDN or IP address of the Microsoft server. In order for the member to
resolve the FQDN of a Microsoft server, you must define a DNS resolver for the Grid member in the DNS
Resolver tab of the Member Properties editor. Note that if the IP address of the Microsoft server is specified,
then the DNS resolver must resolve it when the member and Microsoft server synchronize DHCP data only.
— DNS Sync: Select this option to enable the Grid member to manage the DNS service and synchronize DNS
data with this server. Clearing this check box disables DNS service management and data synchronization.
This allows you to pre-provision specific Microsoft servers and then enable them at a later time.
— DHCP Sync: Select this option to manage the DHCP service of the Microsoft server and synchronize DHCP
data with this server. Clearing this check box disables DHCP service management and data synchronization.
This allows you to pre-provision specific Microsoft servers and then enable them at a later time.
— Active Directory Sites: Select this option to manage Active Directory sites and synchronize Active Directory
Sites and networks with the Grid.
— DNS Monitor & Control: Click Override to override the setting inherited from the Grid. To inherit the same
settings as the Grid, click Inherit. Select this to enable monitoring and the ability to control DNS service for
the Microsoft server. For more information, see Setting Grid Properties for Managing Microsoft Servers on
page 1264.
— DHCP Monitor & Control: Click Override to override the setting inherited from the Grid. To inherit the same
settings as the Grid, click Inherit. Select this to monitor and control DHCP service for the Microsoft server.
For more information, see Setting Grid Properties for Managing Microsoft Servers on page 1264.

Note: You cannot start or stop a DNS or DHCP service on a specific Microsoft server if you disable the monitor
and control setting for the respective service. You can control and monitor DNS and DHCP services at the
Grid level and override the settings at the Microsoft server level. Each monitor and control setting applies
only to the DNS or DHCP service and the respective Microsoft server.

— Synchronize Network Users: Click Override to override the settings inherited from the Grid. To inherit the
same settings as the Grid, click Inherit. Select this to enable the identity mapping for the Microsoft server.
For information, see Enabling Identity Mapping on page 615.
You can assign multiple Microsoft servers to a Grid member and test their connection to the Grid member. Click
the Add icon to add another Microsoft server.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1261

Managing Microsoft Windows Servers

6. Select a Microsoft server and click the Test Microsoft Server icon, or click the Action icon next to the
respective Microsoft server and select Test Microsoft Server from the menu to verify whether the appliance can
successfully connect to the Microsoft server. The appliance displays the test results in the Test Microsoft Server
Results dialog box.
7. Save the configuration and click Restart if it appears at the top of the screen.
or
Click Next: Continue to the next step and define extensible attributes for the Microsoft servers. For information,
see Using Extensible Attributes on page 427.
After you configure a Grid member to manage a Microsoft server, the member automatically connects to the Microsoft
server and starts synchronizing data. You can then do the following:
• View the status of the servers in the Microsoft Servers panel, as described in Monitoring Managed Microsoft
Servers on page 1278. Newly added servers first display a status of Connecting as the Grid member contacts
the Microsoft servers. The status changes to OK after the Grid member successfully connects to the Microsoft
server.
• View the data synchronized from the Microsoft servers. To view DNS data, navigate to the DNS view you
specified. For information, see Viewing Zones on page 873. To view DHCP data, navigate to the Networks tab of
the network view that you specified. For information, see Managing IPv4 DHCP Data on page 1107.
Network conditions and the amount of data can affect the synchronization time. Therefore, you might not be
able to view all of the synchronized data immediately.
• Use Smart Folders to organize the Microsoft servers and their data. For example, you can create a folder for DNS
zones and another folder for DHCP scopes synchronized from a Microsoft server. For information about Smart
Folders, see Chapter 3, Smart Folders, on page 173.
• Update the synchronized data. For information, see Chapter 35, Managing Microsoft DNS Services, on page
1283 and Chapter 36, Managing Microsoft DHCP Services, on page 1301.
You can also use Global Search to search for synchronized data, such as zones and IP addresses. For information, see
Global Search on page 68.

Configuring Grid Properties for Managing Microsoft Servers

You can configure the following Grid properties for Microsoft servers that are managed by a Grid member:
• Monitor and control settings for DNS and DHCP services. For information, see Defining Monitor and Control
Settings for DNS and DHCP Services on page 1263.
• Use the identity mapping feature to get visibility of user interaction with their environments. For information,
see Configuring Identity Mapping on page 1275.
• Output destination for Microsoft server log messages. For information, see Output Destination for Log Messages
on page 1263.
• Simultaneous connections for Microsoft servers. For information, see Maximum Simultaneous Connections for
Microsoft Servers on page 1263.
• Maximum connection timeout setting. For information, see Configuring RPC Timeout Settings on page 1264.
For more information about configuring Grid properties for Microsoft servers, see Assigning Grid Members to
Microsoft Servers on page 1259.

1262 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Grid Properties for Managing Microsoft Servers

Defining Monitor and Control Settings for DNS and DHCP Services
You can enable or disable monitor and control settings of DNS and DHCP services for a specific Microsoft server. The
appliance enables this by default when you add a Microsoft server. When you upgrade the existing Microsoft servers,
the managed member inherits values from the Grid. You can monitor and control the DNS and DHCP services on a
Microsoft service only if both the management setting of the respective service and the monitor and control settings
of the corresponding Microsoft server for the selected service are enabled. To know more about how to enable
monitor and control settings, see Setting Grid Properties for Managing Microsoft Servers on page 1264.

Note: The original setting that controls the overall management of a given service is referred to as the management
setting. It controls whether the synchronization of the corresponding service is enabled or not, with no change
to the existing synchronization behavior. Note that synchronization does not depend on the value of the
monitor and control setting for the Microsoft server.

You can configure Microsoft server settings at the Grid level. Note that Microsoft servers inherit these settings by
default, and you can override these settings at the Microsoft server level.
When you enable monitor and control settings for DNS and DHCP services, the managing member verifies the
corresponding service status on the Microsoft server every 30 seconds. The Grid Master is notified of the status
through Grid replication.
When you disable monitor and control setting for DNS and DHCP services, the managing member stops verifying the
service status. NIOS administrators cannot start or stop DNS or DHCP service on the Microsoft server. When you try
to start or stop these services through the Infoblox API, the appliance generates an error message. The pending
service control requests made before disabling the monitor and control settings are sent to the Microsoft server.
For information about the displayed status, see Viewing DNS and DHCP Service Status on Microsoft Servers on page
1265.

Output Destination for Log Messages

You can configure an output destination for Microsoft server log messages at the Grid level and override it at the
Microsoft server level. You can choose to save log messages related to Microsoft synchronization in the syslog or
Microsoft log. For information, see Viewing the Syslog on page 1341.
When you change the setting, the Grid Master notifies the managing member about the new setting through Grid
replication and sends log messages to the selected destination. The new setting takes effect for synchronization only
after the managing member is notified. The synchronization, which is already in progress continues to log messages
to the destination based on the old setting. To know more about how to select output destination for log messages,
see Setting Grid Properties for Managing Microsoft Servers on page 1264.

Maximum Simultaneous Connections for Microsoft Servers

You can specify a maximum number of simultaneous RPC connections that can be configured for the respective
Microsoft server, which are managed by the Grid. You can override this value at the Microsoft server level. To know
more about how to define maximum simultaneous connections for Microsoft servers, see Setting Grid Properties for
Managing Microsoft Servers on page 1264.

Note: When you increase the maximum number of simultaneous connections above the recommended setting for a
given Microsoft server, it may consume additional bandwidth, memory, and CPU usage.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1263

Managing Microsoft Windows Servers

Configuring RPC Timeout Settings

You can specify an RPC (Remote Procedure Call) timeout value to control network connectivity for Microsoft servers.
You can configure an RPC timeout value at the Grid level and override it for each Microsoft server. The default value
at the Grid level is ten seconds and the member inherits this value from the Grid. You can specify a value between
one and 60 seconds. To know more about how to configure RPC timeout settings, see Setting Grid Properties for
Managing Microsoft Servers on page 1264.

Setting Grid Properties for Managing Microsoft Servers

To configure Grid properties for managing Microsoft servers, complete the following:
1. Grid: From the Grid tab -> Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit. Select Microsoft
Sync Settings tab in the Grid Properties Editor wizard.
Microsoft Server: From the Grid tab -> Microsoft Servers tab -> Servers tab, select a Microsoft server and click the
Edit icon, or click the Action icon next to the respective Microsoft server and select Edit from the menu. In
the Microsoft server editor, click the General tab.
Standalone appliance: From the System tab -> System Manager tab, expand the Toolbar and click System
Properties -> Edit.
2. Complete the following in the Basic tab:
— Monitor and Control Services: Select this to enable monitor and control settings for DNS and DHCP services
for a specific Microsoft server. This is enabled by default. Each monitor and control setting applies only to
the corresponding service and is applicable only to the respective Microsoft server. You can override the
settings for each Microsoft server.
— DNS: Select this to enable monitoring and the ability to control DNS service.
— DHCP: Select this to enable monitoring and the ability to control DHCP service.
— Logging output destination: From the drop-down list, select an output destination to which the appliance
saves log messages for Microsoft servers. When you select Microsoft Log, the appliance logs the messages
that are generated for the respective Microsoft server in the existing Microsoft log. This is selected by
default. For more information, see Viewing Synchronization Logs on page 1281. When you select Syslog,
NIOS logs the messages that are generated for the respective Microsoft server in the syslog. For more
information about the syslog, see Viewing the Syslog on page 1341. Click Override to select an output
destination to save the log messages at the member level.
3. Optionally, select the Microsoft Server Settings tab in the Grid Properties Editor wizard and complete the
following in the Advanced tab or click the Advanced tab in the General tab in a Microsoft server editor:
— Maximum simultaneous connections: Specify a maximum number of simultaneous RPC connections that
can be configured for the respective Microsoft server, which are managed by the Grid. The default is five.
You can specify a value between two and 40.
You can click Override at the member level to specify a new value. The Override button changes to Inherit.
Click Inherit to inherit the value from the Grid.
— RPC timeout: Specify the RPC timeout value in seconds to control the network communication timeout. The
default is ten seconds. You can specify a value between one and 60.
You can click Override at the member level to specify a new value. The Override button changes to Inherit.
Click Inherit to inherit the value from the Grid.
4. Save the configuration.

1264 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Microsoft Servers

Viewing DNS and DHCP Service Status on Microsoft Servers

Each Microsoft server reports the following statuses:
• Service status (DNS and DHCP): Displays the status of the service on the actual Microsoft server, based on the
latest polling of the service by the managing member. The monitor and control setting has an effect only on the
service status, and therefore can affect the overall status.
• Overall status: Displays the service status for each service that is enabled for synchronization with the Microsoft
server. The overall status ignores any service status for which the monitor and control setting is disabled.
• Synchronization status: Displays the synchronization status for each service that is enabled for synchronization
on the respective Microsoft server. The synchronization status is not affected by the monitor and control setting.
For more information, see Viewing the Status of Servers on page 1278.

Note: When you disable monitor and control settings, Grid Manager displays unknown using gray color for such
services. When you enable monitor and control setting of a given service, Grid Manager displays the last
known status that is obtained before the setting was first disabled. The appliance later updates to the latest
status as soon as the monitoring resumes and Grid Manager displays the new status.

Managing Microsoft Servers

After you configure Grid members to manage Microsoft servers, you can set certain properties and manage the
servers as follows:
• Set server properties, as described in Setting Microsoft Server Properties.
• Change the managing member or the management mode, as described in Changing the Managing Member or
Management Mode on page 1266.
• Back up the synchronized data, as described in Backing Up Synchronized Data on page 1266.
• Disable synchronization with a Microsoft server, as described inDisabling Synchronization on page 1266.
• Remove a Microsoft server, as described in Removing a Managed Microsoft Server on page 1266.

Setting Microsoft Server Properties

You can modify any of the Microsoft server properties you previously configured, except for the network view and DNS
view. You can also set certain properties, including the logging level, extensible attributes, and administrative
permissions. Extensible attributes and permissions apply to the data only when they are managed from Grid
Manager. Extensible attributes and permissions are not synchronized to the Microsoft server.
To set the properties of a Microsoft server:
1. From the Grid tab, select the Microsoft Servers tab -> Servers tab, select a Microsoft server and click the Edit icon,
or click the Action icon next to the respective Microsoft server and select Edit from the menu.
2. In the Microsoft Server Properties editor, you can set properties in the following tabs:
— General: Modify the settings described in Assigning Grid Members to Microsoft Servers on page 1259.
— Services (DNS/DHCP): Modify DNS and DHCP synchronization settings. For more information, see Assigning
Grid Members to Microsoft Servers on page 1259.
— Active Directory Domain/sites: Modify Active Directory Site settings. For more information, see Assigning
Grid Members to Microsoft Servers on page 1259.
— Extensible Attributes: Define extensible attributes for the server. For information, see Using Extensible
Attributes on page 427.
— Permissions: Define administrative permissions that apply to the server. For information see About
Administrative Permissions on page 195.
3. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1265

Managing Microsoft Windows Servers

You can edit the General and Logging properties of multiple Microsoft servers at the same time by selecting the
Microsoft servers and clicking the Edit icon. When Grid Manager displays the Microsoft Server Properties editor, it
displays the values that the Microsoft servers have in common. If a property has multiple values, it indicates this. You
can then change any of the values and when you click Save, Grid Manager applies your changes to all the selected
Microsoft servers.

Changing the Managing Member or Management Mode

You can change the managing member and the management mode of a Microsoft server.
If you change the managing member, the previous member aborts any ongoing synchronization, and the newly
assigned member resumes the synchronization process.
Note that if you switch the managing member or change the management mode of a Microsoft server from Read/Write
to Read-only, the Grid member reverts any changes that were made from Grid Manager since the last synchronization.
For example, an admin adds a network and DHCP range for a scope. If another admin changes the management mode
of the Microsoft server to Read-only before the next synchronization, the Grid member deletes the network and DHCP
range at the next synchronization.
To change the member or management mode:
1. From the Grid tab, select the Microsoft Servers tab -> Servers tab, select a Microsoft server and click the Edit icon,
or click the Action icon next to the respective Microsoft server and select Edit from the menu.
2. In the Microsoft Server Properties editor, select the General tab and do any of the following:
— Managing Member: Click Select Member and select another Grid member.
— Manage Server(s) in: Select either Read-only or Read/Write.
3. Save the configuration and click Restart if it appears at the top of the screen.

Backing Up Synchronized Data

When you back up the Grid, it includes all managed Microsoft data. If you restore a backup, the data is restored on
the Grid only. It is not synchronized to the Microsoft servers. When the Grid member synchronizes the data after the
restore operation, it overrides the data on the Grid with the data from the Microsoft servers. For information about
backing up and restoring data, see Chapter 10, Managing NIOS Software and Configuration Files, on page 519.

Disabling Synchronization
When you set the disable option, the Grid member completes any on-going synchronization and does not start a new
one. Setting this option only affects data synchronization and does not affect the operations of the Microsoft server.
Synchronization resumes when the Microsoft server is re-enabled.
To disable a Microsoft server:
1. From the Grid tab, select the Microsoft Servers tab -> Servers tab, select a Microsoft server and click the Edit icon,
or click the Action icon next to the respective Microsoft server and select Edit from the menu.
2. In the General tab, select the Disable Synchronization option.
3. Save the configuration and click Restart if it appears at the top of the screen.

Removing a Managed Microsoft Server

When you remove a Microsoft server from the Grid, the managing member stops any on-going synchronization and
does not start a new one. If the Microsoft server served DNS, the synchronized DNS data remains unchanged in the
Grid. If the Microsoft server served DHCP, then Grid Manager deletes all the DHCP ranges, leases, and fixed addresses
associated with the server. It also deletes networks that were assigned only to the Microsoft server. It does not delete
a network if it was assigned to other Microsoft servers as well.
Removing a managed Microsoft server from the Grid does not affect the operations of the Microsoft server.

1266 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Active Directory Sites and Services

To remove a managed server:

1. From the Grid tab, select the Microsoft Servers tab -> Servers tab, select a Microsoft server and click the Delete
icon, or click the Action icon next to the respective Microsoft server and select Delete from the menu.
2. When the Delete Confirmation dialog box appears, click Yes.
For information about how removing a Microsoft server affects the synchronized DNS and DHCP data, see Disabling
and Removing Microsoft DNS Servers on page 1300 andDisabling and Removing Microsoft DHCP Servers on page
1320.

About Active Directory Sites and Services

An Active Directory Site represents physical or logical sites that are defined on a Microsoft server. Each Active
Directory Site is associated with an Active Directory Domain. A Microsoft administrator can associate multiple sites
and networks with an Active Directory Domain. You cannot associate the same network with multiple Active Directory
Sites. For more information about adding an Active Directory Site, see Monitoring Managed Microsoft Servers on
page 1278.
You can synchronize Active Directory Sites, along with the associated networks, from the Active Directory server. The
networks that synchronize from the Active Directory server appears in NIOS as a network or a network container. The
Active Directory Site to which the network belongs is displayed as an extensible attribute and associated with the
respective network. For more information, see Managing Extensible Attributes and Associated Networks on page
1272. When you create a new Active Directory Site on NIOS, the appliance synchronizes new Active Directory Sites
and associated networks with the Active Directory server.
The appliance uses LDAP to communicate with the Microsoft server. For more information, see Configuring Microsoft
Server and LDAP Connections on page 1273. You can specify a site link for a given Active Directory Site. For more
information, see Configuring Server Site Links on page 1273.
You can assign relevant permissions for Active Directory Domains at the Grid level, network view level, or at the object
level. For more information, see Configuring and Managing Server Permissions on page 1268.
The appliance supports the following versions of Microsoft servers: Microsoft Windows Server 2003, Microsoft
Windows Server 2008, Microsoft Windows Server 2008 R2, Microsoft Windows Server 2012, and Microsoft Windows
Server 2012 R2.

Best Practices for Configuring Active Directory Sites and Services

• A Grid member configured to synchronize Active Directory Sites and networks of a Microsoft server uses system
resources, CPU, memory, network, etc. The amount of consumed resources depends on the number of Microsoft
servers that are managed by the Grid member, the amount of data for synchronization and the synchronization
frequency. Infoblox recommends that the managing Grid member should not serve other protocols.
• The Grid Master might also be affected by the initial synchronization. The first synchronization replicates all
Active Directory Sites and networks from the managing Grid member to the Grid Master.
• The Grid member always initiates the connection to the Microsoft server. Infoblox recommends that you use an
encrypted LDAP connection between the Grid member and the Microsoft server. The appliance displays a
warning message when you use a non-encrypted connection.
• During a scheduled full upgrade, the synchronization of a Microsoft server is deactivated until the managing
Grid member completes its upgrade.
• Microsoft Windows 2003 does not support IPv6 networks. Hence, the appliance prevents you from performing
the following operations on the NIOS appliance, which might result in a synchronization failure on the Microsoft
server:
— Assigning an Active Directory Site to an IPv6 network if the site belongs to an Active Directory Domain that
is managed by a Windows 2003 server.
— Creating an IPv6 network from an IPv6 network template in which an Active Directory Site belonging to an
Active Directory Domain managed by a Windows 2003 server is defined.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1267

Managing Microsoft Windows Servers

— Moving one or more IPv6 networks when the destination Active Directory Site belongs to an Active Directory
Domain that is managed by a Windows 2003 server.

Synchronizing Active Directory Domains on a Domain Controller

The top level container in the Active Directory is called a Forest. Each forest can contain one or more Active Directory
domains. All these domains share the same sites and networks.
To avoid any inconsistency within NIOS, the appliance synchronizes only the root Active Directory domain of the forest
into the Grid. For example, if the Microsoft server points to a domain controller of xyz.abc.com domain, the appliance
synchronizes abc.com domain in NIOS.

Configuring and Managing Server Permissions

You can define permissions for Active Directory Sites on both the NIOS and Microsoft servers, but there is no
relationship between these two sets of permissions and they are not synchronized. You must have relevant
permissions on the Microsoft server to synchronize an Active Directory server. If you do not have permissions, the
operation fails and the appliance logs the message into the Microsoft log. The synchronization process fails until
appropriate permissions are granted.
On the Active Directory Sites, make sure that you set the following permissions in the Permission Entry for Sites dialog
box:
• In the Permissions section, select all the check boxes.
• In the Properties section, select the Read All Properties and Write All Properties check boxes.
An administrator can define relevant permissions on the Active Directory Site and associated networks to prevent
them from accidental deletion. However, you can modify such Active Directory Sites and networks. For example, you
can rename an Active Directory Site.
You can define permissions for an Active Directory Domain at the following levels:
• Grid level: When you assign Grid level permission, it is applicable to the objects that are associated with the
Active Directory Domains that you have defined. When you assign Grid permissions, you can assign either
Read/Write, Read-only, or Deny permissions for All Active Directory Domains resource. For more information
about how to define Grid level permission, see Defining Global Permissions on page 196.
• Network view level: When you assign permission at the network view level, the permission is applicable to all
the Active Directory Domains within the selected network view. For more information, see Administrative
Permissions for Network Views on page 254.
• Permission on the Active Directory Domain. For more information, see Defining Object Permissions on page
200.
You must have the following permissions on the Active Directory Domain to perform the relevant operations:
• Read-only permission on the Active Directory Domain to view the Active Directory Domain and associated Sites.
• Read/Write permission on the Active Directory Domain to add, update or delete an associated Active Directory
Site.
• Read/Write permission on the Active Directory Domain to associate or dissociate an Active Directory Site from or
to the network.
• Note that the All Active Directory Domains permission will only support two modes: Read-Only and Read/Write.
If you do not define permissions explicitly, the appliance sets Read-only permission for Active Directory
Domains and Sites.
• Note that the extensible attributes are used to represent Active Directory Domains and Sites. As extensible
attributes are generic and they do not support permissions, you can always retrieve Active Directory Domains
and Sites for a given network if you have Read-only permission.

1268 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Active Directory Sites and Associated Networks

Configuring Active Directory Sites and Associated Networks

An Active Directory Domain is a collection of Active Directory Sites and associated networks. Each Active Directory
Site can have multiple networks associated with it. The synchronization process ignores a network which is not
assigned to an Active Directory Site. You can create and modify Active Directory Sites and networks on the NIOS
appliance.
You can use Active Directory Sites and services to synchronize sites and networks from the Active Directory server.
After synchronization, the appliance displays these as networks or network containers in the appliance.
The Active Directory Sites that are associated with a network are displayed as extensible attributes, which is a
combination of the Active Directory Domain and Site name, for the respective networks on the appliance.
To add Active Directory Sites, you must have Read/Write permission on the respective Active Directory Domain with
which it is associated. For more information about permissions, see Configuring and Managing Server Permissions
on page 1268.
To create Active Directory Sites and associate networks:
1. From the Grid tab, select the Microsoft Servers tab -> Active Directory Domains tab and click the respective Active
Directory Domain name.
2. Click the Add icon in the New Active Directory sites wizard and specify a name for the Active Directory Site. You
can associate multiple sites with an Active Directory Domain.

Note: You can specify a name up to 63 bytes and it is not case-sensitive, but it cannot contain spaces and the
following special characters: |{}~[]’:;<>=?@!”#$%^&‘()+/\,*.

You can select an Active Directory Site and click the Delete icon to delete it.
3. Click Next to associate networks with an Active Directory Site. Select an Active Directory Site and click the Add
icon to associate networks with the respective site.
4. Click Cancel to close the wizard without saving your settings. You can click Save and Close to save the settings
and close the wizard or click Save and Edit to save the settings and edit the properties. The application will close
the wizard and open the Active Directory Site Properties editor. Click Save and New to save the Active Directory
Sites in the list and open a new wizard.

Managing Active Directory Sites

You can manage Active Directory Sites and networks that you defined earlier and modify their information. You can
do the following:
• View Active Directory Domains and sites, as described in Viewing Active Directory Domains and Sites on page
1270.
• Modify Active Directory Sites and networks, as described in Monitoring Managed Microsoft Servers on page
1278.
• Delete Active Directory Sites. For more information, see Associating Active Directory Sites with Networks on
page 1272.
• Move networks that are associated with an Active Directory Site to another. For more information, see Moving
Networks Between Active Directory Sites on page 1271.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1269

Managing Microsoft Windows Servers

Viewing Active Directory Domains and Sites

You can view Active Directory Domains that are associated with the Microsoft server. You can also view Active
Directory Sites and networks that are associated with the Active Directory Domains.
To view Active Directory Domains and sites:
1. From the Grid tab, select the Microsoft Servers tab -> Active Directory Domains tab.
2. Grid Manager displays the following information:
— Name: The name of the Active Directory Domain. You can click the name to view the Active Directory Sites
below it.
— NetBIOS Name: The name returned in the NetBIOS format.
— MS Sync Server: The Microsoft synchronization server that is associated with the Active Directory Domain.
— Network View: The network view that is associated with the Active Directory Domain.
You can do the following in the Active Directory Domains tab:
— Sort the Active Directory Domains in ascending or descending order by column.
— Use filters and the search function to look for specific values.
— Export and print the information in the table.
3. To view Active Directory Sites associated with an Active Directory Domain, click the domain name that is
displayed as a hyperlink. The appliance displays the list of Active Directory Sites that are associated with the
respective Active Directory Domain in the Active Directory Domains Home table.
You can do the following in the Active Directory Domains Home table:
— Sort the Active Directory Sites in ascending or descending order by column.
— Use filters and the search function to look for specific values.
— Export and print the information in the table.

Modifying Active Directory Sites and Networks

You can edit the name of an Active Directory Site and associate networks with the respective site. You can also add
additional networks or remove associated networks from the Active Directory Site.
To edit an Active Directory Site:
1. From the Grid tab, select the Microsoft Servers tab -> Active Directory Domains tab and click respective Active
Directory Domain name.
2. In the Active Directory Domains Home table, select an Active Directory Site name and click the Edit icon, or click
the Action icon next to the respective Active Directory Site name and select Edit from the menu.
3. In the Active Directory Site Properties editor, you can do the following:
— Name: The name of the Active Directory Site. You can edit the name.
— Networks: The networks that are associated with the Active Directory Site. You can click the Add icon to
associate new networks with the Active Directory Site.
To delete an associated network, select the check box adjacent to the network address, and click the Delete
icon.
4. You can either click Save and Close or Save to save your settings. Click Cancel to close the editor without saving
your settings.

Deleting Active Directory Sites

You can delete Active Directory Sites that are associated with an Active Directory Domain. You cannot delete an Active
Directory Site from the Active Directory Domain if the respective Active Directory Site has networks associated with
it. You must first delete the associated networks to delete an Active Directory Site.

1270 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Active Directory Sites

To delete Active Directory Sites:

1. From the Grid tab, select the Microsoft Servers tab -> Active Directory Domains tab and click the respective Active
Directory Domain name.
2. In the Active Directory Domains Home table, select an Active Directory Site and click the Delete icon, or click the
Action icon next to the respective Active Directory Site name and select Delete from the menu.
3. The appliance displays a confirmation message. Click Yes to delete the sites or click No to cancel the operation.

Moving Networks Between Active Directory Sites

You can move networks from an Active Directory Site to another using either the Microsoft Servers or the IPAM tab.
You can use the Microsoft Servers tab to move networks only when you select an Active Directory Site.
You can add multiple networks from various Active Directory Sites and move them simultaneously to an Active
Directory Site. When the Active Directory Site synchronizes, it always maps to a certain network view. You can only
select networks from a network view to which the Active Directory Domain belongs.
To move networks within Active Directory Sites, complete the following:
1. Microsoft Servers tab: From the Grid tab, select the Microsoft Servers tab -> Active Directory Domains tab and
click respective Active Directory Domain name. In the Active Directory Domains Home table, click the Action icon
next to the respective Active Directory Site name and select Move Networks from the menu.
OR
IPAM tab: From the Data Management tab, select the IPAM tab, select networks that you want to move and click
Move Networks from the Toolbar.
2. In the Move Networks wizard, complete the following:
— Destination Active Directory Site: Click Select Site to select the destination Active Directory Site. The
appliance displays the Microsoft Sites Selector dialog box listing all the Active Directory sites in the Grid. It
also displays the smart folders, if any. You can use the filter and Go to functions to find a specific Active
Directory site. To select an Active Directory site, click the site name.
— Networks: You can select networks that you want to move to another Active Directory Site.
— Go to: Specify an IP address of the network that you want to move to another destination and click Go.
— Click the Add icon to add networks. To delete a network from the list, select the check box next to the
network and click the Delete icon.
3. Click Move to move networks or click Close to exit.

Moving Multiple Networks to an Active Directory Site

You can move multiple networks to a given Active Directory Site in a single operation. The following rules are
applicable:
• Only a super-user can move multiple networks to an Active Directory Site.
• The destination site must belong to an Active Directory Domain that is synchronized in Read/Write mode.
• The appliance assigns the destination Active Directory Site to a network in either of the following cases:
— If the network is currently assigned to another Active Directory Site within the same Active Directory
Domain.
— If the network is currently not assigned to any Active Directory Site within the Active Directory Domain.
— The Active Directory Sites associated with an Active Directory Domain is different from the destination
Active Directory Site.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1271

Managing Microsoft Windows Servers

Associating Active Directory Sites with Networks

You can associate an Active Directory Site with an IPv4 or IPv6 network or an IPv4 and IPv6 network template. The
appliance does not check the synchronization mode of the associated Active Directory Domain when you create or
modify a template, but it verifies only when you use the template to create a network.
To assign Active Directory Sites to networks, complete the following:
1. From the Data Management tab, select the DHCP tab -> Networks tab.
2. In the Networks section, select either IPv4 Network or IPv6 Network from the Add drop-down menu and complete
the details as mentioned inAdding IPv4 Networks on page 1111 and Adding IPv6 Networks on page 1161
respectively, and complete the following to assign Active Directory Sites to networks:
— No Active Directory Site: Select this if you do not want to associate an Active Directory Site with the
network.
— Assign these Active Directory Domains/sites: Select this to assign multiple Active Directory Sites to a
network, but note that each Active Directory Site must be associated with a different domain. You cannot
add an Active Directory Site, if you have already assigned a domain from the same Active Directory Site.
When you select this option, the appliance enables the following:
— Active Directory Domain: The Active Directory Domains that are synchronized from the Microsoft server.
Click an Active Directory Domain that you want to associate.
To search for a particular Active Directory Domain, specify the respective name and click Go.
— Active Directory Sites: The Active Directory Sites that are associated with the selected Active Directory
Domain. Click an Active Directory Site that you want to associate.
To search for a particular Active Directory Site, specify the respective name and click Go.
— Add >: Click this to add the selected Active Directory Sites to the network.
— < Remove: Click this to remove an Active Directory Site, which you have already added, from the
network.
— << Remove all: Click this to remove Active Directory Sites, which you have already added, from the list.
— Assign the same domains/sites as the selected network: Click Select Network to assign Active Directory
Sites, which are associated with the selected network, to the new network that you are configuring. Select a
network from the Network Selector dialog box. The appliance displays the Active Directory Domains and
Sites that are associated with the selected network, but you cannot make any changes and the fields are
greyed out. Click Clear to clear the entry.
3. You can either click Save and Close to save the settings and close the wizard or click Save and New to save your
settings and open a new wizard or click Cancel to close the wizard without saving your settings.

Managing Extensible Attributes and Associated Networks

The appliance creates an extensible attribute for each Active Directory Domain that is synchronized with the Grid.
Note the following about extensible attributes:
• The appliance generates a name for the extensible attribute. The appliance displays an error message if you
have already created an extensible attribute with the same name.
• Extensible attributes are Read-only and does not support inheritance.
• You can define a single value only and there are no default values.
• The appliance restricts an extensible attribute to IPv4 network and IPv6 network objects.
• You can specify a value for each extensible attribute and it is optional.

1272 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Active Directory Sites

Configuring Microsoft Server and LDAP Connections

Active Directory is a distributed directory service that authenticates network users. Active Directory uses LDAP
(Lightweight Directory Access Protocol) to access other network services. This protocol is also used when an Active
Directory Service entry is configured under Authentication Server Groups. For an Active Directory, the Grid member
uses LDAP to communicate with the Microsoft server. Note that the managed Microsoft server must be a part of an
Active Directory Domain and it must be a domain controller for the respective domain. The appliance logs an error
message in the Microsoft log each time the synchronization happens if the Microsoft server is not a part of the Active
Directory Domain or if it is not the domain controller for the respective domain. You can define an LDAP timeout value
at the Grid level and override it at the Microsoft server level.
To configure LDAP timeout settings, complete the following:
1. Grid: From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
Select the Microsoft Sync Settings tab in the Grid Properties Editor wizard and click the Advanced tab.
Microsoft Server: From the Grid tab -> Microsoft Servers tab -> Servers tab, select a Microsoft server and click the
Edit icon. In the Microsoft server editor, select the General tab and click the Advanced tab.
2. Complete the following:
— LDAP timeout: Specify the LDAP connection timeout value. The default is 10 seconds. You can specify a
value between one and 60 seconds.
You can click Override to override the LDAP timeout value at the Microsoft server level. To inherit the
settings from the Grid, click Inherit.
3. Save the configuration.

Configuring Server Site Links

You must choose a site link when you create an Active Directory Site on the Microsoft server. The site link describes
how the replication occurs between the sites and the protocol, either IP (Internet Protocol) or SMTP (Simple Mail
Transfer Protocol), which is used for communication.
The appliance uses the default object DEFAULTIPSITELINK when you create an Active Directory Site from the NIOS
appliance. If you want to change the site link for a given Active Directory Site, which is already created, you must
create the Active Directory Site on the Microsoft server or modify it on the Microsoft server after you create it using
the NIOS appliance.
You must first configure site links on the Microsoft server. When you create Active Directory sites, the appliance
automatically associates them with the default IP site link. The value that you specify for default IP site link must exist
on the Microsoft server. Note that the appliance does not display any error message when you create a site with a site
link that does not exist on the Microsoft server.
To configure server site links, complete the following:
1. From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
Microsoft Server: From the Grid tab -> Microsoft Servers tab -> Servers tab, select a Microsoft server and click the
Edit icon. In the Microsoft server editor, select the General tab and click the Advanced tab.
2. Select the Microsoft Sync Settings tab in the Grid Properties Editor wizard and complete the following in the
Advanced tab:
— Default IP site link: Specify the default IP site link in the form of a string. The appliance does not validate it
against the Windows server during configuration. The appliance displays an error message during
synchronization, if the site link for IP does not match the configured name on the Windows server.
You can click Override to override the default IP site link value at the Microsoft server level. To inherit the
settings from the Grid, click Inherit.
3. Save the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1273

Managing Microsoft Windows Servers

Managing Active Directory Sites and Associated Networks

You can manage Active Directory Sites and networks using either the Microsoft servers or the NIOS appliance.

Managing an Active Directory Site from the Microsoft server

You can create, modify, or delete an Active Directory Site from the Microsoft server in both Read-only and Read/Write
synchronization modes. When you create an Active Directory Site from the Microsoft server, it is created on the NIOS
appliance. This site appears as an Active Directory Site under the corresponding Active Directory Domain and in the
respective extensible attribute.
When you make changes on the Microsoft server, the synchronization process ignores any other modifications that
you make, but replicates only the name changes to the Grid. When you rename an Active Directory Site, the change
reflects:
• in the Active Directory Site and in the respective extensible attribute.
• on all the networks that are associated with the Active Directory Site.
When you delete an Active Directory Site from the Microsoft server, it deletes the Active Directory Site object and
removes corresponding extensible attributes. The appliance removes the value from all the network objects that are
associated with it.

Managing an Active Directory Site from NIOS

You can create, modify, or delete an Active Directory Site from the appliance in Read/Write synchronization mode
only. The appliance displays an error message if you perform any of these operations in Read-only mode.
When you rename an Active Directory Site and the associated networks, the changes reflect on the Microsoft server.
The appliance displays an error message when you delete an Active Directory Site that is associated with networks.
You must first remove the networks that are associated with the site.
You cannot resize or split a network with an associated site in Read-only synchronization mode. You cannot join two
networks if any of the involved networks or network containers are associated with a site irrespective of the
synchronization mode.

Managing Network Operations from Microsoft server

Note that you can perform network operations, such as create, modify or edit networks, in both Read-only and
Read/Write synchronization modes. When you create a network, the synchronization process ignores the network if
it is not assigned to a Active Directory Site. When the network is attached to the site, the appliance finds a matching
network or network container in the configured network view. If it does not exist, the appliance creates a new network
or a network container depending on the objects existing in the database. The new network or network container is
set as unmanaged and a new extensible attribute is attached to the object to store the site.
Note the following about managing networks:
• When you update a site that is associated with a network, the change is visible on the corresponding network or
network container.
• Synchronization process ignores the changes when you update a network. Note that it does not ignore the
changes when you modify the Active Directory Site or change an IP address or a CIDR.
• When you delete a network, the appliance removes the extensible attribute that is representing the associated
site from the corresponding network or network container.
• If the status is set as managed, it indicates that the network is used for another purpose inside the Grid. The
appliance does not remove it from the Grid.
• If the status is set as unmanaged, the appliance deletes the network if there is no other site coming from
another Active Directory Domain, which is associated with the network. Otherwise the appliance does not
remove the network from the Grid.

1274 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Identity Mapping

Converting Unmanaged Networks to Managed Status

When you synchronize a network from the Active Directory server, the network created in NIOS is considered to be
unmanaged. You can neither associate a NIOS member or a Microsoft server to manage it nor edit permissions, and
other fields. You can only edit extensible attributes and Active Directory sites on the unmanaged network. To perform
certain operations on Unmanaged networks, you must first convert them to Managed networks.
The IPAM main page lists all networks that are created during Active Directory synchronization as unmanaged,
highlighted in yellow. You can explore unmanaged networks through IPAM’s IP Map and IP List views.
Unmanaged networks can be converted at the IPAM main page and at the device level under Data Management –>
Devices, selecting a device and opening the Networks page.

Managing Network Operations from NIOS

The appliance denies the operation when you create a network, which is associated with a site, if the respective site
belongs to an Active Directory Domain that is synchronized in Read-only mode. Otherwise the appliance creates it on
the Microsoft server that is associated with the respective site.

Restoring Server Data

When you restore a database backup, the appliance performs the following operations after the standard restore
procedure is complete:
• The appliance deletes the cached data that is used for synchronization.
• Synchronization for all configured Microsoft servers starts in Read-only mode.
Note that these rules are applicable during upgrade also.

Configuring Identity Mapping

You can enable Identity Mapping on the NIOS appliance to provide Active Directory domain user information if the
NIOS appliance is connected to a Microsoft server. This feature supports Active Directory domains whose domain
controller is running Windows 2008 server, Windows 2008 R2 server, Windows 2012 server, or Windows 2012 R2
server. Note that Identity Mapping is not supported for the Windows 2003 server and earlier editions. Note that
Identity Mapping is not supported on the TE-810, TE-820, IB-VM-810 and IB-VM-820 appliances.
Each network user being mapped can use different devices to access the Windows environment. So using the identity
mapping feature and synchronizing all Microsoft servers on the Infoblox appliance provide visibility of user
interaction with their environments. By enabling this feature, you can monitor Active Directory domain users, the IP
addresses they log on to, the login status, and the time duration of their current status in the IPAM tab.
To view user information, you must first enable this feature at the Grid level. You can enable this feature even when
you have not installed an MS Management license on the appliance. However, you cannot configure DNS, DHCP, and
Active Directory sites synchronization unless you install an MS Management license on the appliance.
When you enable this feature, the appliance remotely communicates with all synchronized Microsoft servers (Domain
Controllers, an Exchange server, or a domain member) to pull event logs. The identity mapping information displayed
is as accurate as these event logs are available in the Microsoft authentication logs. Therefore, it is necessary to
assign Grid members to Microsoft servers to collect user information from Windows event logs. For information, see
Assigning Grid Members to Microsoft Servers on page 1259.

Note: The identity mapping information displayed on NIOS completely depends on live event logs that are available
on the Microsoft servers. The appliance pulls event logs incrementally. So subsequent requests pull only the
latest logs since the last successful synchronization. To avoid data loss, depending on the expected activities,
you must consider the size of the event log file on the Microsoft server and how often you want to synchronize
the data with the appliance before the event log file rolls over.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1275

Managing Microsoft Windows Servers

Prerequisites on the Microsoft Server

You must enable event logs on the Microsoft server for the Identity Mapping feature to function properly. To enable
event logging on Microsoft servers, refer to
https://technet.microsoft.com/en-us/library/dd941595%28v=ws.10%29.aspx.
The identity mapping information is collected successfully only when the Microsoft users belonging to a Domain User
group and Event Log Reader group start a RPC session and access MS-EVEN6. The synchronization process is
successful when they have this permission. The synchronization process fails unless appropriate permissions are
granted. The failed operations are logged in the Microsoft logs. The NIOS appliance tries to collect user information
again in the next synchronization.

Administrative Permissions
Only superusers can view identity mapping information. Limited-access admin groups can view identity mapping
information only if they have network permissions. For example, if the users have permissions to only DNS zones,
they may not be able to view identity mapping information because they do not have network permissions. The
appliance does not display a warning message if admins do not have correct permissions. For information about
network permissions, see Administrative Permissions for IPv4 and IPv6 Networks and Shared Networks on page 228.

About User Sessions

A user session is an abstract concept to specify a single user logging with a network address for a finite period of time.
A user session starts when a Kerberos account authentication event or login event is received and ends when a logout
is received, although such an event may never be received. In such cases, a session is considered to be timed out.
Network user associations are unique for a finite period of time. A single login involves a number of login and logout
events. In order to consolidate and improve system performance, Infoblox uses the concept of consolidation window.
If a login event or Kerberos service ticket is received within the consolidation window, then that session is considered
as an extension from the previous session. If a login event is received outside this window, it is considered as a new
session. The number of network users you see depends on the length of the consolidation window.
For example, consider the following sample events occurred on the Microsoft server when the consolidation window
is set to 10 minutes:
Kerberos Authentication Request: 10:00:00
Kerberos Service Ticket Request: 10:00:01
Account Logon: 10:00:02
Account Logoff: 10:00:03
Account Logon: 10:00:05
Account Logoff: 10:00:07
Account Logon: 10:00:10
Account Logoff: 10:00:11
The sample user session for the above events:

User Name IP Address First Seen Time (UTC) Last Seen Time (UTC)
John 10.10.10.10 10:00:00 AM (UTC) 10:00:11 AM (UTC)

If another login request is received at 10:30 AM (10 minutes after the last seen event), then it is considered as a
different session:

User Name IP Address First Seen Time (UTC) Last Seen Time (UTC)
John 10.10.10.10 10:00:00 AM (UTC) 10:00:11 AM (UTC)

1276 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring Identity Mapping

User Name IP Address First Seen Time (UTC) Last Seen Time (UTC)
John 10.10.10.10 10:30:00 AM (UTC)

If a Kerberos service ticket is received instead of a login event, then the previous session is extended and is updated
as Last Seen Time in the first user session.

User Name IP Address First Seen Time (UTC) Last Seen Time (UTC)
John 10.10.10.10 10:00:00 AM (UTC) 10:30:00 AM (UTC)

The appliance displays separate entries (counts) for the following scenarios:
• Multiple users logging in from the same IP address. For example, User 1 logged in with 10.10.10.10 address
counts as one network user and User 2 logged in with 10.10.10.10 address counts as another network user.
• Same user logging in from multiple IP addresses. For example, a single user can log in to multiple workstations,
each with a different IP address.
• Same user logging from the same IP address at a different time intervals.

Network User Count Displayed for Different Login Scenarios

If you are configuring multiple Domain Controllers belonging to different organizations, then you must configure them
in different network views. For example, if the same user logs in to multiple Domain Controllers with the same IP, it
creates multiple entries for each login. In this case, there is a chance of overwriting an entry by subsequent events.
If Domain Controllers are configured in different views, then separate entries are displayed for different network
views. You can configure multiple Domain Controllers within the same network view if they serve the same
organization, possibly using a load balancing method.

Note: The appliance displays user information only for the managed networks.

The following table illustrates how the appliance displays counts for different login scenarios:

Table 34.1 Network User Count Displayed for Different Login Scenarios

Login Scenarios Appliance Displaying User Mapping Information

Mobile user logging in to Note that you must first synchronize both the Domain Controller and Microsoft Exchange server
the Microsoft Exchange with the appliance to get user mapping information for this scenario. For this example, two entries
server are displayed.
1. User name and IP address of the Microsoft Exchange server on the Domain Controller.
2. User name and IP address of the mobile device on the Microsoft Exchange server.
Multiple users from the Appliance displays separate entry (user name and IP address) for each user.
same IP address

Same user from multiple IP Appliance displays separate entry (user name and IP address) for each user.
address

Login and Logout Timestamps

Note that all timestamps are displayed in the time zone of the admin account that you use to log in to the appliance.
There is a possibility of missing the login and logout events as described in the following cases:
• There is a chance of missing a login event when NIOS retrieves event logs from the Microsoft server after a user
logs in and the event log has already rolled over.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1277

Managing Microsoft Windows Servers

• There is a possibility of missing a logout or session end notifications when the user shuts down the workstation
or leaves the system. In such cases, the Microsoft event log does not specifically indicate a logout. The logout
events that are missed on the Domain Controller or Exchange server are missed on NIOS as well.
To maintain accuracy, the login timestamp is estimated as logout timestamp minus (-) the idle timeout. However,
when a login or Kerberos Authentication event is received, the login timestamp is updated to the value available in
the Kerberos authentication event or the login event.
To maintain accuracy of the logout time data, the appliance allows you to configure the length of idle time in the Grid
Properties Editor wizard. After this time interval, the status of the user changes to Timed Out. For information about
how to set timeout length, see Configuring Active User Timeout Session on page 616.

Note: The Timed Out and Logged Out user information is periodically removed from the database.

Viewing Active Directory User Information

To view Active Directory user information, you must first enable identity mapping feature at the Grid level. For
information about enabling Identity Mapping feature, seeEnabling Identity Mapping on page 615. After you enable
the identity mapping feature, you must synchronize the appliance with all Microsoft servers in order for the appliance
to gather user and device mapping information from the Microsoft servers. You can view Active Directory user
information in the Network Users tab. For more information, see Viewing Active Network Users on page 615.
To synchronize the appliance with Microsoft servers:
1. From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
2. Select the Microsoft Integration tab in the Grid Properties Editor wizard, and complete the following
— Synchronize Network Users with all MS servers: Select this check box to synchronize users with all
Microsoft servers that are managed by the Grid in order for the appliance to gather user and device
mapping information from the Microsoft server authentication logs. You can override this value at the
Microsoft server level.

Note: On an Infoblox appliance, the Enable Network Users Feature and Synchronize Network Users with all MS
servers options are disabled by default for all new installations.

3. Save the configuration.

Monitoring Managed Microsoft Servers

You can monitor the status of managed Microsoft servers from the Dashboard and from various panels in the Grid
tab. Grid Manager also maintains a log for each managed Microsoft server. You can monitor Microsoft servers and
their services as follows:
• You can view the Microsoft Servers Status widget on the Dashboard. For information, see Microsoft Servers
Status Widget on page 156.
• You can view the status of Microsoft servers. For information, see Viewing the Status of Servers on page 1278.
• You can view the logs of the Microsoft servers. For information, see Viewing Synchronization Logs on page
1281.

Viewing the Status of Servers

You can view details about the managed Microsoft servers by navigating to the Grid tab -> Microsoft Servers tab ->
Servers tab. For each Microsoft server, the panel displays the following by default:
• Name: The FQDN of the Microsoft server.
• Status: The connection status, which can be one of the following:

1278 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring Managed Microsoft Servers

— Running: The Grid member is connected to the Microsoft server.

— Connecting: The Grid member is connecting to the Microsoft server.
— Error: The Grid member failed to connect to the Microsoft server. Check the Microsoft log for any messages
to determine the reason for the failure.
— Unknown: The Microsoft server is disabled. The Grid member does not try to connect to disabled servers.
• IP Address: The IP address of the Microsoft server.
• DNS: The status of the DNS service on the Microsoft server. When you disable DNS synchronization, NIOS does
not display any status icon. The status icon can be one of the following:

Icon Color Meaning

Green The DNS service is functioning properly.

Red The Microsoft server is unavailable.

Yellow The DNS service is starting or stopping.

Gray The DNS service is stopped or management of the Microsoft DNS server is disabled.

• DHCP: The status of the DHCP service on the Microsoft server. When you disable DHCP synchronization, NIOS
does not display any status icon. The status icon can be one of the following:

Icon Color Meaning

Green The DHCP service is functioning properly.

Red The Microsoft server is unavailable.

Yellow The DHCP service is starting or stopping.

Gray The DHCP service is stopped or management of the Microsoft DHCP server is disabled.

• Comment: Displays any comments that were entered for the Microsoft server.
• Site: Displays any values that were entered for this pre-defined attribute.
You can add the following columns for display:
• Version: The Windows version of the managed server.
• Managing Member: The hostname of the Grid member that manages the server.
• Synchronization Status: Displays the synchronization status as follows:
— Running: The Microsoft server is synchronizing data with the Grid member.
— Connecting: The Grid member is trying to connect to the server.
— Error: Synchronization failed between the member and server. You can check the messages in the Microsoft
server log to determine the reason for the failure.
• Last Changed: Displays information about when the status was last updated for Microsoft DNS and DHCP
services. It corresponds to the last time information was exchanged with the server.
• AD Domain: Displays the AD domain of the Windows server. This is displayed only if the Windows server
belongs to an Active Directory domain.
• Root AD Domain: Displays the root AD domain of the Windows server. This is displayed only if the Windows
server belongs to an Active Directory domain.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1279

Managing Microsoft Windows Servers

You can also do the following:

• Add Microsoft servers.
— Click the Add icon.
• Edit the properties of a Microsoft server.
— Click the check box beside a server and click the Edit icon, or click the Action icon next to the respective
Microsoft server and select Edit from the menu. For information, see Setting Microsoft Server Properties on
page 1265.
• Delete a Microsoft server.
— Click the check box beside a server and click the Delete icon, or click the Action icon next to the
respective Microsoft server and select Delete from the menu. For information, see Removing a Managed
Microsoft Server on page 1266.
• Manage DNS and DHCP services of a Microsoft server.
— Click the check box beside a server and click the Manage Server Services icon, or click the Action icon
next to the respective Microsoft server and select Manage Server Services from the menu to view the
service status. You can mouse over the DNS and DHCP service icons and click the Start/Stop service icon to
start or stop a service, or click the Edit Service icon to edit the service properties. For information about
setting DHCP server properties, see Setting Microsoft DHCP Server Properties on page 1319. For
information about setting DNS server properties, see Specifying Forwarders for Microsoft Servers on page
1300.
• View detailed server status information, as described in Viewing Detailed Status Information on page 1280.
• Click Test MS Server to test the Microsoft server connection. The appliance validates the Microsoft server and
displays the test code and the test result data for services that you have enabled. To test the Microsoft server,
click the check box beside a server and click the Test Microsoft Server icon, or click the Action icon next to
the respective Microsoft server and select Test Microsoft Server from the menu. For more information, see
Assigning Grid Members to Microsoft Servers on page 1259.
• View extensible attributes associated with the Microsoft server.
Click the Action icon next to the respective Microsoft server and select Extensible Attributes from the menu.
For information, see Assigning Grid Members to Microsoft Servers on page 1259.
• Define permissions for Microsoft servers.
Click the Action icon next to the respective Microsoft server and select Permissions from the menu.
• Use filters and the Go To function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Sort the displayed data in ascending or descending order by column.
• Export the list of Microsoft servers to a .csv file.
— Click the Export icon.
• Print the list of Microsoft servers.
— Click the Print icon.

Viewing Detailed Status Information

You can view more status information by selecting a server from the Microsoft servers panel and clicking the Action
icon next to the respective Microsoft server and selecting Detailed Status from the menu or clicking the Detailed
Status icon. The Detailed Status panel displays the following information:
• Synchronization Status: The status icon indicates the synchronization status as follows:
— Green: The Microsoft server is synchronizing data with the Grid member.
— Red: Synchronization failed between the member and server. You can check the messages in the Microsoft
server log to determine the reason for the failure.
• DNS Service Status: For information about the status icons, see Viewing the Status of Servers on page 1278.

1280 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring Managed Microsoft Servers

• DNS Service Status Last Updated: The date and time of the last DNS service status update from the Microsoft
DNS server.
• DHCP Service Status: For information about the status icons, see Viewing the Status of Servers on page 1278.
• DHCP Service Status Last Updated: The date and time of the last DHCP service status update from the Microsoft
DHCP server.
• Active Directory Sync Status: The Active Directory Site is synchronizing data with the Grid member when the
status icon is green.
• Active Directory sync status last updated: The date and time of the last Active Directory Site update from the
Microsoft server.
Note the following guidelines about status information:
• Grid Manager does not display any status information if there is no synchronization between DHCP and DNS.
• If the appliance has not received any information when the services are enabled, then the Synchronization
Status icon is displayed in red, whereas the DNS and DHCP status icons are displayed in grey.

Viewing Synchronization Logs

Grid Manager maintains a synchronization log file for each Microsoft server managed by a Grid member. It logs events
related to the synchronization process, depending on the logging level that you configured in the Logging tab of the
Microsoft Server Properties editor described in Setting Microsoft Server Properties on page 1265.
The log files are rotated and compressed once they reach 40MB.
To view the log file of managed Microsoft server:
1. From the Administration tab, select the Logs tab -> Microsoft Logs tab.
2. If there is more than one managed server in the Grid, you can select the Microsoft server whose logs you want to
view.
3. The log file contains information related to the synchronization of the Microsoft DNS and DHCP data, as follows:
• Timestamp: The date and time of the log message. The time zone is the time zone configured in the User Profile.
• Source: Identifies the event that generated the message, such as a server synchronization or zone
synchronization.
• Level: Indicates the severity of the message, which can be one of the following:
— Debug: Provides information about all events associated with synchronization.
— Information: The Grid member is synchronizing with the Microsoft server and these messages provide
normal status information.
— Warning: The Grid member synchronized the data, but there was an issue, which is detailed in the Message
section.
If the Grid member encounters an error during the synchronization, it skips the object with the error, logs
the error in the Microsoft log, and continues to synchronize the rest of the data. The Grid member logs the
error at each synchronization until you resolve the issue and it can synchronize the object successfully.
— Error: The Grid member failed to synchronize an object, such as a DNS zone or DHCP scope, due to the error
described in the Message section.
• Object Type: The type of object that corresponds to the entry, such as FQDN or ADDRESS.
• Object Name: The name of the object that corresponds to the entry.
• Message: Detailed information about the event.
You can also do the following in the log viewer:
• Toggle between the single line view and the multi-line view.
• Navigate to the next or last page of the file using the paging buttons.
• Refresh the view.
• Click the Follow icon to have the appliance automatically refresh the log every five seconds.
• Download the log.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1281

Managing Microsoft Windows Servers

• Clear the contents of the log.

• Sort the data in ascending or descending order by column.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Export or print the content of the log.

1282 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 35 Managing Microsoft DNS
Services
This chapter provides guidelines for using Grid Manager to manage Microsoft DNS servers and for synchronizing DNS
data between Microsoft servers and the Grid. It discusses some features of the Microsoft DNS servers only as they
relate to the synchronization of data. Please review the Microsoft documentation for complete information about
Microsoft DNS servers and their features.
In addition, if you encounter technical issues with your Microsoft DNS servers, contact Microsoft Technical Support
or consult the Microsoft Support site at http://support.microsoft.com/. Some Windows versions require certain
updates and hotfixes installed, so the Microsoft server can synchronize with the Grid member. For information about
these requirements, see Requirements on page 1254.
The topics in this chapter include:
• Managing Microsoft DNS Servers on page 1284
— Synchronizing DNS Data on page 1284
— Enabling and Disabling DNS Zone Synchronization on page 1285
— Synchronizing with Multiple Servers on page 1287
• Managing Synchronized DNS Data on page 1287
— Adding Zones to Microsoft Servers on page 1288
— Setting Zone Properties on page 1288
— Deleting and Restoring Synchronized Zones on page 1290
— Managing Resource Records in Synchronized Zones on page 1290
• Synchronizing Updates on page 1292
— Synchronizing Delegations on page 1295
— Synchronizing AD-Integrated Zones on page 1297
— Resolving Conflicts on page 1299
• Viewing Members and Managed Servers on page 1299
• Specifying Forwarders for Microsoft Servers on page 1300
• Disabling and Removing Microsoft DNS Servers on page 1300

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1283

Managing Microsoft DNS Services

Managing Microsoft DNS Servers

After you configure a Grid member to manage a Microsoft DNS server, the Grid member connects to the Microsoft
server and starts synchronizing DNS data from the Microsoft server to its database. First, it synchronizes the Microsoft
server properties and its list of zones. Then it synchronizes each zone individually, including its properties and
resource records.
The synchronization time varies, depending on different factors, such as the number of managed Microsoft servers
and the amount of data being synchronized. The synchronized data is then replicated to the Grid Master through the
Grid replication process.
If the server is managed in read/write mode, admins can update the synchronized DNS data, control the DNS service
of the server, and specify forwarders for it as well.

Synchronizing DNS Data

Managing members synchronize the properties and resource records for the following types of DNS zones:
• Authoritative forward-mapping zones
• IPv4 and IPv6 reverse-mapping zones
• Stub zones
• Delegations
• Active Directory-integrated zones
Grid members synchronize most of the resource records supported by Microsoft servers, except for WINS, WINSR, and
ATMA records. They synchronize all the resource records supported by Infoblox DNS servers, as well as unsupported
records, such as ISDN and X25 records. You can view the unsupported records in Grid Manager and delete them, but
you cannot edit them. Note that Grid Manager and Microsoft DNS servers display some resource records, such as SIG
records, in a different format. You can enable and disable zone synchronization for individual Microsoft DNS zones.
For information, see Enabling and Disabling DNS Zone Synchronization on page 1285.
Grid members do not synchronize the following DNS zones supported by Microsoft servers:

Infoblox Terminology Microsoft Terminology

Forwarding zones Conditional forwarders
Cached zones Stub zones
Root zone Root zone (Dot zone)
0.in-addr.arpa 0.in-addr.arpa (0.0.0.0)
127.in-addr.arpa 127.in-addr.arpa (127.0.0.1 - loopback)
255.in-addr.arpa 255.in-addr.arpa (255.255.255.255 - broadcast)
TrustAnchors Trust Anchors

You cannot use Grid Manager to create the unsupported zones and assign them to a Microsoft server. Any zone on
the Grid that has the same name as a forwarding, cached or root zone on the Microsoft server is not synchronized. In
addition, Grid members do not synchronize the contents of a zone if the Microsoft server is a secondary server.
Subdomains defined within a Microsoft DNS zone are not synchronized unless they contain at least one resource
record. For example, in the corp100.com zone, any resource record defined in a subdomain of the corp100.com zone
is synchronized. If the subdomain sub.corp100.com zone has no resource record, it is not synchronized.
The following zones and resource records are supported on Microsoft servers running Windows Server 2008 only.
Therefore, Grid members can only synchronize these DNS zones and resource records with Microsoft servers running
Windows Server 2008.

1284 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Microsoft DNS Servers

• IPv6 reverse-mapping zones

• Global Names zones
• DNAME records
• NAPTR records
• DNSSEC records

Enabling and Disabling DNS Zone Synchronization

You can enable and disable synchronization for a DNS zone that is assigned to a Microsoft server. Zone
synchronization setting is valid for the selected zone in the DNS view for which it is defined. When you disable the
synchronization for a DNS zone, the NIOS appliance stops synchronizing data with the zone but it does not disable
the zone. In addition, the zone synchronization setting takes effect regardless of the role of the zone (primary,
secondary, or stub), synchronization mode, and permission (read-only or read-write).
Users who have permissions to edit zone properties can enable or disable zone synchronization. Note that you can
enable and disable zone synchronization for Microsoft zones only and when you add Microsoft primary or secondary
servers.
To configure Microsoft zone synchronization:
1. From the Data Management tab, select the DNS tab -> Zones tab -> zone check box, and then click the Edit icon.
2. In the Authoritative Zone editor, click Name Servers.
3. Select Use this set of name servers, and enter the details as specified in Assigning Zone Authority to Name
Servers on page 839.
— Disable Zone Synchronization: Select this to disable zone synchronization for the selected zone. Zone
synchronization is enabled when you clear the check box.
4. Save the configuration.

Enabling and Disabling DNS Zone Synchronization for Multiple Zones

You can enable or disable Microsoft zone synchronization for multiple zones:
1. From the Data Management tab, select the DNS tab -> Zones tab, and select the zone check boxes. You can either
select a single zone or multiple zones.
2. Expand the Toolbar and click the arrow beside MS Zone Synchronize to select an option.
— Enable: Click Enable to enable zone synchronization for the selected zones. Click Yes in the Enable MS Zone
Synchronization dialog box to enable synchronization or click No to cancel the process.
— Disable: Click Disable to disable zone synchronization for the selected zones. Click Yes in the Disable MS
Zone Synchronization dialog box to disable synchronization or click No to cancel the process.

Considerations about Zone Synchronization

Before you enable and disable zone synchronization for a Microsoft DNS zone, consider the following:
• Zone synchronization is enabled by default.
• A zone must be synchronized at least once before you can disable synchronization.
• Zones defined on a Microsoft DNS server are listed in the NIOS appliance, regardless of whether they are
synchronized or not.
• When you delete a zone on the Microsoft server, it is automatically deleted from NIOS, irrespective of its
synchronization setting.
• When you create a zone on the NIOS appliance and disable zone synchronization, the zone is not created on the
Microsoft server until you enable zone synchronization.
• When you disable zone synchronization, you can perform operations for which you have access rights on the
NIOS appliance. This includes changes made directly to the zone or as a result of changes made in another
zone. Examples: delegation creations and editing name servers.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1285

Managing Microsoft DNS Services

• When you disable synchronization for a zone and perform certain operations on the respective zone, the
outcomes of those operations are not replicated on any Microsoft servers assigned to the zone. For Microsoft
primary servers, any resource records or zone properties (including name servers) that you create, modify, or
delete on the NIOS appliance are not copied to the Microsoft server. For Microsoft secondary servers and stub
servers, any zone properties (including name servers and masters) that you create, modify, or delete on the
NIOS appliance are not copied to the Microsoft server.
• When you disable synchronization for a zone, the zone retains the Microsoft server that was last selected as the
master before synchronization was disabled. The master retains its role when you enable synchronization
again.
• When you disable synchronization, NIOS completes the ongoing process. The synchronization effectively stops
at the end of the synchronization. NIOS resumes the synchronization of the zone as soon as the member
assigned to the master MS server is notified through Grid replication that the zone is no longer disabled for
synchronization and the zone is overdue for synchronization. This is based on the last time the zone was
successfully synchronized and the synchronization interval at the time of re-enabling the synchronization.
• Note that the zones that are disabled for synchronization are not accounted in the overall synchronization
status.
• NIOS retains the zone synchronization disable setting when you enable or disable the DNS synchronization
setting of any MS server that is assigned to the zone.

IDN Support for Synchronized DNS Data

Infoblox Grid supports IDNs for synchronized DNS data between the appliance and Microsoft servers. For more
information about IDNs, see Support for Internationalized Domain Names on page 113.
The appliance stores IDNs in punycode and Microsoft server stores IDNs in \xyz format. Due to this difference at the
DNS protocol level, IDNs are not allowed in a zone name when you configure NIOS (primary or secondary) and
Microsoft (primary or secondary) servers. For information, see IDN Support Limitations for Synchronized Data on
page 1287. If synchronized data between NIOS and Microsoft servers contain IDNs, the IDNs are preserved on the
primary server. When a Microsoft server is the secondary server for a zone, MMC (Microsoft Management Console)
displays the zone content that contains IDNs in punycode only. Make sure that you use a zone name that complies
with the DNS protocol when manually configuring an authoritative zone.
A Microsoft server serves a resource record that contains an IDN in \xyz format when it is configured as the primary
server and NIOS as the secondary server. For example, use the \xyz\xyz\xyz.com representation on NIOS for 网
络 .com, a zone added on the Microsoft server.
You can add resource records that contain IDNs for the following configurations:
• NIOS is the primary server and Microsoft server is the secondary server: You can add records in IDNs or
punycode. The appliance preserves IDNs and does not encode punycode to IDNs. Note that you cannot add a
resource record that contains an IDN on the Microsoft server when it is configured as the secondary server.
• Microsoft server is the primary server and NIOS is the secondary server: You can add records on both NIOS and
Microsoft servers. You can use IDNs or punycode. You can add IDN records on both servers in this scenario.
The following table summarizes how the servers display resource records that contain IDNs after synchronization:

Microsoft server
Primary Server Input Secondary Input NIOS displays displays records
Server records in...
in...
NIOS Punycode Microsoft NA Punycode Punycode
NIOS IDN Microsoft NA IDN Punycode
Microsoft Punycode NIOS Punycode Punycode Punycode
Microsoft IDN NIOS IDN IDN IDN

1286 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Synchronized DNS Data

IDN Support Limitations for Synchronized Data

You cannot configure an authoritative zone and stub zone that contains IDNs for the following configurations:
• When NIOS is the primary server and Microsoft server is the secondary server.
• When Microsoft server is the primary server and NIOS is the secondary server.

Synchronizing with Multiple Servers

Because a Grid member can manage multiple Microsoft servers, it could potentially manage multiple servers
assigned to the same zone. For example, a Grid member could manage a Microsoft server that is the primary server
of a zone and one or more Microsoft servers that are secondary servers of the same zone. It could also manage
multiple Microsoft servers that are secondary servers for the same zone.
If a Grid member manages the primary server and at least one secondary server of a zone, the Grid member always
synchronizes DNS data with the primary server only. It never synchronizes data with the secondary server, even if the
primary server fails.
If a Grid member manages several Microsoft servers that are secondary servers of the same zone, it synchronizes DNS
data as follows:
• If each Microsoft server is assigned to a different DNS view, the Grid member synchronizes data with each one.
• If the Microsoft servers are synchronized to the same DNS view, the Grid member selects a principal server for
synchronization purposes, as follows:
— The first Microsoft server that is assigned as the DNS secondary server is designated principal server.
— If the secondary servers are managed in read-only and read/write modes, the Grid member always selects a
server that is managed in read/write mode.
— If a Microsoft server fails three successive synchronizations, it loses its principal server status. The Grid
Master checks the date that each server last became a principal server and selects the server that has not
been the designated principal server the longest.
Note that a Grid member could fail to synchronize with a Microsoft server due to errors, such as a disabled
account or an expired password. In these situations, the failure count is reset and is not increased. This
prevents the Microsoft server from losing its master status to another Microsoft server that could
experience the same errors.
When a zone is served by multiple Microsoft servers, the MS Sync Server column of the Zones tab shows which
Microsoft server is actually performing the synchronization of that zone with the Grid.

Managing Synchronized DNS Data

When Grid members are configured to manage Microsoft servers in read/write mode, you can use Grid Manager to
view, edit and delete the DNS data of those servers. You can add new zones and assign them to a Microsoft server.
You can modify the properties of zones synchronized from the Microsoft server and edit their resource records as well.
All updates are synchronized to the Microsoft servers at regular intervals.
The following sections provide guidelines for managing the zones and resource records served by Microsoft servers:
• Adding Zones to Microsoft Servers on page 1288
• Setting Zone Properties on page 1288
• Deleting and Restoring Synchronized Zones on page 1290
• Managing Resource Records in Synchronized Zones on page 1290
Synchronized zones also support the following features:
• You can import data to zones synchronized with Microsoft servers. Note that the import fails if you try to import
unsupported records to a Microsoft zone. For information about importing records, see Importing Zone Data on
page 849.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1287

Managing Microsoft DNS Services

• You can copy records to and from zones synchronized with Microsoft servers. When copying records to a
Microsoft zone, you can copy only those records that are supported by Microsoft servers. For information about
copying records, see Defining a Match Destinations List on page 817.

Adding Zones to Microsoft Servers

From Grid Manager, you can create zones and assign Microsoft servers as their primary or secondary servers. The
managing Grid member then synchronize these zones to the appropriate Microsoft servers.
From Grid Manager, you can add the following types of zones to Microsoft servers:
• Authoritative forward- and reverse-mapping zones—For information, see Configuring Authoritative Zones on
page 829.
• Forward- and reverse-mapping stub zones—For information, see Configuring Stub Zones on page 864.
• Delegations—For information, see Configuring a Delegation on page 857.
Note that you cannot add a zone on a Microsoft server and configure it to be served by an Infoblox Grid member. For
example, on the Microsoft server, you cannot add a zone and assign a Grid member as its primary server and the
Microsoft server as the secondary server. You must add such a zone from Grid Manager.
Following are guidelines for adding zones to a Microsoft server:
• The primary or secondary server of the zone must be a Microsoft server.
• If the primary server is a domain controller, you can enable the option to store the zone in Active Directory,
making it an AD-integrated zone. Note that you can enable Active Directory integration only after the Microsoft
server has been synchronized at least once because its AD ability is not known before the synchronization.
• You do not have to assign a Grid member as the primary or a secondary server of the zone. For example, a zone
can have a Microsoft server as its primary server and an external secondary server.
• The zone must be in the same DNS view to which the DNS data of the Microsoft server was synchronized. You
cannot add a zone served by the Microsoft server to a different DNS view.
• The zone does not inherit the properties from the Grid or from the DNS view. It uses the Infoblox-defined
defaults. You can change the property values, as described in Setting Zone Properties on page 1288.
• You can set certain zone properties that are not supported and synchronized to the Microsoft server. For
example, you can define extensible attributes and administrative permissions. When you set these properties,
they apply to the zones only when they are managed from Grid Manager.
• Infoblox does not support all the zone properties of a Microsoft DNS server. When a Grid member synchronizes
zones that were created on Grid Manager to the Microsoft server, the zones contain default values for all
unsupported properties.
• If you set the Disable option, the zone status is set to “Paused” on the Microsoft server. A zone in a “Paused”
status is not served to DNS clients, nor is it available for zone updates.
• Setting the Disable option does not stop synchronization. Grid members synchronize disabled zones.
• The member learns the Windows version of the Microsoft server after its first successful synchronization.
Certain zones and resource records are dependent on a specific Windows version. You cannot assign these
zones to Microsoft servers whose versions are unknown or insufficient.
• If the member is a secondary server for a zone with a Microsoft primary server, the member obtains the zone
data through DNS zone transfers from the Microsoft primary server; not through synchronizations. This ensures
that the zone data is always current on the Infoblox secondary server, as it does not have to wait for
synchronizations to update its data.

Setting Zone Properties

When the primary server of a zone is a Microsoft server, it does not inherit its properties from the Grid. Zones that are
synchronized from a Microsoft server retain their original properties. Zones that Grid Manager admins create assume
the Infoblox-defined default values.
To modify the properties of a synchronized zone:

1288 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Synchronized DNS Data

1. From the Data Management tab, select the DNS tab -> Zones tab -> DNS_view -> zone check box and click the Edit
icon.
2. In the Authoritative Zone editor, you can do the following in each tab:
— General: You can add or edit comments, and set the Disable and Lock options. Setting the Disable option
sets the status of the zone to “Paused” on the Microsoft server. Grid members synchronize disabled zones
to Microsoft servers.
— Name Servers: You can modify the name servers assigned to the zone. For information, see Assigning Zone
Authority to Name Servers on page 839.
— Settings: If the zone was synchronized from a Microsoft server, this tab displays the original settings from
the Microsoft server. If the zone was created using Grid Manager, then it inherits the TTL values from the
Grid. Note that these values might be different from those on the Microsoft server. To change any of these
values, see Configuring DNS Service Properties on page 753.
— Zone Transfers: In this tab, you specify the servers to which zone transfers are allowed. For information
about zone transfers, see Enabling Zone Transfers on page 788. Set the following parameters, depending
on whether the primary or secondary servers of the zone are Infoblox or Microsoft DNS servers:
— If the primary server is an Infoblox, Microsoft or external primary and the secondary servers are both
Infoblox and Microsoft DNS servers, this tab displays two separate tables where you can specify zone
transfer settings for the Infoblox DNS servers and the Microsoft DNS servers.
Zone Transfer Settings for Infoblox Members: Specify the settings as described in Configuring Zone
Transfers on page 789.
Zone Transfer Settings for Microsoft Servers: Note that you cannot use a named ACL for access control
though you can use individual ACEs. For information about named ACLs and access control, see
Configuring Access Control on page 398. You can set access control for zone transfers for Microsoft
servers to one of the following:
• None: Does not allow zone transfers to any name server.
• Any: Allows zone transfers to any IP address.
• Any Name Server: Allows zone transfers to any name server in the Name Servers table.
• Address: Allows zone transfers to the IP address that you specify.
— If both the primary and secondary servers are Microsoft servers, the dialog box displays the Zone
Transfer Settings for Microsoft Servers table only.
— If no Microsoft servers are primary or secondary servers, then the dialog box displays the Zone Transfer
Settings for Infoblox Members table only.
— Updates: In this tab, you specify whether the zone can accept dynamic DNS updates. For information about
dynamic DNS updates, see Chapter 21, Configuring DDNS Updates, on page 909. If the primary server is a
Microsoft server, regardless of the secondary servers, the Updates tab displays the following:
— Dynamic Updates: Select one of the following:
None: The zone does not accept dynamic updates.
Secure Only: This appears only if the zone is AD-integrated. The zone accepts GSS-TSIG-signed updates
only.
Nonsecure and Secure: The zone accepts both nonsecure and GSS-TSIG-signed updates.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1289

Managing Microsoft DNS Services

— Active Directory:
— Automatically create underscore zones: This option allows the appliance to create the following
subzones that the DNS server must have to answer AD-related DNS queries:
_msdcs.zone
_sites.zone
_tcp.zone
_udp.zone
domaindnszones.zone
forestdnszones.zone
Note that these zones are automatically generated. You cannot edit these zones or import data into them.
They cannot be modified, thus providing protection against forged updates.
• Extensible Attributes: Extensible attributes apply to the zones only when they are managed from Grid Manager.
For information, see Using Extensible Attributes on page 427.
• Permissions: These permissions apply to Infoblox Grid Manager administrators only. For information, see About
Administrative Permissions on page 195.

Deleting and Restoring Synchronized Zones

When you delete a synchronized zone from the Grid, Grid Manager moves the zone and its resource records to the
Recycle Bin. It deletes the zone and its resource records from the Microsoft server at the next synchronization.
Note that if you delete a zone on Grid Manager and plan to add it back to the database with different properties or
resource records, ensure that you wait until after the deletion is synchronized to the Microsoft server to add the new
zone. Otherwise, if you delete a zone and add a new zone with the same name within a synchronization interval, Grid
Manager will synchronize the zone properties and resource records from the Microsoft server to the newly added zone
on Grid Manager.
If a zone has subzones, you can choose to remove them and their resource records or “reparent” them to the parent
zone of the one you are removing. For information, see Removing Zones on page 852.
If you restore deleted zones from the Recycle Bin, the Grid member restores it on the Microsoft server as well. For
information, see Restoring Zone Data on page 854.

Managing Resource Records in Synchronized Zones

From Grid Manager, you can add and edit resource records in zones served by Microsoft servers. For information
about adding and managing resource records, see Managing Resource Records on page 880. You can also use IP Map
and the IP List to track A, AAAA and PTR records that are synchronized from Microsoft servers. For information, see
Chapter 13, IP Address Management, on page 575.
Microsoft DNS servers support all the resource records supported by Infoblox DNS servers, except for hosts, bulk
hosts and shared record groups. You cannot add these records to zones served by Microsoft servers or assign zones
with these records to Microsoft servers.
Following are guidelines for adding and managing resource records in synchronized zones:
• Infoblox DNS servers support defining a naming policy for the hostnames of A, AAAA, MX, and NS records based
on user-defined or default patterns. For information, see Specifying Hostname Policies on page 795. The
hostname policy applies only when records are created from Grid Manager. Resource records that originate from
the Microsoft server are synchronized to the Grid member even if they do not comply with the hostname policy
of the Grid member. The policy is enforced only if you edit the resource record from Grid manager.
• When you create an A or AAAA resource record on the NIOS appliance with the option to automatically create the
corresponding PTR record, Grid Manager uses the deepest reverse zone that can hold the record. For example, a
Grid has the following reverse zones: 10.in-addr.arpa, 0.10.in-addr.arpa, and 0.0.10.in-addr.arpa. When you
create the A record www A with the IP address 10.0.0.1, Grid Manager creates a PTR record in the zone
0.0.10.in-addr.arpa. If the deepest zone does not allow the creation of the PTR record, Grid Manager creates the
A record, but not the PTR record, and displays a warning.

1290 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Synchronized DNS Data

Note: If the Enable PTR record removal for A/AAAA records option is selected and if you try to delete the A or
AAAA records in zones served by Microsoft servers, the appliance displays the Delete Confirmation (A or
AAAA Record) dialog box to confirm whether you want to remove the corresponding PTR record that was
automatically generated while creating the A or AAAA record. In the Delete Confirmation dialog box, select
the Remove associated PTR resource record(s) check box and click Yes to delete the associated PTR record
or click No to cancel. For information about enabling this option, see Deleting PTR Records associated with
A or AAAA Records on page 762.

• You can add and edit DNAME records in a DNS zone assigned to a Microsoft server running Windows 2008 or
Windows Server 2012. You cannot add or edit DNAME records in zones assigned to Microsoft servers running
earlier Windows versions.
• You can disable synchronized resource records from Grid Manager. When you disable a resource record, it is
removed from the Microsoft server at the next synchronization.
• If you add a resource record with invalid data from Grid Manager, such as a DNAME record with an alias name
that has special characters, the invalid resource record is not synchronized to the Microsoft server and is
eventually deleted from the Grid. The error is logged in the Microsoft log.
• If the zone of the resource record was created using Grid Manager, then it and all its resource records inherit
their TTL values from the Grid. Note that these values might be different from those on the Microsoft server. You
can change these values to match those on the Microsoft server. For information on changing these values, see
Configuring DNS Service Properties on page 753.
• Grid Manager and Microsoft DNS servers display TXT records differently.
On Grid Manager, you enter the text string of TXT records as defined in RFC 1035. You can enter the following:
— A contiguous set of characters without spaces. If you enclose the characters in double quotes, Grid
Manager displays the character string without the double quotes. For example, if you enter "abcdef", Grid
Manager displays abcdef.
— A string that contains any character, including spaces, enclosed in quotes.
— If the string contains a quote ("), you must precede it with a backslash.
— If you enter a text string with multiple spaces between each word and the string is not enclosed in
double quotes, Grid Manager displays the text string with a single space between each word. For
example, if you enter text string, the GUI displays text string. To preserve multiple spaces, enclose the
string in double quotes.
Unlike on Microsoft DNS servers, you cannot enter a text string on multiple lines in Grid Manager. However, each
contiguous set of characters or quoted string entered on Grid Manager is equivalent to a separate line entered
on a Microsoft DNS server.
On a Microsoft DNS server, you can enter text without quotes and with each line on a separate line. Microsoft
DNS servers then display the text in a brief format where the lines are separated by a comma and a space.
For example, if you enter the following in the Text field of the TXT Record wizard or editor on Grid Manager:
"this is a line""with another line""and a third one"
It is served by the Microsoft and Infoblox DNS servers as:
"this is a line""with another line""and a third one"
But it is displayed in the Microsoft DNS server as:
this is a line, with another line, and a third one

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1291

Managing Microsoft DNS Services

Synchronizing Updates
A Grid member synchronizes DNS data with each managed Microsoft server at regular intervals. Grid Manager admins
with the applicable permissions can then update the synchronized DNS zones and resource records. During each
synchronization, updates from Grid Manager are applied to the Microsoft server and updates from the Microsoft
server are applied to the Grid as well. Note that the resource records are synchronized only if there is a change to the
SOA record on either the Microsoft server or the Grid.
The following examples illustrate how Grid members synchronize DNS data:
• If a Microsoft server admin adds the finance.corp100.com zone, it is also added to the Grid after a
synchronization.
• If a Grid Manager admin changes the A record of admin.corp100.com from 10.2.1.5 to 10.2.1.6, the IP address
of its corresponding A record on the Microsoft server is updated to 10.2.1.6.
• If a Grid Manager admin deletes a DNS zone that is assigned to a Microsoft server, the corresponding zone on
the Microsoft server is deleted as well in the next synchronization.
Because admins can update DNS data from the Microsoft server and from Grid Manager, conflicts can occur during
synchronization. In addition, Microsoft servers and Infoblox DNS servers have some differences in the features they
support and the way they handle certain zones and resource records.
The following guidelines describe how the Grid member resolves conflicts and handles any differences when DNS
data is synchronized between a Microsoft server and the Grid.
• On Microsoft servers, users can enter FQDNs and labels using a mix of upper and lower case characters. The
servers preserve the original case when they store the data. When the Grid member synchronizes data with the
Microsoft server, it displays the data in lower case in Grid Manager and the Infoblox API. The case of the data is
preserved as long as no change is made to the DNS zone or resource record. If a Grid Manager admin modifies a
DNS zone or resource record, the next synchronization converts the object name to lower case on the Microsoft
server.
• If a Microsoft server admin modifies an object that has a pending scheduled task and synchronization occurs
before the scheduled task, the object is modified in both the Microsoft server and the Grid member. When the
scheduled task executes at its scheduled time, it fails and an error message is logged in the audit log.
• A situation could arise where two Microsoft servers in different domains are primary servers for zones with the
same name. For example, two reverse-mapping zones could be named 1.1.10.in-addr-arpa in two Microsoft
servers managed by the same member. If the two Microsoft servers are synchronized to different DNS views, the
Grid member synchronizes each one separately. If the Microsoft servers are synchronized to the same DNS view,
then the Grid member synchronizes the zone with the first Microsoft server. During the synchronization with the
second Microsoft server, the Grid member logs an error and does not synchronize the zone.
• The Grid member does not synchronize the naming policy configured on Microsoft servers. Zones and resource
records that fail the policy check on Microsoft servers are reported in the synchronization log file.
• When you remove a Microsoft server that is assigned to a zone, the succeeding synchronization removes the
zone from the Microsoft server.
• When a Microsoft server admin and a Grid Manager admin change the same object, the Grid member retains the
version that exists on the Microsoft server. Following are some examples:

Table 35.1

Grid Manager Admin... Microsoft Server Admin... After Synchronization

Deletes the corp100.com zone Updates the corp100.com zone The corp100.com zone is created on the
Grid with the updates and is assigned to
the Microsoft server .
Changes the zone transfer Deletes the sales.corp100.com The sales.corp100.com is deleted from the
settings of the sales.corp100.com zone. Grid as well.
zone.

1292 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Synchronizing Updates

• Changing the name or IP address of a resource record on the Microsoft server effectively deletes the original
resource record and creates a new record with the current information. During the synchronization, the Grid
member also deletes the original record, including its associated properties, such as its extensible attributes
and administrative permissions, and creates a new record.
For example, as shown in Figure 35.1, the A record for printer1.corp100.com is on both the Microsoft and
Infoblox Grid member. On the Grid, the A record has extensible attributes and a comment. A Microsoft server
admin changes the IP address of the A1 resource record from 10.1.1.2 to 10.1.1.3. On the Microsoft server, this
is equivalent to deleting the A1 resource record with the IP address 10.1.1.2 and then adding a new A1 resource
record with the IP address 10.1.1.3. When the data is synchronized, the Grid member deletes the original record
with its extensible attributes and comments and creates a new A record with IP address 10.1.1.3.

Figure 35.1

Microsoft Server Grid Member

printer1.corp100.com A 10.1.1.2
printer1.corp100.com A 10.1.1.2
Attributes: Lab 11, ID 111
Comment: Lab printer
printer1.corp100.com A 10.1.1.2

printer1.corp100.com A 10.1.1.3

printer1.corp100.com A 10.1.1.3 printer1.corp100.com A 10.1.1.3

printer1.corp100.com A 10.1.1.2
Attributes: Lab 11, ID 111
Comment: Lab printer

• If a Microsoft server admin changes the IP address of a resource record and a Grid Manager admin changes the
IP address of the same resource record, they are effectively deleting the record and each creating a new one.
For example, as shown in Figure 35.2, a Microsoft server admin changes the IP address of the A resource record
for printer1.corp100.com from 10.1.1.2 to 10.1.1.3, and a Grid Manager admin changes the IP address of the
same resource record to 10.1.1.4. When the data is synchronized, the Grid member deletes the A1 resource
record with IP address 10.1.1.2 and creates an A resource record with IP address 10.1.1.3 and another A1
resource record with IP address 10.1.1.4.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1293

Managing Microsoft DNS Services

Figure 35.2

Microsoft Server Grid Member

printer1.corp100.com A 10.1.1.2 printer1.corp100.com A 10.1.1.2

printer1.corp100.com A 10.1.1.2 printer1.corp100.com A 10.1.1.2

printer1.corp100.com A 10.1.1.3 printer1.corp100.com A 10.1.1.4

printer1.corp100.com A 10.1.1.3 printer1.corp100.com A 10.1.1.3

printer1.corp100.com A 10.1.1.4 printer1.corp100.com A 10.1.1.4

• The Microsoft server does not allow the creation of arpa subzones as forward-mapping zones, similarly, the
appliance restricts assigning arpa subzones (zone names ending with .arpa) to the Microsoft server.
• NIOS does not synchronize the top-level reverse-mapping zones (in-addr.arpa and ip6.arpa) created on the
Microsoft server and the top-level reverse-mapping zones (in-addr.arpa and ip6.arpa) created on the NIOS
appliance cannot be assigned to the Microsoft server.
• Grid members can synchronize classless IPv4 reverse-mapping zones from the Microsoft server to the Grid only
if the zone prefix is in one of the following formats: <subnet>/<subnet mask bit count> or <subnet>-<subnet mask
bit count> . For example, 128/26.2.0.192.in-addr.arpa. If the zone prefix is not in the specified format, the Grid
member skips the zone and logs an error message. For information, see
http://technet.microsoft.com/en-us/library/cc961414.aspx.
Likewise, Grid Manager admins can add a classless IPv4 reverse-mapping authoritative or stub zone to a
Microsoft server only if its prefix is in the specified format.For information about configuring classless IPv4
reverse-mapping zones in Grid Manager, see Specifying an RFC 2317 Prefix on page 830.
• Grid members synchronize DNS records that contain values that Infoblox does not support. Grid Manager
admins can view these records, but they cannot edit or restore such records. For example, if a member
synchronizes a NAPTR record that contains an unsupported value in the Service field, admins can view this
record but they cannot edit or restore it, as long as it contains an unsupported value.
• When a Grid member synchronizes a zone from a Microsoft server to the appliance and that zone contains
UTF-8 characters in the "Responsible Person" field, Grid Manager displays the “Responsible Person” value in
the RNAME field of the SOA record of the zone. Note though that you cannot edit the SOA record if the RNAME
field contains unsupported UTF-8 characters.
• Synchronizing a new zone from the Microsoft server to the Grid is a two-step process. First the zone name is
synchronized, and then its properties and records are synchronized. The zone synchronization from the
Microsoft server is not considered complete until both steps are done. NIOS drops any records that are created
on the appliance for the synchronized zone before it is completely synchronized.
For example, the corp100.com zone is created on a Microsoft server and then synchronized to the NIOS
appliance. If a NIOS admin creates a record, such as an A record, in the corp100.com zone before it is fully
synchronized, the record is removed from the corp100.com zone. Ensure that both the zone and its contents are
completely synchronized before you add a record to a zone on the NIOS appliance.
• When a Microsoft admin deletes a zone whose primary and secondary servers are Microsoft servers, the zone is
deleted from the Grid after a synchronization. If the secondary Microsoft servers are managed by the member in
Read-Write mode, the zone is removed from the secondary servers as well. But if some of the secondary
Microsoft servers are managed by the member in Read-Only mode, then at the next synchronization the zone is
recreated on the Grid with the Microsoft servers as the secondary servers and the masters defined for the zone
as external primary servers.

1294 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Synchronizing Updates

• If you add Grid members or other Microsoft servers as secondary servers to a zone on the Microsoft server, NIOS
does not automatically add them as Grid Secondary or Microsoft Secondary servers in the Name Servers tab of
the zone after the synchronization. Instead, NIOS creates NS records for them in the zone.

Synchronizing Delegations
When a parent zone delegates a subdomain to one or more name servers, Infoblox DNS servers require the
delegation name servers to also be authoritative for the subzone. Microsoft servers do not; they allow the delegation
servers of a subzone to be different from its authoritative servers. Infoblox DNS servers support this configuration
only if the primary server of the parent zone is a Microsoft server. This configuration is retained when delegations are
synchronized from Microsoft servers to the Grid.
For example, as shown in Figure 35.3, on a Microsoft server, corp100.com delegates sales.corp100.com to the name
server ns1.corp100.com; but the authoritative server of sales.corp100.com is 2k3r264-2.infoblox.com.

Figure 35.3 Delegation Server and Authoritative Server for corp100.com

The delegation server for

sales.corp100.com is different
from its authoritative server.

Figure 35.4 shows that after corp100.com and its subzone are synchronized to the Grid, corp100.com contains an NS
record for sales.corp100.com and an A record for the delegation name server ns1.corp100.com. The MS Delegation
Addresses column displays the IP address of the delegation server of the subzone sales.corp100.com.

Figure 35.4 corp100.com Synchronized to the Grid

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1295

Managing Microsoft DNS Services

After the synchronization, you can add name servers for the delegation as follows:
1. Select the zone by navigating to the Data Management tab -> DNS -> Zones -> parent_zone.
2. Click the Add icon and select Record -> NS Record.
3. Complete the following and click Next:
— Name Server: Enter the hostname you want to configure as the name server for the zone.
— Name: Specify the name of the subzone. Note that you cannot change this name when you edit the record.
4. Enter the IP address of the name server.
5. Save the configuration.
NIOS adds an NS record for the new delegation server and synchronizes this update to the Microsoft server. In
Figure 35.5, a new delegation server, ns2.corp100.com, was added.

Figure 35.5 NS Record for ns2.corp100.com

When you navigate to the Name Servers tab of sales.corp100.com to view the authoritative name servers for the
subzone, note that as shown in Figure 35.6, the table displays 2k8r264-2.infoblox.com as the authoritative server for
the subzone. The Parent Delegation column indicates if the FQDN and IP address of the authoritative name server for
the zone matches the FQDN and IP address in the delegation zone’s NS record. In the example, the authoritative
name server 2k8r264-2.infoblox.com is different from the delegation name servers (ns1.corp100.com and
ns2.corp100.com), so the column displays No.

Figure 35.6 Authoritative Name Server of sales.corp100.com

1296 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Synchronizing Updates

Note though that because Infoblox DNS servers require the delegation servers to also be authoritative for the
subzone, if you add another authoritative name server to the subzone from Grid Manager, NIOS also adds it as a
delegation server in the parent zone. For example, as shown in Figure 35.7, when an admin adds the name server
ns-100.corp100.com as an external secondary server for sales.corp100.com, NIOS automatically adds it as a
delegation server by adding an NS record for it in the parent zone.

Figure 35.7 Adding Another Authoritative Server from Grid Manager

Synchronizing AD-Integrated Zones

An AD-integrated zone can be served by multiple domain controllers, and a Grid member can manage more than one
of the domain controllers. If the domain controllers are configured to synchronize their DNS data to different DNS
views, the Grid member synchronizes DNS data with each domain controller. If the domain controllers are configured
to synchronize their DNS data to the same DNS view, the member selects a principal server for synchronization
purposes and synchronizes data with that principal server only. The selection of the principal server is logged, as well
as when it changes. The Grid member selects a principal server as follows:
• The first domain controller that is assigned as the primary server is designated principal server.
• If a domain controller fails three successive synchronizations, it loses its principal status. The Grid Master then
checks the date that each domain controller last became a principal server and selects the one that has not
been the designated principal the longest.
• If the domain controllers are managed in read-only and read/write modes, the Grid member always selects the
domain controller that is managed in read/write mode.
When a zone is served by multiple Microsoft servers, the MS Sync Server column of the Zones tab shows which
Microsoft server is actually performing the synchronization of that zone with the Grid.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1297

Managing Microsoft DNS Services

The Grid member periodically checks if each zone has one principal server. If it does not find a principal server for a
zone, the Grid member selects one among the name servers assigned to the zone. It gives priority to the server that
was not the designated principal server the longest.

1298 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Members and Managed Servers

Following are additional guidelines when synchronizing AD-integrated zones:

• You can create an AD-integrated zone on Grid Manager and assign one domain controller as its primary server. If
a domain controller admin adds more primary servers to the zone, they are added to the zone on Grid Manager
when the zone is synchronized. If you want to delete the primary servers, you must delete all the primary servers
at once. You cannot delete only a subset of the servers.
• A situation could arise where two domain controllers in different AD domains are primary servers for zones with
the same name. For example, two reverse-mapping zones could be named 1.1.10.in-addr-arpa in two domain
controllers managed by the same member. If the two domain controllers are synchronized to different DNS
views, the Grid member synchronizes each one separately. If the domain controllers are synchronized to the
same DNS view, then the Grid member synchronizes the zone with the first domain controller. During the
synchronization with the second domain controller, the Grid member logs an error and does not synchronize the
zone.
• If a Grid Manager admin deletes a CNAME record that has a blank canonical name from an AD-integrated zone,
this CNAME record is not deleted from the Microsoft server after the synchronization if the AD-integrated zone is
hosted on a Microsoft server running Windows 2008 R2 or Windows Server 2012.
• When a Microsoft server is the primary server of a zone that contains an _msdcs zone, it appends the parent
zone name to the server name in the NS record of the _msdcs zone. But when an Infoblox Grid member is the
primary server of a zone that contains an _msdcs zone, it specifies the server name only in the NS record. For
example, the _msdcs zone is in the corp100.com zone and the name server is nameserver100.com. When a
Microsoft server is the primary server of corp100.com, the server name on the NS record of the _msdcs zone is
nameserver100.com.corp100.com. When a Grid member is the primary server, the server name on the NS
record of the _msdcs zone is nameserver100.com.

Resolving Conflicts
Some conflicts require intervention from an admin. For example, a Grid member cannot synchronize a zone when its
primary server on the Microsoft server is different from its primary server on the Grid. When a Grid member is unable
to synchronize data due to such conflicts, it logs an error, skips the object with the error and continues synchronizing
the rest of the data. You can then view the Microsoft logs to check which objects were not synchronized. If you resolve
the problem, the Grid member synchronizes the object on its next attempt. For information about the logs, see
Viewing Synchronization Logs on page 1281.

Viewing Members and Managed Servers

You can view Infoblox and Microsoft DNS servers by navigating to the Data Management tab -> DNS tab, and then
selecting the Members/Servers tab. The panel displays the following information about each DNS server:
• Name: The hostname of the Grid member or Microsoft server.
• Status: The status of the DNS service on the Grid member or Microsoft server.
• Comment: Comments that were entered for the Grid member or Microsoft server.
• Site: Values that were entered for this pre-defined attribute.
• Address: The IP address of the Grid member or Microsoft server.
You can do the following:
• List the DNS views or zones served by the member or Microsoft server.
— Click a Grid member or Microsoft server name.
• Edit the properties of a Grid member or Microsoft server.
— Click the check box beside a Grid member or Microsoft server, and then click the Edit icon. To edit the DNS
properties of a Grid member, see Configuring DNS Service Properties on page 753. To edit the DNS
properties of a Microsoft server, see Specifying Forwarders for Microsoft Servers.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1299

Managing Microsoft DNS Services

• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Export the list of Grid members and Microsoft servers to a .csv file.
— Click the Export icon.
• Print the list of Grid members and Microsoft servers.
— Click the Print icon.

Specifying Forwarders for Microsoft Servers

A forwarder is a name server to which all other name servers first send queries that they cannot resolve locally. The
forwarder then sends these queries to DNS servers that are external to the network, avoiding the need for the other
name servers in your network to send queries off-site. You can define a list of forwarders for each managed Microsoft
server as follows:
1. From the Data Management tab, select the DNS tab -> Members/Servers tab -> ms_server check box -> Edit icon.
2. Click the Add icon and enter the IP address of the forwarder in the text field.
3. Save the configuration and click Restart if it appears at the top of the screen.

Disabling and Removing Microsoft DNS Servers

When you disable synchronization with a Microsoft server, the managing Grid member terminates any ongoing
synchronization and restarts it when the Microsoft server is re-enabled. The synchronized DNS data stays in the same
state until synchronization resumes. For information, see Disabling Synchronization on page 1266.
When you remove a managed Microsoft server from the Grid, the managing Grid member terminates any ongoing
synchronization and does not start a new one. Zones and their content on the Microsoft server remain in the state
that existed the moment the Microsoft server was removed. The Grid retains the zones that were assigned to the
Microsoft server that was removed, but deletes the Microsoft server from its assigned zones as follows:
• If the Microsoft server is the only primary server and there are no other assigned servers or if the secondary
server is an external secondary server, Grid Manager deletes all the server assignments.
• If the Microsoft server is the only primary server and there are Grid secondary servers, an external primary is
created with the FQDN and IP address of the removed Microsoft server.
• If the Microsoft server is a secondary server and there is a Grid primary, an external secondary is created with
the FQDN and IP address of the removed Microsoft server.
• If the Microsoft server is a server for a stub zone, the server is removed.
To remove a Microsoft DNS server:
1. From the Data Management tab, select the DNS tab -> Members/Servers tab -> ms_server check box.
2. Expand the Toolbar and click Delete.
3. Click Yes when the confirmation dialog box appears.

1300 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 36 Managing Microsoft DHCP
Services
This chapter provides guidelines for using Grid Manager to manage Microsoft DHCP servers and for synchronizing
DHCP data between Microsoft servers and the Grid. It discusses some features of the Microsoft DHCP servers only as
they relate to the synchronization of data. Please review the Microsoft documentation for complete information about
Microsoft DHCP servers and their features.
In addition, if you encounter technical issues with your Microsoft DHCP servers, contact Microsoft Technical Support
or consult the Microsoft Support site at http://support.microsoft.com/. Some Windows versions require certain
updates and hotfixes installed, so the Microsoft server can synchronize with the Grid member. For information about
these requirements, see Requirements on page 1254.
The topics in this chapter include:
• About Microsoft DHCP Management on page 1302
— Synchronizing DHCP Data from Microsoft Servers on page 1302
— Viewing Synchronized Leases on page 1304
• Synchronizing DHCP Failover Relationships on page 1304
— About Microsoft DHCP Failover Relationships on page 1305
— Admin Permissions for Managing Microsoft DHCP Failover Relationship on page 1305
— Admin Permissions for Managing Failover Relationships for DHCP Ranges on page 1306
• Synchronizing IP Addresses with Invalid MAC Addresses on page 1306
• Managing Synchronized DHCP Data on page 1307
— Adding and Managing Scopes on page 1307
— Adding Fixed Addresses/Microsoft Reservations on page 1313
— About Superscopes on page 1315
• Synchronizing Updates on page 1317
• Managing Microsoft DHCP Servers on page 1318
— Viewing Members and Managed DHCP Servers on page 1318
— Setting Microsoft DHCP Server Properties on page 1319
— Controlling the DHCP Service of a Microsoft Server on page 1320
— Disabling and Removing Microsoft DHCP Servers on page 1320
— Modifying DHCP Server Assignments on page 1320

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1301

Managing Microsoft DHCP Services

About Microsoft DHCP Management

Grid Manager enables you to centrally manage the DHCP data of multiple Microsoft DHCP servers from a single
interface. Once the DHCP data is synchronized, you can use the Dashboard on Grid Manager to monitor DHCP and
server operations, or organize DHCP data into Smart Folders. Through IPAM tools, such as network maps and IP maps,
you can track and manage IP address usage in your networks and monitor DHCP range utilization. You can also run a
network discovery to retrieve IP allocation for both managed and unmanaged devices—including virtualized
resources. For information about the IPAM features, see Chapter 13, IP Address Management, on page 575.

Figure 36.1 Managing Microsoft DHCP Servers from Grid Manager

Managing
IP Map Member 10.1.0.0/16

MS DHCP Server

Dashboard
10.2.0.0/16
MS DHCP Server
Admin Grid Master

10.3.0.0/16

MS DHCP Server

An admin logs into Grid Manager

and uses its tools, such as the Managing
Dashboard an IP Map, to manage Member 10.4.0.0/16
and monitor multiple DHCP servers
MS DHCP Server

Synchronizing DHCP Data from Microsoft Servers

After you configure a member to manage the DHCP service of a Microsoft server, the Grid member connects to the
server and starts synchronizing IPv4 DHCP data from the Microsoft server to the Grid database. It synchronizes the
Microsoft server properties, leases, scopes and reservations.
The synchronization time varies, depending on different factors, such as the number of managed Microsoft servers
and the amount of data being synchronized.

Note: Synchronizing IPv6 data is not supported.

As shown in Table 36.1, Microsoft servers and Infoblox DHCP servers represent DHCP data differently. Scopes on
Microsoft servers are DHCP ranges on Infoblox DHCP servers. Additionally, Microsoft servers support split-scopes,
which is a scope assigned to two Microsoft servers. Each scope has an exclusion range on opposite ends to specify
the pool of IP addresses that the other Microsoft server allocates. On an Infoblox DHCP server, each scope in the
split-scope is represented as a DHCP range with an exclusion range. Note that NIOS also synchronizes scopes
assigned to more than two Microsoft servers, but they are not synchronized as split-scopes.
Fixed addresses on Infoblox DHCP servers are the same as reservations on Microsoft servers. Infoblox reservations,
which are IP addresses that are excluded from DHCP, are not supported on Microsoft servers. Microsoft superscopes,
which are used to group scopes, are represented as superscopes and can be managed from Infoblox DHCP servers.

1302 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Microsoft DHCP Management

Table 36.1 DHCP Data in Microsoft and Infoblox DHCP Servers

DHCP Data Microsoft DHCP Servers Infoblox DHCP Servers

Address pool from which the server allocates Scope DHCP Address Range in a
addresses Network
An IP address that is always assigned to the Reservation Fixed Address
same device
An IP address that is excluded from DHCP Not supported Reservation
because a user intends to configure it
manually on a network device
Administrative group of scopes Superscope Microsoft superscope

Note: In this chapter, reservations always refer to Microsoft reservations (Infoblox fixed addresses), unless
otherwise specified.

When the member synchronizes a scope to the Grid, it converts the scope to a DHCP range and network. For example,
it converts the Microsoft scope 10.1.1.1- 10.1.1.200 with a netmask of /24 to the network 10.1.1.0/24 and DHCP
range 10.1.1.1- 10.1.1.200 on Grid Manager. The member associates the DHCP properties of the scope, including its
DHCP and Microsoft vendor options, with the DHCP range. It synchronizes the leases within the range and if
configured, the exclusion range as well.
NIOS synchronizes two scopes as split-scopes if the following conditions are met:
• Two scopes have the same address range.
• The scopes are assigned to two different Microsoft servers.
• Each scope has an exclusion range and the exclusion ranges are at opposite ends of the scope, so they
complement each other. For example, the scope 10.1.1.1-10.1.1.200 on Microsoft server A has an exclusion
range of 10.1.1.100-10.1.1.200 and the same scope on Microsoft server B has en exclusion range of
10.1.1.1-10.1.1.99.
When the appliance synchronizes a split-scope, it sets a split-scope flag on each scope to indicate that it is part of a
split-scope. For more information, see Viewing Scopes on page 1312. It synchronizes any reservations that are
configured in each scope as well.
When the member synchronizes a Microsoft reservation to the Grid, it converts the reservation to a fixed address and
static lease on Grid Manager. It associates the DHCP properties and DHCP and Microsoft vendor options of the
reservation with the fixed address record.
The Grid member synchronizes superscopes to the Grid as well. The Grid supports Microsoft superscopes, when an
MS management license is installed. For information about adding and managing superscopes in Infoblox DHCP
servers, see About Superscopes on page 1315.
Following are some guidelines on how a Grid member synchronizes DHCP data from Microsoft servers to the Grid:
• If two superscopes have the same name, but are served by different servers, the member creates two different
superscopes on the Grid, each appended with the Microsoft server FQDN.
• The member synchronizes all active and inactive scopes from a managed Microsoft server as long as the scopes
do not conflict or include any networks currently served by a Grid member. The member does not synchronize a
scope if its network already exists in the Grid and is served by a Grid member. It can synchronize a scope if its
network is included in an existing network, only if the network is not served by DHCP.
• Synchronizing scopes that are larger than /12 is not supported.
• NIOS synchronizes all scopes except for those with serving ranges that overlap the serving ranges of existing
DHCP ranges.
• If the appliance manages multiple Microsoft servers and synchronizes identical scopes from more than two
Microsoft servers, it does not flag the scopes as split-scopes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1303

Managing Microsoft DHCP Services

• If the appliance synchronizes one or more scopes from Microsoft servers that are identical to an existing
split-scope, it removes the split-scope flag from the existing split-scope.
• NIOS does not synchronize partially overlapping scopes inside a single network from different Microsoft
servers. It synchronizes only ranges that completely overlap.
• More than two scopes are not synchronized as split-scopes, even if they are identical and have exclusion ranges
that complement each other.
• Scopes that have more than one exclusion range are not synchronized as split-scopes, even if the exclusion
ranges complement each other. In addition, if a split-scope is synchronized from a Microsoft server and one of
the scopes is split again on the Microsoft server, NIOS synchronizes the third scope, but does not set a
split-scope flag. In addition, it removes the split-scope flag from the original split-scopes.
You can view the synchronized data as follows:
• To view the networks of the scopes, select the Data Management tab -> DHCP tab -> Networks tab -> Networks
panel. This panel displays all IPv4 networks. For information about this panel, see Modifying IPv4 Networks on
page 1118.
• To view the corresponding DHCP ranges and reservations, select the Data Management tab -> DHCP tab ->
Networks tab, and click a network link. For information about this panel, see Viewing Scopes on page 1312.
You can also use the features in the IPAM tab, such as the Net Map and IP Map, to view and manage the Microsoft
DHCP data. For information, see Chapter 13, IP Address Management, on page 575.

Viewing Synchronized Leases

A Grid member synchronizes all leases from its managed Microsoft server to the Grid. Microsoft servers automatically
generate a static lease for each reservation. These static leases are synchronized to the Grid as well. You can view the
synchronized leases by navigating to the Data Management -> DHCP -> Leases tab. For information about viewing
current leases, see Viewing Current Leases on page 1244. You can do the following:
• View lease details, by selecting a lease and clicking the Lease Details icon. For additional information, see
Viewing Detailed Lease Information on page 1246.
• Clear a lease, by selecting it and clicking the Clear Lease icon. Note that Grid Manager clears the lease
immediately. It does not wait for the next synchronization.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
Additionally, you can enable a Grid member to log lease related operations, so you can view these events in the Lease
History panel. For information, see Configuring the Lease Logging Member on page 1096 and Viewing Lease History
on page 1247.

Synchronizing DHCP Failover Relationships

The synchronization of DHCP data with Microsoft DHCP servers running Microsoft Windows version 2012 or later
includes the synchronization of DHCP failover relationships and the associated scopes. Note that this feature does
not have any impact on the synchronized data with Microsoft servers running a Windows version earlier than 2012.
When you change the synchronization mode of a Microsoft server, it affects the way a failover relationship is
synchronized and replicated, but you cannot change these settings directly. When a failover relationship
synchronization mode changes from read-only to read/write, NIOS copies the DHCP configuration within the
relationship between both partners, using the primary Microsoft server as the reference. When a failover relationship
synchronization mode changes from read/write to read-only, NIOS does not change the DHCP configuration within
the relationship on each Microsoft server.

1304 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Synchronizing DHCP Failover Relationships

About Microsoft DHCP Failover Relationships

A failover relationship represents the relationship between two Microsoft DHCP servers, where each of them is called
a partner. A failover relationship that has at least one Grid member as a partner is called a NIOS failover relationship
and if it has at least one Microsoft server as a partner, it is defined as a Microsoft failover relationship. A failover
relationship can be configured with two Microsoft servers, a Microsoft server and an external server, two Grid
members, a Grid member and an external server.
When you synchronize a failover relationship from a Microsoft server, the NIOS appliance copies the changes
originating from the Microsoft server to the failover relationship of the partner, only if the two Microsoft servers
match. Two failover relationships match if they have the same name, and if the address of the partner defined in one
Microsoft server matches with the address of the other, and vice versa. Also, you must configure Microsoft servers to
manage DHCP and enable synchronization on both the Microsoft servers.
The changes that originate from the Microsoft server are applied to the failover relationship on NIOS, and vice versa.
The changes are effective on the partner server from its next scheduled synchronization.
The failover relationship synchronization mode for Microsoft is read/write if both partners are each Microsoft servers
that are enabled for DHCP synchronization. For all other cases, the failover relationship synchronization is read only.
When NIOS fails to match a failover relationship, the partner of that relationship is considered to be unknown or
external. In the case of multiple servers, you must define the Microsoft server on the appliance using the same IP
and/or FQDN.
Infoblox recommends that you do the following for Microsoft servers in a failover relationship:
• The synchronization interval of two Microsoft servers in a failover relationship must be identical and small.
• Use the same managing member for Microsoft servers in a failover relationship.
• After a Microsoft server fails, you must turn off NIOS synchronization during restore to avoid transferring the old
configuration to its partners.
• The primary and secondary Microsoft servers that you select in a failover relationship must be in the same
network view. Note the following if the servers are on different network views:
— You cannot modify or delete failover associations.
— You cannot add, modify, or delete scopes that are associated with the failover association.
— The appliance does not display the FQDN, but displays the IP address and status as ‘unknown’ for the
secondary Microsoft server.
— The appliance may not display the scopes that are assigned to the failover association.
— The appliance does not allow you to perform any action on the objects in a failover association, as the
objects will be in read-only mode.

Admin Permissions for Managing Microsoft DHCP Failover Relationship

To create, modify or delete a Microsoft failover relationship in NIOS, you must have the same permissions on both
the Microsoft servers that are assigned to the failover relationship.
You can update the property of a failover relationship only if it has read/write permissions. You cannot update the
properties of the Microsoft server or partner directly. You must first delete the relationship, create a new relationship
and assign the DHCP scope to the new relationship. NIOS applies the changes to both Microsoft servers defined in
the failover relationship during its next synchronization schedule, only if they are in read/write mode during that
time. You can delete a Microsoft failover relationship only if it is not associated with a DHCP range.

Microsoft Failover Relationships for DHCP Ranges

When you create or update a DHCP range on NIOS, administrators can assign or remove a DHCP range from a
Microsoft failover relationship only if the failover relationship has two read/write Microsoft servers. Note that when
you reassign a DHCP range that is assigned to a Microsoft failover relationship, NIOS removes the DHCP range from
the failover relationship during the next synchronization of the respective server.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1305

Managing Microsoft DHCP Services

When you remove a DHCP range from a read/write Microsoft failover relationship, NIOS deletes a copy of the DHCP
range from both the Microsoft servers defined in the failover relationship. When a DHCP range is associated with a
Microsoft failover relationship, any change made to one copy of the range is automatically saved to the other copy.

Admin Permissions for Managing Failover Relationships for DHCP Ranges

You must have read/write permissions on the DHCP range and on each Microsoft server to assign or remove a DHCP
range from a Microsoft failover relationship.
Note that the changes performed on a DHCP range, which is assigned to a read/write Microsoft failover relationship,
are applied to both copies of the range and synchronized with each Microsoft server during each of their next
scheduled synchronization.
You can delete a DHCP range that is assigned to a Microsoft failover relationship only if the failover relationship has
two read/write Microsoft servers. When you delete a DHCP range that is assigned to a Microsoft failover relationship
in read/write mode, NIOS deletes them on both Microsoft servers that is defined in the relationship during the next
respective scheduled synchronization.

Limitations of Microsoft DHCP Failover Relationship on NIOS

Note the following limitations of Microsoft DHCP failover relationship on NIOS:
1. You cannot synchronize failover scope statistics on a Microsoft DHCP failover relationship.
2. The appliance does not support on demand replication for a Microsoft DHCP failover relationship.
3. You cannot set the functional peer in the PARTNER-DOWN state for a Microsoft DHCP failover on NIOS. For
information, see Setting a Peer in the Partner-Down State on page 1185.
4. The appliance does not support time synchronization of both partners and time synchronization monitoring.
Infoblox recommends that the administrators of the Microsoft servers running the DHCP server must ensure that
the time synchronization is appropriate.
5. You can only add up to 31 DHCP failovers to a Microsoft server in a failover relationship.

Synchronizing IP Addresses with Invalid MAC Addresses

An invalid MAC address is a MAC address whose length is not six bytes (48 bits). You can synchronize IP addresses
with invalid MAC addresses only for Microsoft servers for which you have enabled DHCP synchronization. When you
enable this setting for a Microsoft DHCP server, NIOS synchronizes any DHCP lease or reservation with an invalid MAC
address and it is effective from the next scheduled DHCP lease or DHCP server synchronization. The synchronization
does not affect a DHCP lease or reservation with a valid MAC address.
You can synchronize IP addresses with invalid MAC addresses at the Grid level and override them at the member
level. This is valid for NIOS 6.11.0 and later releases. The appliance displays the invalid MAC address using a red
cross mark in the list. You cannot save invalid MAC addresses, but you can view invalid MAC addresses in the list
panels and editors.
When you disable synchronization for invalid MAC addresses, NIOS ignores any DHCP lease or reservation with an
invalid MAC address and the object disappears from NIOS during the next synchronization of the Microsoft server to
which it belongs. An invalid MAC address that you had synchronized earlier persists until NIOS updates the
associated lease or reservation with a new MAC address, or the lease is cleared, or deleted, or expired.
To synchronize an invalid MAC address, complete the following:
1. Grid: From the Grid tab -> Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
Member: From the Grid tab -> Grid Manager tab, click the Members tab, select the member check box, and click
the Edit icon.
2. Select the Microsoft Server Settings tab in the Grid Properties Editor wizard and complete the following in the
Advanced tab:

1306 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Synchronized DHCP Data

— Allow Invalid MAC Address to be synchronized: This is enabled, by default. Select this to enable
synchronization for invalid MAC addresses.
You can click Override at the member level to specify a new value. The Override button changes to Inherit.
Click Inherit to inherit the value from the Grid.
3. Save the configuration.

Managing Synchronized DHCP Data

When Grid members are configured to manage Microsoft DHCP servers in read/write mode, you can use Grid Manager
to view, edit and delete the DHCP data of those servers. You can add and manage networks and DHCP ranges that are
synchronized as scopes to the Microsoft server, and add and manage reservations and superscopes. All updates are
synchronized to the Microsoft servers at regular intervals.
Grid Manager also allows you to set admin permissions, extensible attributes, and thresholds. These apply only when
the DHCP data is managed on Grid Manager. These properties are not synchronized to Microsoft servers.
The following sections provide guidelines for managing Microsoft DHCP data from Grid Manager:
• Adding and Managing Scopes
• Adding Fixed Addresses/Microsoft Reservations on page 1313
• About Superscopes on page 1315

Adding and Managing Scopes

To add a scope from Grid Manager, you must create an IPv4 network and a DHCP range, and then assign the Microsoft
server to the network and range. To add a split-scope from Grid Manager, you must create an IPv4 network and a DHCP
range, and then assign two Microsoft server to the network and range.
To edit a scope synchronized from a Microsoft server, you must edit the properties of its corresponding DHCP range.
The following sections describe how to add, edit and remove scopes using Grid Manager.

Note: Microsoft servers do not support Infoblox hosts and reservations. You cannot add them to networks and DHCP
ranges served by Microsoft servers.

Adding Networks for Scopes

Following are guidelines for adding a network for Microsoft scopes:
• The network must be served by Microsoft servers. It cannot be served by a mix of Microsoft and Infoblox DHCP
servers.
• If you are adding a split-scope, you must assign the network to two Microsoft servers that serve the split-scope.
A split-scope cannot be served by a mix of Microsoft and Infoblox DHCP servers.
• The network can contain only one DHCP range per Microsoft server. It can contain multiple DHCP ranges as long
as they do not overlap and are each served by a different Microsoft server.
• You can set DHCP properties at the DHCP range level only, not the network level.
You can run discoveries on networks served by Microsoft servers. For information about network discoveries, see IP
Discovery and vDiscovery on page 617.

Note: Networks served by Microsoft DHCP servers do not support the split, join, and expand functions.

You can create a network from scratch or use a network template. For information about creating network templates,
see Adding IPv4 Network Templates on page 1146. To add an IPv4 network for a scope:
1. From the Data Management tab, select the DHCP tab.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1307

Managing Microsoft DHCP Services

2. If you have more than one network view in the system, select the network view in which you want to add the
network. It must be the same network view to which the Microsoft server is assigned.
3. Expand the Toolbar and click Add -> Network.
4. In the Add Network wizard, select one of the following and click Next:
— Add Network
or
— Add Network using Template: Click Select Template and select a network template. For more information,
see About IPv4 Network Templates on page 1146. In the DHCP Network Template Selector dialog box,
select the template you want to use and click the Select icon. Note that when you use a template to create a
network, the configurations of the template apply to the new network. The appliance populates the
template properties in the wizard when you click Next. You can then edit the pre-populated properties,
except for Netmask.
5. Complete the following and click Next:
— Address: Enter the IP address of the network. You can enter the IP address with a CIDR block. For example,
enter 10.0.0.0/24, and the netmask slider adjusts the netmask to /24. You can also enter partial IP address
with a CIDR block. When you are done, Grid Manager displays the complete IP address with the CIDR block.
For example, when you enter 15/24, Grid Manager displays 15.0.0.0/24 and the netmask slider adjusts the
netmask to /24. Note that Microsoft DHCP servers do not support /32 subnets.
— Netmask: Use the netmask slider to select the appropriate number of subnet mask bits for the network.
Microsoft servers support /1 to /31 netmasks. Note that when you use a template that contains a fixed
netmask, you cannot adjust the netmask for this network.
— Comment: Enter additional information about the network, such as the name of the organization it serves.
— Automatically create reverse-mapping zone in view: This function is enabled if the netmask of the network
equals /8, /16, or /24. Select this to have the appliance automatically create reverse-mapping zones for
the network. A reverse-mapping zone is an area of network space for which one or more name servers have
the responsibility for responding to address-to-name queries. These zones are created in the DNS view
assigned to receive dynamic DNS updates at the network view level.
— Disabled: This option does not apply to networks assigned to Microsoft servers. The member ignores this
field when the network is assigned to Microsoft servers. You can disable DHCP ranges assigned to Microsoft
servers, but not networks.
6. Click Next to add Microsoft servers as DHCP servers for the network. Click the Add icon and select the following:
— Add Microsoft Server: Select the Microsoft server from the Microsoft Server Selector dialog box. You
can add multiple Microsoft servers, if you are adding multiple DHCP ranges served by different
Microsoft servers. For a split-scope, you must assign two Microsoft servers to the network.
7. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see About Extensible Attributes on page 417.
8. Save the configuration and click Restart if it appears at the top of the screen.
or
Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Setting Network Properties

You can change the Microsoft servers assigned to the network, and define extensible attributes and admin
permissions to the network. You can also set thresholds for the network, to enable the appliance to make a syslog
entry when address usage goes above or below the thresholds.
To set network properties:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box, and then
click the Edit icon.
2. The Network editor contains the following basic tabs from which you can modify data:

1308 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Synchronized DHCP Data

— General Basic: You can enter or modify comments.

— Member Assignment: Add or delete Microsoft servers. For information, see Adding IPv4 Networks on page
1111. If the network contains multiple DHCP ranges each managed by a different Microsoft server, then you
can add those Microsoft servers here.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific network. You
can also modify the values of the extensible attributes. For information, see About Extensible Attributes on
page 417.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Expert Mode to display the following tabs from which you can modify advanced
data.
— General Advanced: You can associate zones with a network. For information, see Associating Networks with
Zones on page 1093.
— Thresholds: These watermarks represent thresholds above or below which address usage is unexpected
and might warrant your attention. Thresholds are inherited from the Grid.
— High-water Mark: Enter a number between 0 and 100. If the percentage of allocated addresses in a
DHCP range exceeds this number, the appliance makes a syslog entry. The default is 95.
— Low-water Mark: Enter a number between 0 and 100. If the percentage of allocated addresses in a
DHCP range drops below this number, the appliance makes a syslog entry. The default is 0. Address
usage must initially exceed the low-water mark threshold and then dip below it before the appliance
considers low address usage an event requiring an alert.
4. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting and Restoring a Network

When you delete a network, Grid Manager moves it and its DHCP ranges and fixed addresses to the Recycle Bin, and
permanently deletes its leases. The corresponding scopes and reservations are deleted from the Microsoft server at
the next synchronization. If you restore the network on Grid Manager, its DHCP ranges and fixed addresses are
restored as well. The Grid member then adds the corresponding scopes and reservations to the Microsoft server on
the next synchronization. For information about deleting networks, see Deleting IPv4 Networks on page 1119. For
information about restoring data, see Using the Recycle Bin on page 73.

Adding a DHCP Range/Scope

After you add a network for a scope, you must then define its DHCP range. You can create the DHCP range from scratch
or use a DHCP Range template. For information about DHCP templates, see About IPv4 Range Templates on page
1142.
You can add multiple ranges to the same network, as long as each range is served by a different Microsoft server and
the ranges do not overlap.
When you add a split-scope, you must specify the Microsoft servers that serve the scopes and their exclusion ranges.
Each scope inherits its options from its respective Microsoft server. Note that the enabled/disabled setting of the first
range automatically applies to the second range. Therefore, if the first range is initially disabled, then the second
range is initially disabled as well.
To add a DHCP range for a scope:
1. From the Data Management tab, select the DHCP tab.
2. Navigate to the network to which you want to add a DHCP range, and then click Add -> DHCP Range from the
Toolbar. You can also add a DHCP range from any panel in the DHCP tab.
3. In the Add Range wizard, select one of the following and click Next:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1309

Managing Microsoft DHCP Services

— Add DHCP Range

or
— Add DHCP Range using Template
Click Select Template and select the template that you want to use. Note that when you use a template to
create a DHCP range, the configurations of the template apply to the new range. The appliance
automatically populates the DHCP range properties in the wizard. You can then edit the pre-populated
properties.
4. Complete the following:
— Network: Click Select Network to select the network to which you want to add the DHCP range. The network
must be served by a Microsoft server. If you are adding a DHCP range while viewing the contents of a
specific network, the appliance displays the network address here. You can still select a different network
by clicking Select Network.
— Start: Enter the first IP address in the range.
— End: Enter the last IP address in the range.
— Name: You can enter a name for the DHCP range.
— Comment: You can enter additional information. After the range is synchronized to the Microsoft server as a
scope, this text appears in the Description field of the scope on the Microsoft server.
— Disable for DHCP: Select this if you do not want the DHCP server to allocate IP addresses from this DHCP
range at this time. If you select this, the Grid member synchronizes the range to the Microsoft server as an
inactive scope.
5. Click Next and select one of the following to provide DHCP services for the DHCP range:
None: Select this if you do not want to synchronize this range to the Microsoft DHCP server.
Microsoft Server: This field displays the Microsoft server that you selected for the network. If several servers
were assigned to the network, you can select one from the list.
— Microsoft Split-Scope: Select this to create a split-scope, and then complete the following:
— Microsoft Server #1: Read-only field that displays the Microsoft server that you specified in the preceding
step.
— Microsoft Server #2: Select the Microsoft server that will serve the split-scope.
— Split Percentage: Specify the percentage of IP addresses in the scope that is allocated to the exclusion
range of each Microsoft server. The default is 50%. You can either move the slider or enter the percentages
in the text fields. When you use the slider, you are specifying the percentage of addresses in the exclusion
range of the first server. A tooltip window displays the percentage as you adjust the slider. When you set the
slider, the Split Percentage, Exclusion Starting Address, and Exclusion Ending Address fields are updated
accordingly.
— Exclusion Starting Address: When you set the split percentages, these fields automatically displays the
starting address of the exclusion range of each Microsoft server. Alternatively, you can enter the starting
address of the exclusion range of the first Microsoft server, and the Split Percentage and Exclusion Ending
Address values adjust accordingly.
— Exclusion Ending Range: When you set the split percentage, these fields automatically display the ending
address of the exclusion range of each Microsoft server. Alternatively, you can enter the ending address of
the exclusion range of the second Microsoft server, and the Split Percentage and Exclusion Starting
Address values adjust accordingly.
6. Click Next, and optionally set operational parameters for the scope. Otherwise, the scope inherits its parameters
from the first Microsoft DHCP server.
• Lease Time: Specify the lease time. The default is 8 days. When the range is served by a Microsoft server and
you enter a lease time of 1000 days or more, Grid Manager automatically grays out this field and checks the
Unlimited Lease Time option after you save your entries.
— Unlimited Lease Time: Select this option to set an infinite lease time for the IP addresses leased from this
range.

1310 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Synchronized DHCP Data

— Routers: In the table, enter the IP address of the router that is connected to the same network as the DHCP
clients. Click the Add icon to add more routers.
— Domain Name: Enter the name of the domain for which the Microsoft server serves DHCP data. The DHCP
server includes this domain name in Option 15 when it responds with a DHCPOFFER packet to a
DHCPDISCOVER packet from a client.
— DNS Servers: In the table, enter the IP address of the DNS server to which the DHCP clients send name
resolution requests. The DHCP server includes this information in the DHCPOFFER and DHCPACK messages.
— Broadcast Address: Enter the broadcast IP address of the network to which the DHCP server is attached.
7. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
8. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Setting DHCP Range/Scope Properties

A Microsoft scope inherits its properties from its Microsoft server. In Grid Manager, you can override the inherited
values or set other properties by editing the DHCP range. You can also configure an exclusion range within the scope
and set thresholds, to enable the appliance to make a syslog entry when address usage goes above or below the
thresholds.
You can modify a scope’s properties, including its start and end addresses, servers, and exclusion ranges. If you edit
the properties of a split-scope and it results in gaps or overlapping exclusion ranges so that the ranges are no longer
identical, Grid Manager displays a warning indicating that continuing with the operation automatically removes the
split-scope flag. Grid Manager also removes the flag when the start or end address of a scope changes, so its range
is no longer the same.
To set DHCP range properties:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> addr_range check
box, and then click the Edit icon.
2. The DHCP Range editor contains the following basic tabs from which you can modify data:
— General: Modify the fields, including the start and end addresses, as described in Adding a DHCP
Range/Scope on page 1309.
— Server Assignment: Switch to None or select a different Microsoft server for the DHCP range.
— IPv4 DHCP Options: Keep the DHCP properties or override them and enter unique settings for the DHCP
range. For information about the fields, see Adding a DHCP Range/Scope on page 1309.
This tab displays DHCP and Microsoft vendor options that were synchronized from the Microsoft server. You
can edit any of the options. When you select a different User Class or Vendor Class from the drop-down
menus, Grid Manager automatically updates the option definitions in the drop-down list.
To configure additional DHCP options, click + and select a User Class and Vendor Class from the drop-down
menus. Select an option from the drop-down list, and enter a value in the field beside it. You can click - to
remove an option.
— Extensible Attributes: You can add and delete extensible attributes that are associated with a specific DHCP
range. You can also modify the values of extensible attributes. For information, see Using Extensible
Attributes on page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Expert Mode to display the following tabs from which you can modify advanced
data.
— DDNS: Complete the following to set DDNS parameters for the range:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1311

Managing Microsoft DHCP Services

— Enable DDNS Updates: Click the check box to enable the Microsoft DHCP server to send dynamic DNS
updates or clear the check box to disable this function.
— Option 81 Support
DHCP Server Updates DNS If Requested by Client: The DHCP server updates DNS only if it is requested
by the client. Otherwise, the client updates DNS.
DHCP Server Always Updates DNS: The DHCP server always updates DNS, regardless of any client
request.
— Exclusion Ranges: Configure a range of IP addresses that the server does not use to assign to clients. You
can use these exclusion addresses as static IP addresses. For information, see Configuring IPv4 Fixed
Addresses on page 1125. In a split-scope, the exclusion range identifies the range of IP addresses that the
other Microsoft server serves. If you edit the exclusion range of either of the scopes in a split-scope and the
exclusion ranges no longer complement each other, NIOS removes the split-scope flag from both scopes.
— Thresholds: Thresholds are inherited from the Grid. These watermarks represent thresholds above or below
which address usage is unexpected and might warrant your attention.
— High-water Mark: Enter a number between 0 and 100. If the percentage of allocated addresses in a
DHCP range exceeds this number, the appliance makes a syslog entry. The default is 95.
— Low-water Mark: Enter a number between 0 and 100. If the percentage of allocated addresses in a
DHCP range drops below this number, the appliance makes a syslog entry. The default is 0. Address
usage must initially exceed the low-water mark threshold and then dip below it before the appliance
considers low address usage an event requiring an alert.
4. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting and Restoring a DHCP Range/Scope

When you delete a DHCP range, Grid Manager moves it and its exclusion range and fixed addresses to the Recycle
Bin, and permanently deletes its leases. At the next synchronization, the member deletes the scope, its exclusion
range and reservations from the Microsoft server. If you restore a DHCP range on Grid Manager, then the Grid member
adds its corresponding scope, exclusion range and reservations to the Microsoft server at the next synchronization.
For information about deleting DHCP ranges, see Deleting IPv4 Address Ranges on page 1125. For information about
restoring data, see Using the Recycle Bin on page 73.
If you delete a scope that is part of a split-scope, Grid Manager automatically removes the split-scope flag from the
remaining scope.

Viewing Scopes
To view the scopes in a network, navigate to DHCP -> Networks -> network. The panel displays the objects in the
network, including the scopes and split-scopes. For split-scopes, the panel displays both scopes with the same start
and end address. It displays the following information about each object:
• IP Address: The IP address of the DHCP object. For a scope, this field displays the start and end addresses of the
scope. Note that the appliance highlights all disabled DHCP objects in gray.
• Split-Scope: Displays Yes if the scope is a split-scope.
• MS Server: Displays the Microsoft server that is serving the scope.
• Type: The DHCP object type, such as DHCP Range or Fixed Address.
• Name: The object name. For example, if the IP address belongs to a host record, this field displays the
hostname.
• Comment: The information you entered for the object.

1312 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Synchronized DHCP Data

• IPv4 DHCP Utilization: The percentage of the total DHCP usage of a DHCP range. This is the percentage of the
total number of fixed addresses, reservations, hosts, and active leases in the DHCP range divided by the total IP
addresses in the range, excluding the number of addresses in the exclusion ranges. Note that only enabled
objects are included in the calculation.
• Site: The site to which the DHCP object belongs. This is one of the predefined extensible attributes.
You can select the following additional columns for display:
• Static Addresses: Indicates whether the IP address is a static address.
• Dynamic Addresses: Indicates whether the IP address is a dynamically assigned address.
• Disabled: Indicates whether the object is disabled.
• Priority: Displays the priority of a DHCP range when NAC filters are applied.
• Available extensible attributes.
You can also do the following in this panel:
• Sort the displayed data in ascending or descending order by column.
• Click Go to IPAM View to view information about the object in the IPAM tab.
• Add new objects, such as DHCP ranges, to the network.
• Delete or schedule the deletion of a selected object or multiple objects.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Print or export the data.
You can also view the scopes in the IP Map.

Adding Fixed Addresses/Microsoft Reservations

To add a reservation from Grid Manager, add a fixed address and Grid Manager synchronizes it to the Microsoft server
as a reservation. You can create fixed addresses from scratch or use fixed address templates. For information about
fixed address templates, see Adding IPv4 Fixed Address/Reservation Templates on page 1145.
To add a fixed address:
1. From the Data Management tab, select the DHCP tab.
2. Expand the Toolbar and click Add -> Fixed Address.
3. In the Add Fixed Address wizard, select one of the following and click Next:
— Add Fixed Address
or
— Add Fixed Address using Template
Click Select Template and select the template that you want to use.
4. Complete the following:
— Network: Click Select Network to select the network to which you want to add the fixed address. If you are
adding the fixed address from a specific network, the appliance displays the network address here. You can
still select a different network by clicking Select Network.
— IP Address: Enter the IPv4 address for the fixed address, or click Next Available IP to obtain the next
available IP address.
— MAC Address: Enter the MAC address of the host.
— Name: Enter a name for the fixed address. This is required for reservations on Microsoft servers.
— Configure On:
None: Select this if you do not want this synchronized to the Microsoft server.
Microsoft Server: Select the Microsoft server that serves this fixed address.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1313

Managing Microsoft DHCP Services

— Comment: Optionally, enter additional information. The text in this field appears in the Description field of
the Microsoft reservation after the fixed address is synchronized. Note that due to a length limit set by the
Microsoft DHCP server, after you synchronize DHCP data, the Description field can display only up to 128
characters even though NIOS allows up to 256 characters for this field.
5. Click Next, and optionally set operational parameters for the fixed address. Otherwise, the fixed address inherits
its parameters from its scope.
— Routers: In the table, enter the IP address of the router that is connected to the same network as the DHCP
client. Click the Add icon to add more routers.
— Domain Name: Enter the name of the domain for which the Microsoft DHCP serves DHCP data. The DHCP
server includes this domain name in Option 15 when it responds with a DHCPOFFER packet to a
DHCPDISCOVER packet from a client.
— DNS Servers: In the table, enter the IP address of the DNS server to which the DHCP client sends name
resolution requests. The DHCP server includes this information in the DHCPOFFER and DHCPACK messages.
— Broadcast Address: Enter the broadcast IP address of the network to which the DHCP server is attached.
6. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see Using Extensible Attributes on page 427.
7. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Setting Fixed Address/Reservation Properties

Microsoft reservations inherit their properties from their scopes. In Grid Manager, you can override the inherited
values or set other properties of a Microsoft reservation, by editing its fixed address.
To modify a fixed address:
1. From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> fixed_address
check box, and then click the Edit icon.
2. The Fixed Address editor contains the following basic tabs from which you can enter data:
— General: You can modify the fields described in Adding Fixed Addresses/Microsoft Reservations on page
1313.
— IPv4 DHCP Options: Keep the inherited properties, or override them and enter unique settings.
This section displays DHCP and Microsoft vendor options that were synchronized from the Microsoft server.
You can edit any of the options. When you select a different User Class or Vendor Class from the drop-down
menus, Grid Manager automatically updates the option definitions in the drop-down list.
To configure additional DHCP options, click + and select a User Class and Vendor Class from the drop-down
menus. Select an option from the drop-down list, and enter a value in the field beside it. You can click - to
remove an option.
— Discovered Data: If you ran a discovery on the network, Grid Manager displays the discovered data of the
fixed address. For information, see Viewing Discovered Data on page 642. Note that conflicts can occur
when discovered data does not match the existing IP address data. For information about resolving these
conflicts, see Resolving Conflicting Addresses on page 647.
— Extensible Attributes: Add and delete extensible attributes that are associated with a specific network. You
can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427.
— Permissions: This tab appears only if you belong to a superuser admin group. For information, see
Managing Permissions on page 205.
3. Optionally, you can click Toggle Expert Mode to display the DDNS tab. To set DDNS parameters for the fixed
address, complete the following:

1314 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Synchronized DHCP Data

— Enable DDNS Updates: Click the check box to enable the Microsoft DHCP server to send dynamic DNS
updates or clear the check box to disable this function.
— Option 81 Support
— DHCP Server Updates DNS If Requested by Client: The DHCP server updates DNS only if it is requested
by the client. Otherwise, the client updates DNS.
— DHCP Server Always Updates DNS: The DHCP server always updates DNS, regardless of any client
request.
4. Save the configuration and click Restart if it appears at the top of the screen.
or
— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Deleting and Restoring a Fixed Address/Reservation

When you delete a fixed address, Grid Manager moves it to the Recycle Bin. At the next synchronization, the Grid
member deletes its corresponding reservation from the Microsoft server. If you restore fixed address, then the Grid
member adds its corresponding reservation to the Microsoft server at the next synchronization. For information about
deleting fixed addresses, see Deleting Fixed Addresses on page 1130. For information about restoring data, see
Using the Recycle Bin on page 73.

About Superscopes
In Grid Manager, you can group DHCP ranges served by Microsoft servers into a superscope. You can add multiple
DHCP ranges to a superscope, as long as the ranges are all served by the same Microsoft DHCP server. The Grid
member then synchronizes the superscope and its associated DHCP ranges as superscopes and scopes to the
Microsoft DHCP server.
You can also associate extensible attributes with superscopes in Grid Manager. Extensible attributes are not
synchronized to the Microsoft DHCP server.
Only admins with read/write permission to superscopes can add and manage superscopes.

Adding Superscopes
Before you add a superscope, you must first create at least one DHCP range to include in the superscope.
To add a superscope:
1. From the Data Management tab, select the DHCP tab.
2. If you have more than one network view in the system, select the network view in which you want to add the
superscope. The network view must be the same one that is assigned to the Microsoft server.
3. Expand the Toolbar and click Add -> Superscope.
4. In the Add Superscope wizard, complete the following and click Next:
— Name: Enter a name for the superscope.
— Comment: Optionally, enter additional information about the superscope.
— Disabled: Select this to disable the DHCP ranges in the superscope. They are then synchronized as inactive
scopes on the Microsoft server.
5. Click the Add icon and select a range from the Select Range dialog box. This dialog box lists only the address
ranges that are served by a Microsoft server.
6. Click Next to enter values for required extensible attributes or add optional extensible attributes. For information,
see About Extensible Attributes on page 417.
7. Save the configuration and click Restart if it appears at the top of the screen.
or

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1315

Managing Microsoft DHCP Services

— Click the Schedule icon at the top of the wizard to schedule this task. In the Schedule Change panel, enter a
date, time, and time zone. For information, see Scheduling Tasks on page 85.

Viewing Superscopes
To view superscopes, navigate to the Data Management tab -> DHCP tab -> Networks tab -> Microsoft Superscopes.
Grid Manager displays the following information about each superscope that is displayed:
• Name: The name of the superscope. Grid Manager appends the FQDN of its associated Microsoft server so you
can identify which superscope belongs to which server.
• Comment: The comment that was entered for the superscope.
• DHCP Utilization: The percentage of the total DHCP usage of the ranges in the superscope. Fixed addresses and
reservations that are outside of a range are excluded from the calculation.
• Site: The site of the superscope. This is one of the predefined extensible attributes.
You can add the following columns for viewing:
• Static Addresses: The number of static addresses.
• Dynamic Addresses: The number of dynamic addresses.
• Disabled: Indicates whether the superscope is enabled.
You can do the following in this section:
• Click the link of a superscope to list its address ranges.
• Add a superscope.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Print or export the information in this section.
• Delete a superscope.

Modifying Superscopes
To modify a superscope:
1. From the Data Management tab, select the DHCP tab -> Network tab -> Microsoft Superscopes -> ms_superscope
check box, and then click the Edit icon.
2. The Superscopes editor contains the following tabs from which you can modify data:
— General: You can modify the name and comment, and enable or disable the superscope. You can also add
and delete address ranges from the superscope. Note that when you delete the last DHCP range in a
superscope, Grid Manager automatically deletes the superscope as well.
— Extensible Attributes: Define extensible attributes for the superscope. These apply only when the
superscope is managed in Grid Manager. For information, see Using Extensible Attributes on page 427.
— Permissions: Define administrative permissions that apply to the superscope when it is managed in Grid
Manager. For information see About Administrative Permissions on page 195.
3. Save the configuration and click Restart if it appears at the top of the screen.

Deleting Superscopes
When you delete a superscope in Grid Manager, it is permanently deleted from the database. The superscope is
deleted from the Microsoft server at the next synchronization. Note that deleting a superscope does not delete the
DHCP ranges in the superscope. These are retained in the database.
To delete a superscope:

1316 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Synchronizing Updates

1. From the Data Management tab, select the DHCP tab -> Network tab -> Microsoft Superscopes -> ms_superscope
check box, and then click the Delete icon.
2. Click Yes when the confirmation dialog appears.

Synchronizing Updates
A Grid member synchronizes DHCP data with each of its managed Microsoft server at regular intervals. During each
synchronization, updates from Grid Manager are applied to the Microsoft server and updates from the Microsoft
server are applied to the Grid as well.
Because admins can update DHCP data from both the Microsoft server and from Grid Manager, conflicts can occur
during synchronization. The following guidelines describe how the Grid member resolves conflicts and handles any
differences when DHCP data is synchronized between a Microsoft server and the Grid.
• If a Microsoft server admin modifies an object that has a pending scheduled task in Grid Manager and
synchronization occurs before the scheduled task, the object is modified in both the Microsoft server and the
Grid member. When the scheduled task executes at its scheduled time, it fails and an error message is logged in
the audit log.
• When a Microsoft server admin and a Grid Manager admin change the same object, the Grid member retains the
version that exists on the Microsoft server. Following are some examples:

Table 36.2

Grid Manager Admin... Microsoft Server Admin... After Synchronization

Deletes the 10.1.1.0/24 network Adds a scope that is within the The 10.1.1.0/24 network is created on the
which has two DHCP ranges 10.1.1.0/24 network Grid with the updates and is assigned to
the Microsoft server.
Changes the DHCP options of a Deletes the scope. The scope is deleted from the Grid as well.
scope

• If a Grid member manages multiple Microsoft servers, it can synchronize scopes to the same network as long as
they are served by different Microsoft servers and they do not overlap. If the Microsoft servers have scopes that
overlap, the Grid member synchronizes only one of the scopes, including its reservations. It does not
synchronize the other scopes and logs an error message for each scope that is not synchronized. For
information about the Microsoft logs, see Viewing Synchronization Logs on page 1281.
Note that a Grid member can synchronize scopes with overlapping reservations because they are served by
different Microsoft servers.
• When a Grid member synchronizes a split-scope to its respective Microsoft servers, the scopes use the default
value for the DHCP Offer Delay value, since this property is not supported by NIOS.
• If you create a split-scope on a NIOS appliance, synchronization fails if there is an existing scope in the same
network on one of the Microsoft servers. Only one scope is allowed in a network, per Microsoft server.
• If a Microsoft admin adds a DHCP range and a NIOS admin is in the process of adding the same range when a
synchronization occurs, the NIOS admin will not be able to save the range after the synchronization. Grid
Manager will display an error message indicating that the range already exists.
• If both a NIOS admin and a Microsoft admin create a scope or split-scope and conflicts occur, the Microsoft
server always takes precedence. All conflicts are logged to the Microsoft log. Following are some examples:
• If the NIOS admin creates a scope and a Microsoft server admin creates a split-scope for the same DHCP
range, the split-scope is synchronized to Grid Manager.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1317

Managing Microsoft DHCP Services

• If the NIOS admin creates a split-scope on Microsoft servers 1 and 2, and a Microsoft admin creates the
same split-scope on Microsoft servers 1 and 3 but with different exclusion ranges, the scope created by the
NIOS admin on Microsoft server 1 is dropped upon synchronization.
• If the NIOS admin creates a split-scope on Microsoft servers 1 and 2, and a Microsoft admin creates the
same split-scope on the same Microsoft servers but with different exclusion ranges, the split-scope created
by the Microsoft admin is synchronized to NIOS and retained. The split-scope created by the NIOS admin is
dropped.

Managing Microsoft DHCP Servers

You can control the DHCP services of managed Microsoft servers and set certain properties as well. This section
includes the following topics:
• Viewing Members and Managed DHCP Servers
• Setting Microsoft DHCP Server Properties on page 1319
• Controlling the DHCP Service of a Microsoft Server on page 1320
• Disabling and Removing Microsoft DHCP Servers on page 1320
• Modifying DHCP Server Assignments on page 1320

Viewing Members and Managed DHCP Servers

You can view Infoblox and Microsoft DHCP servers by navigating to the Data Management tab -> DHCP tab, and then
selecting the Members/Servers tab. The panel displays the following information about each DHCP server:
• Name: The hostname of the Grid member or Microsoft server.
• Status: The status of the DHCP service on the Grid member or Microsoft server.
• Comment: Comments that were entered for the Grid member or Microsoft server.
• DHCP Utilization: The percentage of the total DHCP utilization of the member or Microsoft server. This is the
percentage of the total number of DHCP hosts, fixed addresses, reservations, and leases assigned to the
member or Microsoft server versus the total number of IP addresses (excluding IP addresses in the exclusion
range) and all DHCP objects assigned to the member or DHCP server. Note that only enabled objects are
included in the calculation. The appliance updates the utilization data every 15 minutes. The appliance
displays the utilization data in one of the following colors:
— Red: The DHCP resources are 100% utilized.
— Yellow: The utilization percentage is over the effective high watermark threshold.
— Blue: The utilization percentage is below the effective low watermark threshold.
— Black: The utilization percentage is at any number other than 100%, or within the effective thresholds.
• Site: Values that were entered for this pre-defined attribute.
You can select the following additional columns for display:
• Address: The IP address of the member or Microsoft server.
• Static Addresses: The number of static IP addresses.
• Dynamic Addresses: The number of dynamically assigned IP addresses.
You can do the following:
• Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Edit the properties of a Grid member or Microsoft server.
— Click the check box beside a Grid member or Microsoft server, and then click the Edit icon.
• Export the list of Grid members and Microsoft servers to a .csv file.

1318 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Microsoft DHCP Servers

— Click the Export icon.

• Print the list of Grid members and Microsoft servers.
— Click the Print icon.

Setting Microsoft DHCP Server Properties

From Grid Manager, you can set DHCP properties supported by a Microsoft server. These are applied to the server at
the next synchronization. You can also set other properties that apply to Grid Manager only, such as thresholds and
the logging.
To set properties for a Microsoft DHCP server:
1. From the Data Management tab, select the DHCP tab -> Members/Servers tab -> Members/Servers -> ms_server
check box, and then click the Edit icon.
2. In the Microsoft Server DHCP Properties editor, you can configure DHCP properties in each tab as follows:
IPv4 DHCP Options tab: Complete the following to configure basic DHCP options for the server:
— Routers: Click the Add icon and enter the IP address of the router that is connected to the same network as
the DHCP clients.
— Domain Name: Enter the name of the domain for which the server serves DHCP data. The DHCP server
includes this domain name in Option 15 when it responds with a DHCPOFFER packet to a DHCPDISCOVER
packet from a client. If DDNS is enabled on the DHCP server, it combines the host name from the client and
this domain name to create the FQDN (fully-qualified domain name) that it uses to update DNS.
— DNS Servers: Click the Add icon and enter the IP address of the DNS server to which the DHCP client sends
name resolution requests. The DHCP server includes this information in the DHCPOFFER and DHCPACK
messages.
— Broadcast Address: Enter the broadcast IP address of the network to which the DHCP server is attached.
— Custom DHCP Options: This section displays DHCP and Microsoft vendor options that were synchronized
from the Microsoft server. You can edit any of the options. When you select a different User Class or Vendor
Class from the drop-down menus, Grid Manager automatically updates the option definitions in the
drop-down list.
To configure additional DHCP options, click + and select a User Class and Vendor Class from the drop-down
menus. Select an option from the drop-down list, and enter a value in the field beside it. You can click - to
remove an option.
DDNS tab: You can enable or disable dynamic DNS updates and set certain properties.
— Enable DDNS Updates: Click the check box to enable the Microsoft DHCP server to send dynamic DNS
updates or clear the check box to disable this function.
— Option 81 Support
DHCP Server Updates DNS If Requested by Client: The DHCP server updates DNS only if it is requested
by the client. Otherwise, the client updates DNS.
DHCP Server Always Updates DNS: The DHCP server always updates DNS, regardless of any client
request.
Thresholds tab: Thresholds are inherited from the Grid. These watermarks represent thresholds above or below
which address usage is unexpected and might warrant your attention.
— Enable DHCP Thresholds: Select this check box to enable the feature.
— High-water Mark: Enter a number between 0 and 100. If the percentage of allocated addresses in a
DHCP range exceeds this number, the DHCP server makes a syslog entry. The default is 95.
— Low-water Mark: Enter a number between 0 and 100. If the percentage of allocated addresses in a
DHCP range drops below this number, the DHCP server makes a syslog entry. The default is 0. Address
usage must initially exceed the low-water mark threshold and then dip below it before the appliance
considers low address usage an event requiring an alert.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1319

Managing Microsoft DHCP Services

3. Optionally, you can click Toggle Expert Mode to display the Logging tab, where you can enable the managing
member to log the lease events of the Microsoft server. This setting is inherited from the Grid. You can override
that setting by clicking Override, and then selecting or clearing the Log Lease Events from DHCP server check box.
4. Save the configuration and click Restart if it appears at the top of the screen.

Controlling the DHCP Service of a Microsoft Server

You can start and stop the DHCP service of a managed Microsoft server from Grid Manager as follows:
1. From the Data Management tab, select the DHCP tab -> Members/Servers tab -> Members/Servers -> ms_server
check box.
2. Expand the Toolbar and click Start or Stop.
3. Click Yes when the confirmation dialog appears.

Disabling and Removing Microsoft DHCP Servers

If you remove a Microsoft server as a managed server, Grid Manager deletes all the DHCP ranges, leases, and fixed
addresses associated with the server. It also deletes networks that were assigned only to the Microsoft server. It does
not delete a network if it was assigned to other Microsoft servers as well.
When you disable a Microsoft server, the managing Grid member terminates any on-going synchronization and
restarts synchronization only when the server is re-enabled. The DHCP data associated with that server is preserved
in the same state until synchronization resumes.
For information on removing and disabling Microsoft servers, see Disabling Synchronization on page 1266 and
Removing a Managed Microsoft Server on page 1266.

Modifying DHCP Server Assignments

If you disable a Microsoft DHCP server or take it offline for maintenance purposes, for example, you can assign its
scopes to a member DHCP server.
Following are the tasks to reassign scopes from a Microsoft server to a member DHCP server:
1. Set the server assignments of all fixed addresses in the scope to “None”.
From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> fixed_address
check box, and then click the Edit icon. You can change the server assignment in the General tab of the Fixed
Address editor.
2. Set the server assignments of all address ranges served by the Microsoft server to “None”.
From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> addr_range check
box, and then click the Edit icon. You can change the server assignment in the General tab of the DHCP Range
editor.
3. Change the sever assignments of the networks by deleting the Microsoft server and replacing it with a member
DHCP server.
From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network check box, and then
click the Edit icon. You can change the server assignment in the Member Assignment tab of the Network editor.
contains the following basic tabs from which you can modify data:
4. Modify the server assignments of all address ranges and specify the member DHCP server.
From the Data Management tab, select the DHCP tab -> Networks tab -> Networks -> network -> addr_range check
box, and then click the Edit icon. You can change the server assignment in the General tab of the DHCP Range
editor.
5. Restart services.
The member DHCP server starts granting lease requests after the restart. Note that you do not need to clear the leases
that were active on the Microsoft server, because the member automatically clears them when you change the DHCP
server assignment.

1320 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Managing Microsoft DHCP Servers

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1321

Managing Microsoft DHCP Services

1322 NIOS Administrator Guide (Rev. A) NIOS 7.3

Part 7 Monitoring and Reporting
This section explains how to use the different monitoring and reporting tools, including DHCP fingerprint detection
and SNMP. It includes the following chapters:
• Chapter 37, Monitoring the Appliance, on page 1325
• Chapter 38, DHCP Fingerprint Detection, on page 1357
• Chapter 39, Monitoring with SNMP, on page 1363
• Chapter 40, Infoblox Reporting and Analytics, on page 1379

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1323

1324 NIOS Administrator Guide (Rev. A) NIOS 7.3
Chapter 37 Monitoring the Appliance
This chapter describes the status icons that indicate the state of appliances, services, database capacity, Ethernet
ports, HA, and Grid replication. It also explains how to use the various logs and the traffic capture tool to monitor a
NIOS appliance.
This chapter contains the following sections:
• Viewing Status on page 1326
— Grid Status on page 1326
— Member Status on page 1326
• Monitoring Services on page 1333
— Service Status on page 1333
— Monitoring Grid Services on page 1333
— Monitoring Member Services on page 1334
• Using a Syslog Server on page 1334
— Specifying Syslog Servers on page 1335
— Syslog Message Prefixes on page 1337
— Configuring Syslog for Grid Members on page 1339
— Setting DNS Logging Categories on page 1340
— Viewing the Syslog on page 1341
— Searching in the Syslog on page 1343
— Downloading the Syslog File on page 1343
• Monitoring Tools on page 1344
— Using the Audit Log on page 1344
— Viewing the Replication Status on page 1346
— Using the Traffic Capture Tool on page 1347
— Using the Capacity Report on page 1348
— Participating in the Customer Experience Improvement Program on page 1349
— Monitoring DNS Transactions on page 1350
— Viewing DNS Alert Indicator Status on page 1352
— Configuring DNS Alert Thresholds on page 1352
— DHCP Fingerprint Detection on page 1357

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1325

Monitoring the Appliance

Viewing Status
Grid Manager provides tools for monitoring the status of the Grid, members, and services. You can monitor overall
Grid and member status from the Dashboard, which provides a high-level view of your Grid, members and IP address
data, and easy access to tasks. For information, see Dashboards on page 117.
Grid Manager also displays status icons to indicate the state of appliances, services, database capacity, Ethernet
ports, HA, and Grid replication. Depending on your appliance, Grid Manager can display status icons for the power
supplies as well as icons to indicate the state of the RAID array and disk controller backup battery.
You can monitor detailed status of the Grid, members, and services, and then decide how to manage them. Note that
when any member or service encounters issues, the appliance sends SNMP traps. For information, see Monitoring
with SNMP on page 1363.

Grid Status
You can monitor the overall status of the Grid using the Grid Status widget on the Dashboard. For information, see
Grid Status on page 145.
You can also view the Grid status from the Grid Manager tab. To view Grid status, from the Grid tab, select the Grid
Manager tab. Grid Manger displays the overall Grid status and status of all Grid services. The Grid status represents
the status of the most critical members or services in the Grid. When all Grid members are running properly, the
overall Grid status is green. When one of the members has operational problems, the overall Grid status is red. Grid
Manager lists all Grid members in the Members tab so you can identify which member has issues. For information,
see Member Status.
In addition, the service bar below the Grid status lists the status of all licensed services—DHCP, DNS, TFTP, HTTP (File
Distribution), FTP, NTP, bloxTools, DNS Accelerator—in the Grid. When you click a service link, Grid Manager displays
detailed information about the selected service running on all members. For information, see Monitoring Services on
page 1333. Grid Manager also provides icons you can use to edit Grid properties and bookmark the page.

Member Status
You can monitor the overall status, such as the memory usage and system temperature, of a Grid member or an
independent appliance using the Member Status (System Status) widget on the Dashboard. For information, see
Member Status (System Status) on page 147.
To monitor detailed status of a member, from the Grid tab, select the Grid Manager tab -> Members tab.
In the Members tab, Grid Manager displays the Grid Master first and then all other members in alphabetical order. If
a member is an HA pair, you can click the arrow next to the member row to view information about the active and
passive nodes. Grid Manager can display the following information:
• Name: The name of the member.
• HA: Indicates whether the member is an HA pair.
• Status: The service status of the member. For a vNIOS appliance whose license is revoked and is still operating
in the Grid, Grid Manager displays a license violation warning here. You should immediately remove this
member from the Grid.
• IPv4 Address: The IPv4 address of the appliance, or the VIP of an HA pair.
• IPv6 Address: The IPv6 address of the appliance, or the VIP of an HA pair.
• Identify: This field appears only if your appliance has the unit identification button. This can be On or Off. When
you identify the appliance by pressing the UID button on the appliance or through the GUI or CLI command, this
field displays On. Otherwise, this is Off.
• DHCP, DNS, TFTP, HTTP, FTP, NTP, bloxTools, Captive Portal, DNS Accelerator usage, Reporting, Discovery, Threat
Protection, Cloud-API, Threat Analytics, TAXII: The status icons indicate whether these services are running
properly. The DNS accelerator usage feature is only applicable to the IB-4030 appliance. For information, see
Service Status on page 1333.

1326 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Status

— Reporting Site: This field appears only when you enable reporting service and configure multi-site cluster.
For information about reporting clusters, see Configuring Indexer Cluster on page 1396.
• Hardware Type: The hardware type of the appliance.
• Hardware Model: The hardware model of the appliance.
• Serial Number: The serial number of the appliance.
• DB Utilization: The current percentage of the database in use.
• Platform: The platform on which the appliance is running. For vNIOS virtual appliances, this displays the name
of the CMP, such as AWS or VMware. For physical NIOS appliances, this displays Physical.
• Comment: Information about the member.
To turn the identification button on or off on the member, click the Hardware Identify icon. Grid Manager displays a
panel with the appliance name, status, and IP address. Hover your mouse over the row and click Turn On to turn the
identification button on, or click Turn Off to turn it off.
To view detailed status, select a member check box, and then click the Detailed Status icon. Grid Manager displays
the Detailed Status panel. If the selected member is an HA pair, Grid Manager displays the information in two
columns, one for the active node and the other for the passive. The Detailed Status panel provides detailed
information described in the following sections.
You can modify some of the data in the table. Double click a row, and either modify the data in the field or select an
item from a drop-down list. Click Save to save the changes. Note that some fields are read only.

Appliance Status
The status icon indicates the operational status of a Grid member and a general description of its current operation.
The status icon can be one of the following:

Icon Color Meaning

Green The appliance is operating normally in a “Running” state.

Yellow The appliance is connecting or synchronizing with its Grid Master.

Red The Grid member is offline, is not licensed (that is, it does not have a DNSone license with the
Grid upgrade that permits Grid membership), is upgrading or downgrading, or is shutting
down.

The following are descriptions that may appear: Running, Offline, Error, and Warning.

Disk Usage
Grid Manager displays the percentage of the data partition of the hard disk drive that is currently in use on the
selected Grid member. It also displays whether the percentage of usage has exceeded the trigger or reset value. Note
that the trigger and reset values are user configurable. The default trigger value is 85% and reset value is 70%. The
status icon can be one of the following:

Icon Color Meaning

Green The disk usage is either below the reset value or has not yet reached the trigger value.

Yellow The disk usage is decreasing from the trigger value, but has not yet reached the reset value.

Red The disk usage has exceeded the trigger value.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1327

Monitoring the Appliance

DB Capacity Usage
Grid Manager displays the current percentage of the database in use on the selected Grid member. It also describes
whether the usage has exceeded the trigger or reset value. Note that the trigger and reset values are user
configurable. The default trigger value is 80% and reset value is 70%. For information, see Using the Capacity Report
on page 1348. The status icon can be one of the following:

Icon Color Meaning

Green The database capacity is either below the reset value or has not yet reached the trigger value.

Yellow The database capacity is decreasing from the trigger value, but has not yet reached the reset
value. When the capacity exceeds the trigger value, the icon changes from green to yellow.

LAN1/LAN2 Ports, HA Port, and MGMT Port

Grid Manager displays the IP address of the port. The status icons for these ports indicate the state of their network
connectivity.

Icon Color Meaning

Green The port is properly connected to a network. Grid Manager displays the IP address of the
network.
Red The port is not able to make a network connection.

Gray The port is disabled.

LCD
The LCD status icon indicates its operational status.

Icon Color Meaning

Green The LCD is functioning properly.

Yellow The LCD process is not running.

Memory Usage
Grid Manager displays the current percentage of system memory in use on the selected Grid member. It also
describes whether the usage has exceeded the trigger or reset value. Note that the trigger and reset values are user
configurable. The default trigger value is 90% and reset value is 80%. You can see more details about memory usage
through the CLI command: show memory. The status icon can be one of the following.

Icon Color Meaning

Red The memory usage has exceeded the trigger value.

Yellow The memory usage is decreasing from the trigger value, but has not yet reached the reset
value.
Green The memory usage is either below the reset value or has not yet reached the trigger value.

1328 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Status

Swap Usage
Grid Manager displays the current percentage of swap area in use on the selected Grid member. It also describes
whether the usage has exceeded the trigger or reset value. Note that the trigger and reset values are user
configurable. The default trigger value is 20% and reset value is 10%. The status icon can be one of the following:

Icon Color Meaning

Red The memory usage has exceeded the trigger value.

Yellow The memory usage is decreasing from the trigger value, but has not yet reached the reset
value.
Green The memory usage is either below the reset value or has not yet reached the trigger value.

FAN
The status icon indicates whether the fan is functioning properly. The corresponding description displays the fan
speed. The status icon and fan speed are displayed for Fan1, Fan2, and Fan3.

Note: vNIOS appliances on VMware do not monitor or report the fan speed.

Icon Color Meaning

Green The fan is functioning properly.

Red The fan is not running.

Power Supply
The Infoblox-4010 has redundant power supplies. The power supply icon indicates the operational status of the
power supplies.

Icon Color Meaning

Green The power supplies are functioning properly.

Red One power supply is not running. To find out which power supply failed, check the LEDs of the
power supplies.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1329

Monitoring the Appliance

NTP Synchronization
The status icon indicates the operational status of the current NTP synchronization status.

Icon Color Meaning

Green The NTP service is enabled and running properly.

Yellow The NTP service is enabled, and the appliance is synchronizing its time.

Red The NTP service is enabled, but it is not running properly or is out of synchronization.

Gray The NTP service is disabled.

Passive HA Connectivity Status

The status icon indicates the ARP connectivity status of the passive node of an HA pair. The status icon can be one of
the following:

Icon Color Meaning

Green The passive HA node is connected to the local router.

Yellow The passive HA node fails to connect to the local router.

Gray ARP is disabled on the passive node of an HA pair.

CPU Temperature
This icon is always green. The description reports the CPU temperature.

Note: vNIOS appliances on VMware do not monitor or report the CPU temperature.

System Temperature
This icon is always green. The description reports the system temperature.

Note: vNIOS appliances on VMware do not monitor or report the system temperature.

1330 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Viewing Status

CPU Usage
Grid Manager displays the current percentage of the CPU usage on the selected Grid member. The maximum is 100%.
It also describes whether the CPU usage has exceeded the trigger or reset value. Note that the trigger and reset values
are user configurable. The default trigger value is 81% and reset value is 70%. You can see more details about CPU
usage through the CLI command: show CPU. The status icon can be one of the following:

Icon Color Meaning

Green The CPU usage is either below the reset value or has not yet reached the trigger value.

Red The CPU usage has exceeded the trigger value.

RAID
For the Infoblox-4010, Grid Manager displays one of the following icons to indicate the status of each disk in the RAID
array. Next to the status icon is a summary that includes the disk number, the operational status of the disk, and the
disk type. Grid Manager also displays a RAID summary with an overall array status icon and the percentage at which
the array is currently operating.

Icon Color Meaning

Green The RAID array or the disk is functioning properly.

Yellow A new disk has been inserted and the RAID array is rebuilding.

Red The RAID array or the disk is degraded. At least one disk in the array is not functioning properly.
Grid Manager lists the disks that are online. Replace only the disks that are offline.

In the event of a disk failure, you must replace the failed disk with one that is qualified and shipped from Infoblox
and has the same disk type as the rest of the disks in the array. The appliance displays information about mismatched
disks. Infoblox-4010 uses only the IB-Type 3 disk type. All disk drives in the array must have the same disk type for
the array to function properly. You can have either IB-Type 1, IB-Type 2, or IB-Type 3, but you cannot mix both in the
array. When you have a mismatched disk in the array, you must promptly replace the disk with a replacement disk
from Infoblox to avoid operational issues.

RAID Battery
The icon indicates the status of the disk controller backup battery on the Infoblox-4010.

Icon Color Meaning

Green The battery is charged. The description indicates the estimated number of hours of charge
remaining on the battery.
Yellow The battery is charging.

Red The battery is not charged.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1331

Monitoring the Appliance

Viewing the Grid Node Tree

You can view graphical representation of the Grid, with its members represented as nodes in the tree. The
Visualization tab is disabled for new installations and this tab is displayed by default when you upgrade to NIOS 7.2.x
and later. For information about enabling this option, see Enabling Grid Visualization on page 1332. Each member
is labeled with its hostname. You can click Display Node Labels on the left panel to display or hide the labels.
By default, the Grid Master is the root node at the center of the tree. It is represented by a color-coded icon connected
to its members. You can then click a member to re-center the tree on that node. The left panel displays information
about the member that is at the center of the node tree.
In the node tree, the shape of the icons indicate the role of the member in the Grid:
• Circle: Grid Master
• Ellipse: Grid Members
The colors of the icons indicate the status of the member:
• Green: The member is online and functioning properly.
• Grey: The member has not joined the Grid.
• Red: The member has operational problems.
The connectors indicate the connection status between the Grid Master and the member.
• Blue Line: Connects the Grid Master with online Grid members
• Thick White Line: Connects the Grid Master with Grid Master Candidates
• Dashed Line Connector: Connects the Grid Master with offline Grid members
The node tree includes zooming and panning capabilities to enable quick navigation and selection among multiple
nodes. You can also hover your mouse over a node to view node information. It displays the same information as that
displayed on the left panel, when a node is at the center of the tree.
For the Grid Master:
• Grid name
• Standalone or HA
• Number of members in the Grid
• Status of each protocol running on the Grid
• Grid status
For a Member:
• Member name
• Standalone or HA
• HA Status if HA pair
• Status of each protocol running on that member

Enabling Grid Visualization

To enable Grid visualization:
1. From the Grid tab, select the Grid Manager tab -> Members tab, and then click Grid Properties -> Edit from the
Toolbar.
2. In the Grid Properties editor, click the Advanced tab.
3. Select the Show Grid Visualization check box.
4. Click Save to save the changes. The Visualization tab appears and displays a graphical representation of the Grid.
This may take a long time depending on the number of members you have in the Grid. When you deselect this
check box, you disable Grid visualization for all users.

1332 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring Services

Monitoring Services
The Grid or device status icon and the service icon indicates whether a service running on a member or an
independent appliance is functioning properly or not.

Service Status
After you enable any of the services—DHCP, DNS, TFTP, HTTP (for file distribution), FTP, NTP, bloxTools, Captive Portal,
Reporting, Discovery, Threat Protection and Cloud API—the appliance indicates their status as follows:

Icon Color Meaning

Green The service is enabled and running properly.

Yellow The service is enabled, but there may be some issues that require attention. For Threat
Protection, this could mean that one of the members is in monitor mode.
Red The service is enabled, but it is not running properly. (A red status icon can also appear
temporarily when a service is enabled and begins running, but the monitoring mechanism has
not yet notified Grid Manager.)
Gray The service is not configured or it is disabled.

Note: When you enable reporting service on the Grid and configure multi-site cluster, you can monitor the status of
all reporting members that you have configured. For information about reporting clusters, see Configuring
Indexer Cluster on page 1396

Monitoring Grid Services

The status icon of a Grid service represents the status of the most critical service in the Grid. For example, if the Grid
DHCP status icon is red, the DHCP service on one of the members in the Grid is not running properly. You can click the
DHCP service link to view the service status of all Grid members and identify which member has a service problem.
You can then decide to start or stop the service, or modify the service configuration on that member.
To monitor a Grid service:
1. From the Grid tab, select the Grid Manager tab, and then click a service link.
2. Grid Manager displays the following information in the Services tab:
— Name: The name of the member.
— Service Status: The current status of the service.
— IPv4 Address: The IPv4 address of the appliance or the VIP of an HA pair.
— IPv6 Address: The IPv6 address of the appliance or the VIP of an HA pair.
— Comments: Information about the member or service.
— Site: The site to which the member belongs. This is one of the predefined extensible attributes.
You can select available extensible attributes for display.
3. Optionally, click the Edit icon next to the service name to edit the Grid properties for the service.
or
Select a member check box, and do one of the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1333

Monitoring the Appliance

— Click the Edit icon to edit the member service configuration. Grid Manager displays the editor for the
corresponding service. For example, when you edit the DHCP service, Grid Manager displays the Member
DHCP Configuration editor.
— Click the Start icon to start the service.
— Click the Stop icon to stop the service.
Grid Manager updates the service status based on your action.

Monitoring Member Services

You can view detailed service status on a selected member. Optionally, you can start and stop a service, and edit the
service configuration.
To monitor a member service:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click the Manage
Member Services icon.
In the Manage Services panel, Grid Manager displays the following information:
— Service: The name of the service.
— Status: The current status of the service running on the member.
— Description: The description of the status. Grid Manager displays the percentage of usage for the TFTP, HTTP
(File Distribution), FTP, and bloxTools services.
2. Optionally, mouse over a service and do one of the following:
— Start/Stop Service: Click this icon to start or stop the selected service. For example, when the DNS service is
currently stopped, the appliance starts the service when you click this icon.
— Edit Service: Click this icon to edit the selected service. Grid Manager displays the corresponding editor. For
example, when you click the Edit Service icon for DNS, Grid Manager displays the Member DNS
Configuration editor.
Click the Refresh icon to update the service status.

Using a Syslog Server

Syslog is a widely used mechanism for logging system events. NIOS appliances generate syslog messages that you
can view through the Syslog viewer and download to a directory on your management station. In addition, you can
configure a NIOS appliance to send the messages to one or more external syslog servers for later analysis. Syslog
messages provide information about appliance operations and processes. NIOS appliances include syslog messages
generated by the bloxTools service. You can choose logging categories to send specific syslog messages. The prefixes
in the syslog messages are based on the logging categories you configure in the syslog. Note that syslog messages
are prefixed only when you select logging categories. For information about how to configure logging categories, see
Specifying Syslog Servers on page 1335. You can also include audit log messages and specific BIND messages
among the messages the appliance sends to the syslog server.
In addition to saving system messages to a remote syslog server, a NIOS appliance also stores the system messages
locally. When the syslog file reaches its maximum size, which is 300 MB for Infoblox appliances and VMware virtual
appliances, and 20 MB for Riverbed virtual appliances, the appliance automatically writes the file into a new file by
adding a .0 extension to the first file and incrementing subsequent file extensions by 1.
Files are compressed during the rotation process, adding a .gz extension following the numerical increment
(file.#.gz). The sequential incrementation goes from zero through nine. When the eleventh file is started, the tenth
log file (file.9.gz) is deleted, and subsequent files are renumbered accordingly. For example, the current log file
moves to file.0.gz, the previous file.0.gz moves to file.1.gz, and so on through file.9.gz. A maximum of
10 log files (0-9) are kept.
You can set syslog parameters at the Grid and member levels. At the member level, you can override Grid-level syslog
settings and enable syslog proxy.

1334 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using a Syslog Server

You can configure the appliance to back up rotated syslog files to external servers through FTP or SCP. When you do
so, the appliance forwards the rotated syslog files to the external servers that you configure. You can configure up to
10 external syslog backup servers each at the Grid and member levels. You can also override the Grid-level server
configuration at the member level. For information about configuring syslog backup servers, see Configuring Syslog
Backup Servers on page 1339.
This section includes the following topics:
• Specifying Syslog Servers on page 1335
• Configuring Syslog Backup Servers on page 1339
• Configuring Syslog for Grid Members on page 1339
• Setting DNS Logging Categories on page 1340
• Viewing the Syslog on page 1341
• Searching in the Syslog on page 1343
• Downloading the Audit Log on page 1346

Specifying Syslog Servers

To configure a NIOS appliance to send messages to a syslog server:
1. From the Grid tab, select the Grid Manager tab -> Members tab, and then click Grid Properties -> Edit from the
Toolbar.
2. In the Grid Properties editor, select the Monitoring tab, and then complete the following:
Syslog
In addition to storing the syslog on a Grid member, you can configure the Grid to send the log to an external
syslog server.
— Syslog size (MB): Specify the maximum size for a syslog file. Enter a value between 10 and 300. The default
is 300.
When the syslog file reaches the size you enter here, the appliance automatically writes the file into a new
file by adding a .0 extension to the first file and incrementing subsequent file extensions by 1.
— Log to External Syslog Servers: Select this to enable the appliance to send messages to a specified syslog
server. Grid Manager displays the current syslog servers in the table. To define a new syslog server, click the
Add icon and complete the following:
— Address: Enter the IP address of the syslog server. Entries may be an IPv4 or IPv6 address.
— Transport: From the drop-down list, select whether the appliance uses Secure TCP, TCP or UDP to
connect to the external syslog server.
— Server Certificate: Click Select to upload a self-signed or a CA-signed server certificate. In the Upload
dialog, click Select and navigate to the certificate file, and then click Upload. Note that this is valid only
for Secure TCP transport.
— Interface: From the drop-down list, select the interface through which the appliance sends syslog
messages to the syslog server.
• Any: The appliance chooses any port that is available for sending syslog messages.
• LAN: The appliance uses the LAN1 port to send syslog messages.
• MGMT: The appliance uses the MGMT port if it has been configured. Otherwise, it uses the LAN1
port.
— Source: From the drop-down list, select which syslog messages the appliance sends to the external
syslog server:
• Any: The appliance sends both internal and external syslog messages.
• Internal: The appliance sends syslog messages that it generates.
• External: The appliance sends syslog messages that it receives from other devices, such as syslog
servers and routers.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1335

Monitoring the Appliance

— Node ID: Specify the host or node identification string that identifies the appliance from which syslog
messages are originated. This string appears in the header message of the syslog packet. Select one of
the following:
• LAN: Use the LAN1 IP address of the appliance. For an HA pair, this is the LAN1 address of the
active or passive node. This is the default.
• Host Name: Use the host name of the appliance in FQDN format.
• IP and Host Name: Use both the FQDN and the IP address of the appliance. The IP address can be
the LAN1 or MGMT IP address depending on whether the MGMT port has been configured. Note
that if the MGMT port is not configured, the LAN1 IP address is used. Table 37.1 on page 1338
provides more information about which IP address is used in the syslog configuration file when the
MGMT port has been configured.
• MGMT: Use the MGMT IP address, if the port has been configured. If the MGMT port is not
configured, the LAN1 IP address is used. This can be an IPv4 or IPv6 address.
— Port: Enter the destination port number. The default is 514 for TCP and UDP. For Secure TCP, the default
port is 6514.
— Severity: Choose a severity filter from the drop-down list. When you choose a severity level, the
appliance sends log messages with the selected level and the levels above it. The severity levels range
from the lowest, debug, to the highest, emerg. For example, if you choose debug, the appliance sends
all syslog messages to the server. If you choose err, the appliance sends messages with severity levels
err, crit, alert, and emerg.
• emerg: Panic or emergency conditions. The system may be unusable.
• alert: Alerts, such as NTP service failures, that require immediate actions.
• crit: Critical conditions, such as hardware failures.
• err: Error messages, such as client update failures and duplicate leases.
• warning: Warning messages, such as missing keepalive options in a server configuration.
• notice: Informational messages regarding routine system events, such as “starting BIND”.
• info: Informational messages, such as DHCPACK messages and discovery status.
• debug: Messages that contain information for debugging purposes, such as changes in the latency
timer settings and AD authentication failures for specific users.
— Logging Category: Select one of the following logging categories:
— Send all: Select this to log all syslog messages, irrespective of categories to which it belongs. When you
select this option, the appliance logs syslog messages for all the events, including all DNS and Infoblox
External DNS Security related events. However, the syslog messages are not prefixed when you select
this option.
— Send selected categories: Select this to configure logging categories from the list of available logging
categories. Use the arrows to move logging categories from the Available table to the Selected table
and vice versa. The appliance sends syslog messages for the categories that are in the Selected table.
When you select this option, you must add at least one logging category. The syslog messages are
prefixed with a category name to which it belongs. Also, the RPZ events logged in the syslog messages
uses specific prefixes for the selected categories. Note that the syslog messages are prefixed when you
set logging categories for at least one external syslog server, even if you set other external syslog
servers as Send All. For information about syslog prefixes, see Syslog Message Prefixes on page 1337.

Note: The syslog categories you specify here is different from that of logging categories specified in the Logging
tab in the Grid DNS Properties or Member DNS Properties editor. The external server preserves contents
of the selected categories even when selection is changed from Send all to Send selected categories and
vice versa.

• Click Add to add the external syslog server information.

1336 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using a Syslog Server

— Copy Audit Log Messages to Syslog: Select this for the appliance to include audit log messages it sends to
the syslog server. This function can be helpful for monitoring administrative activities on multiple
appliances from a central location.
— Syslog Facility: This is enabled when you select Copy audit log messages to syslog. Select the facility
that determines the processes and daemons from which the log messages are generated.
3. Save the configuration and click Restart if it appears at the top of the screen.

Syslog Message Prefixes

You can configure the syslog external backup servers to send (archive) syslog files to different destinations by their
logging categories. This allows you to split syslog files based on the service and efficiently perform troubleshooting.
For example, you can archive all DNS related logs on Server 1, and all DHCP related logs on Server 2. For information
about how to configure an external syslog backup server, see Specifying Syslog Servers on page 1335.
When you select the Send selected categories option, the syslog messages are prefixed with a category name to
which it belongs.

Note: When you set Send all in the Logging Category, the appliance logs syslog messages for all the events and they
are not prefixed. The syslog messages are prefixed even if one external syslog server is set with the Send
selected categories option.

Following are the prefixes used for different logging categories:

• DNS Logging Categories: All DNS related messages use the following prefixes: client, config, database,
dnssec, general, lame_servers, network, notify, queries, query_rewrite, resolver, responses, rpz,
security, update, update_security, xfer_in, and xfer_out. 
Sample syslog message for queries: 
2014-10-27T08:15:49+00:00 daemon ib-10-35-117-12.infoblox.com named[1923]: info
queries: client 10.35.117.12#55190 (1.0.0.127.in-addr.arpa): query:
1.0.0.127.in-addr.arpa IN PTR +E (10.35.117.12)
Sample syslog message for xfer-out:
2014-10-10T06:44:09+00:00 daemon infoblox.localdomain named[17630]: info xfer-out:
client 10.120.20.157#58275 (zone.com): transfer of 'zone.com/IN': AXFR started
• ADP: All Infoblox External DNS Security related messages use prefix adp.

Note: There is no prefix for RPZ syslog messages that does not belong to the DNS or ADP category.

• DHCP: All DHCP related messages use the following prefixes: dhcpd, omshell, dhcrelay, and dhclient.
Sample syslog message for dhcp:
Sep 4 09:23:44 10.34.6.28 dhcpd[20310]: DHCPACK on 70.1.20.250 to fc:5c:fc:5f:10:85 via
eth1 relay 10.120.20.66 lease-duration 600
• DTC: All DTC related messages use the following prefixes: idns_healthd and idnsd.
Sample syslog message for idns_healthd:
Sep 3 12:12:35 10.34.6.30 idns_healthd[1220]: resource health status [Monitor 'icmp'
(ICMP, port 0) checked server 's1' (IP 10.34.6.23), status: IPv4=ONLINE]
• Cloud: All cloud related messages use prefix cloud_api.
Sample syslog message for cloud_api:
Sep 4 10:53:30 10.34.6.32 cloud_api[5354]: [admin]: Login_Allowed - -
to=Serial\040Console apparently_via=Remote ip=10.120.20.66 auth=Local
group=.admin-group
• NTP: All NTP related messages use prefix ntpd.
Sample syslog message for NTP:
Sep 28 06:57:21 10.35.116.7 ntpd[12186]: precision = 0.053 usec

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1337

Monitoring the Appliance

Sep 28 06:57:21 10.35.116.7 ntpd[12186]: Listening on interface #0 wildcard, 0.0.0.0#123

Disabled
• File Distribution: All File Distribution related messages use the following prefixes: ftpd and tftp.
Sample syslog message for TFTP:
Sep 3 13:03:09 10.34.6.30 monitor[23623]: Type: TFTP, State: Red, Event: A TFTPD daemon
failure has occurred.
• Authentication: All Authentication related messages use the following prefixes: auth, authpriv, AD, and
radiusd.
Sample syslog message for RADIUS authentication:
Sep 28 10:09:55 10.35.116.4 httpd: 2015-09-28 10:09:55.912Z [user1]: Login_Allowed - -
to=AdminConnector ip=10.120.253.227 auth=RADIUS group=admin-group apparently_via=GUI
• Microsoft Integration: All Microsoft Integration related messages use the following prefixes: dns_server,
connect_status, dns_zone, dhcp_server, dhcp_leases, clear_lease, ad_site, and ad_users.
Sample syslog message for microsoft integration:
dns_server:
Sep 7 09:46:17 10.34.22.20 mssyncd[22315]: dns_server address 10.102.30.157 : Conflict
in property Forwarders: NIOS value (property=<NULL IP array>) and Microsoft value
(property={10.0.2.35, 10.0.2.60}). Resolved by using the Microsoft value
dhcp_server:
Sep 7 10:08:48 10.34.22.20 mssyncd[22316]: dhcp_server address 10.102.30.157 : Couldn't
open RPC interface <MS-WKST>: an instance of a named pipe cannot be found in the listening
state
Sep 7 10:08:48 10.34.22.20 mssyncd[22317]: dns_server address 10.102.30.157 : Opened
RPC interface <MS-WKST> as user 'ad-15\frtest'

IP address Used in the Syslog Configuration File

The following table describes which IP address the appliance uses as the node ID in the syslog configuration file,
provided that the MGMT port has been configured. If the MGMT port is not configured, the LAN1 IP address is always
used regardless of the configuration.

Table 37.1 IP address Used in Syslog Config File when MGMT Port is Configured

Interface Node ID IP used in syslog configuration file

Any MGMT MGMT IP address
Any IP and Host Name MGMT IP address
MGMT MGMT MGMT IP address
MGMT IP and Host Name MGMT IP address
LAN MGMT LAN1 IP address
LAN IP and Host Name LAN1 IP address

1338 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using a Syslog Server

Configuring Syslog Backup Servers

You can configure external syslog backup servers to forward rotated syslog files. You can configure up to 10 external
syslog backup servers.
To configure external backup servers:
1. Grid: From the Grid tab -> Grid Manager tab, expand the Toolbar and click Grid Properties -> Edit.
Member: From the Grid tab -> Grid Manager tab, click the Members tab, select the member check box, and click
the Edit icon.
2. Grid: In the Grid Properties editor, select the Syslog Backup tab.
Member: In the Grid Member Properties editor, select the Syslog Backup tab and then click Override to override
the Grid-level settings.
Complete the following to modify backup server settings:
— Address: Enter the IP address of the external backup server. You are not allowed to configure more than one
server using the same IP address at the same level (Grid or member). However, you can use the same server
IP address at different levels (Grid or member). Note that you cannot modify the IP address for the
overridden server.
— Protocol: Select SCP or FTP from the drop-down list.
— Port: Enter the destination port number. The default port is 20 for FTP and 22 for SCP.
— Path: Enter the directory path for the syslog file.
— Username: Enter the username of your FTP or SCP account.
— Password: Enter the password of your FTP or SCP account. If you do not change the password of the
overridden server, then make sure that you use the same password specified at the Grid level.
— Enabled: Select this check box to enable the FTP or SCP server. The appliance forwards the rotated syslog
files to the external servers that you configure only after you select this check box. Clear the check box to
disable the server.
3. Click Save and Close.

Configuring Syslog for Grid Members

You can override Grid-level syslog settings and enable syslog proxy for individual members. When you enable syslog
proxy, the member receives syslog messages from specified devices, such as syslog servers and routers, and then
forwards these messages to an external syslog server. You can also enable appliances to use TCP for sending syslog
messages. Using TCP is more reliable than using UDP; this reliability is important for security, accounting, and
auditing messages sent through the syslog. Note that you cannot enable syslog proxy for Grid members, if they are
configured on a Grid Master.
To configure syslog parameters for a member:
1. From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click the Edit icon.
2. In the Grid Member Properties editor, select the Monitoring tab -> Basic tab, click Override in the Syslog section,
and then complete the fields as described in Specifying Syslog Servers on page 1335.
In addition to storing the system log on a Grid member, you can configure a member to send the log to a syslog
server.
3. Select the Advanced tab and complete the following:
— Enable syslog proxy: Select this to enable the appliance to receive syslog messages from other devices,
such as syslog servers and routers, and then forward these messages to an external syslog server.
— Enable listening on TCP: Select this if the appliance uses TCP to receive messages from other devices.
Enter the number of the port through which the appliance receives syslog messages from other
devices.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1339

Monitoring the Appliance

— Enable listening on UDP: Select this if the appliance uses UDP to receive messages from other devices.
Enter the number of the port through which the appliance receives syslog messages from other
devices.
— Proxy Access Control: Select one of the following to configure access control when receiving syslog
messages from specific syslog servers or routers:
— None: Select this if you do not want to configure syslog proxy. When you select this option, none of the
devices can send syslog messages to the appliance. This is selected by default.
— Named ACL: Select this and click Select Named ACL to select a named ACL that contains only IPv4
addresses and networks. This does not support TSIG key based ACEs. When you select this, the
appliance permits clients that have Allow permission in the named ACL to allow syslog messages from
specific syslog servers or routers. You can click Clear to remove the selected named ACL.
— Set of ACLs: Select this to configure individual access control entries (ACEs). Click the Add icon and
select one of the following from the drop-down list. Grid Manager adds a row to the table.
• IPv4 Address or IPv6 Address: Select this to add an IPv4 or IPv6 address entry. Click the Value field
and enter the address. The default permission is Allow, which means that the appliance allows
access to and from this device. You can change this to Deny to block access.
• IPv4 Network or IPv6 Network: Select this to add an IPv4 or Ipv6 network entry. Click the Value field
and enter the network. The default permission is Allow, which means that the appliance allows
syslog messages sent by this network. You can change this to Deny to block access.
• Any Address/Network: Select this to allow or deny access to all IPv4 and IPv6 addresses and
networks. The default permission is Allow, which means that the appliance allows syslog
messages sent by all addresses and networks. You can change this to Deny to block access.
After you have added access control entries, you can do the following:
• Select the ACEs that you want to group and put into a named ACL. Click the Create new named ACL
icon and enter a name in the Convert to Named ACL dialog box.
• Reorder the list of ACEs using the up and down arrows next to the table.
• Select an IPv4 network and click the Edit icon to modify the entry.
• Select an ACE and click the Delete icon to delete the entry. You can select multiple ACEs for
deletion.
4. Save the configuration and click Restart if it appears at the top of the screen.

Setting DNS Logging Categories

You can specify logging categories you want the syslog to capture. Furthermore, you can filter these messages by
severity at the Grid and member levels. For information about severity types, see Specifying Syslog Servers on page
1335.
Note that logging DNS queries and responses in the syslog will significantly affect system performance. Before you
enable query and response logging, ensure that your system has sufficient CPU capacity. Alternatively, if you have a
Reporting license, you can capture DNS query and response information and forward it to an external server. For more
information about this feature, see Configuring the Capture of DNS Queries and Responses on page 1398.
When you enable DNS query or response logging, the NIOS appliance records DNS queries and DNS responses locally
and then upload the files through FTP/SCP. When you use FTP/SCP, you must ensure that the respective server
connection is active and has adequate bandwidth to avoid files getting piled up on the local hard drive of the
appliance. When the connection to the FTP/SCP server is down or if the upload rate does not match the rate at which
the data is produced, the NIOS appliance keeps the captured files until the next successful FTP/SCP connection up
to a certain size depending on the platform, and starts deleting the oldest files. Even though the NIOS appliance
uploads old files once the connection is resumed, and the upload rate matches the rate at which the data is
produced, the NIOS appliance has an additional burden of processing both old and new data. In order to avoid this
delay, Infoblox recommends that you verify the FTP/SCP connection before enabling DNS query and response
logging.
To specify logging categories:

1340 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using a Syslog Server

1. From the Data Management tab, select the DNS tab, and then click Grid DNS Properties from the Toolbar.
or
From the Data Management tab, select the DNS tab -> Members tab -> Grid_member check box, and then click
the Edit icon.
2. In the Grid DNS Properties or Member DNS Properties editor, click Toggle Expert Mode if the editor is in the basic
mode, select the Logging tab, and then complete the following:
— Logging Facility: Select a facility from the drop-down list. This is the location on the syslog server to which
you want to sort the DNS logging messages.
— Logging Category: Select one or more of these log categories:
— general: Records the BIND messages that are not specifically classified.
— client: Enables the logging of messages related to query processing, but not the queries themselves.
Examples of messages include exceeding recursive client quota, and other errors related to recursive
clients, blacklist and NXDOMAIN interception, query name rewrite, and others.
— config: Records the configuration file parsing messages.
— database: Records BIND’s internal database processes.
— dnssec: Records the DNSSEC-signed responses.
— lame servers: Records bad delegation instances.
— network: Records the network operation messages.
— notify: Records the asynchronous zone change notification messages.
— queries: Records the DNS queries. Note that enabling the logging of queries and responses will
significantly affect system performance. Ensure that your system has sufficient CPU capacity before you
enable DNS query logging.
— rate-limit: Logs RRL (Response Rate Limiting) events. You must enable RRL in order for the appliance to
log RRL events to this logging category.
— resolver: Logs messages related to outgoing queries from the 'named' process, when it is acting as a
resolver on behalf of clients.
— responses: Records DNS responses. Note that enabling the logging of queries and responses will
significantly affect system performance. Ensure that your system has sufficient CPU capacity before you
enable DNS response logging.
— rpz: Records log messages when responses are modified through RPZs or for which explicit passthrus
were invoked in the RPZs. This check box is not selected by default.
— security: Logs miscellaneous messages that are related to security, such as denial or approval (mostly
denial) of certain operations.
— transfer-in: Records zone transfer messages from the remote name servers to the appliance.
— transfer-out: Records zone transfer messages from the NIOS appliance to remote name servers.
— update: Records the dynamic update instances.
— update-security: Records the security updates.
— DTC load balancing: Records information about which client is directed to which server.
— DTC health monitors: Records any changes to the health state of a monitored server.
3. Save the configuration and click Restart if it appears at the top of the screen.

Viewing the Syslog

1. From the Administration tab, select the Logs tab -> Syslog tab.
2. From the drop-down list at the upper right corner, select the Grid member on which you want to view the syslog.
3. Optionally, use the filters to narrow down the system messages you want to view. Click Show Filters to enable the
filters. Configure the filter criteria, and then click Apply.
Based on your filter criteria (if any), Grid Manager displays the following in the Syslog viewer:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1341

Monitoring the Appliance

— : The Action icon column is displayed only when you have installed the RPZ license. Click this to view
threat details in the RPZ Threat Details dialog box. For information, see Viewing the RPZ Threat Details on
page 1342.
— Timestamp: The date, time, and time zone of the log message. The time zone is the time zone configured on
the member.
— Facility: The location on the syslog server that determines the processes and daemons from which the log
messages are generated.
— Level: The severity of the message. This can be ALERT, CRITICAL, DEBUG, EMERGENCY, ERROR, INFO, NOTICE,
or WARNING.
— Server: The name of the server that logs this message, plus the process ID.
— Message: Detailed information about the task performed. For Cloud Network Automation, this contains
comma separated values of the admin, source, action, object, object type and message values. Note that
source is defined only if the cloud API request was proxied by the Cloud Platform Appliance. The format for
this field is proxied from:host,IP where host and IP are the host name and IP address of the proxy.

Note: If the selected member is an HA pair, Grid Manager displays the syslog in two tabs—Active and Passive.
Click the corresponding tab to view the syslog for each node.

Viewing the RPZ Threat Details

Make sure that DNS resolution is enabled and running properly on the member to view threat details. To view threat
details for the RPZ zones being queried, complete the following:
1. From the Administration tab, select the Logs tab -> Syslog tab.
2. Click the Action icon and select View Threat Context to open the RPZ Threat Details dialog. The View Threat
Context option is disabled if there is no RPZ rule.
— RPZ Rule: Displays the name of the RPZ rule.
— First Identified: The date and timestamp of the first occasion that the threat was detected.
— Short Description: The brief description of the threat.
— Description: The description of the RPZ rule.

Note: The RPZ Threat Details dialog box may display Unknown if threat is unknown or Unavailable if threat is
known and threat details are not available.

3. Click the Close icon to close the RPZ Threat Details dialog.

You can also do the following in the Syslog viewer:

• Toggle between the single line view and the multi-line view for display.
• Navigate to the next or last page of the file using the paging buttons.
• Refresh the syslog output with newly logged messages.
• Click the Follow icon to have the appliance automatically refresh the log every five seconds.
• Clear the contents of the syslog.
• Use filters and the Go To function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.

1342 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Using a Syslog Server

• To filter Microsoft synchronization related events, click Show Filter, select Server from the first drop-down list,
and select MS_Server from the drop-down list in the value field. This filter displays entries that begin with the
prefix ms. To view values that belong to a specific Microsoft server, you must specify either the name or IP
address of a given Microsoft server in the Message field. When you filter the syslog for a specific Grid member, it
displays the log entries of Microsoft servers that are assigned to the respective Grid member when the entries
are logged.
• Print the report or export it in CSV format.
• Bookmark the syslog page.

Searching in the Syslog

Instead of paging through the syslog to locate messages, you can have the appliance search for syslog messages with
certain text strings. To search for specific messages:
• Enter a search value in the search field below the filters, and then click the Search icon.
The appliance searches through the syslog and highlights the search value in the viewer. You can use the arrow
keys next to the Search icon to locate the previous or next message that contains the search value.

Downloading the Syslog File

You can download the syslog file to a specified directory, if you want to analyze it later.
1. From the Administration tab, select the Logs tab -> Syslog tab, and then click the Download icon.
2. Navigate to a directory where you want to save the file, optionally change the file name (the default names are
node_1_sysLog.tar.gz and node_2_sysLog.tar.gz ), and then click OK. If you want to download multiple syslog
files to the same location, rename each downloaded file before downloading the next.

Note: If your browser has a pop-up blocker enabled, you must turn off the pop-up blocker or configure your
browser to allow pop-ups for downloading files.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1343

Monitoring the Appliance

Monitoring Tools
You can use the audit log, the replication status, the traffic capture tool, and the capacity report in a Grid or HA pair
to monitor administrative activities and capture traffic for diagnostic purposes. You can also use CLI commands to
monitor certain DNS transactions.
This section includes the following topics:
• Using the Audit Log
• Viewing the Replication Status on page 1346
• Using the Traffic Capture Tool on page 1347
• Using the Capacity Report on page 1348
• Participating in the Customer Experience Improvement Program on page 1349
• Monitoring DNS Transactions on page 1350
• Viewing DNS Alert Indicator Status on page 1352
• Configuring DNS Alert Thresholds on page 1352
In addition, if Grid members manage Microsoft servers, Grid Manager creates a synchronization log file for each
managed Microsoft server. For information, see Viewing Synchronization Logs on page 1281.

Using the Audit Log

The audit log contains a record of all Infoblox administrative activities. It provides the following detailed information:
• Timestamp of the change. If you have different admin accounts with different time zone settings, the appliance
uses the time zone of the admin account that you use to log in to the appliance to display the date and
timestamp.
• Administrator name
• Changed object name
• New value of the object. If you change multiple properties of an object, the audit log lists all changes in a
comma-separated log entry. You can also search the audit log to find the new value of an object.
The appliance logs the following successful operations:
• Logins to Grid Manager and the API.
• Logout events, including when users log out by clicking the Logout button, when the Grid Manager GUI times
out, and when users are logged out due to an error.
• Write operations such as the addition, modification, and deletion of objects.
• System management operations such as service restarts and appliance reboots.
• Scheduled tasks such as adding an A record or modifying a fixed address.

Enabling Audit Log Rolling

When the audit log reaches its maximum size, which is 100 MB, the appliance automatically writes the file into a new
file by adding a .0 extension to the first file and incrementing subsequent file extensions by 1. Files are compressed
during the rotation process, adding a .gz extension following the numerical increment (file.#.gz). The sequential
incrementation goes from zero through nine. When the eleventh file is started, the tenth log file (file.9.gz) is
deleted, and subsequent files are renumbered accordingly. For example, the current log file moves to file.0.gz,
the previous file.0.gz moves to file.1.gz, and so on through file.9.gz. A maximum of 10 log files (0-9) are
kept. To list the audit log files and their sizes, log in to the Infoblox CLI and execute the show logfiles command.
To enable audit log rolling:
1. From the Grid tab, select the Grid Manager tab -> Members tab, and then click Grid Properties -> Edit from the
Toolbar.

1344 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring Tools

2. In the Grid Properties editor, select the Security tab, and then select Enable Audit Log Rolling.

Specifying the Audit Log Type

Select either the Detailed (default) or Brief audit log type as follows:
1. From the Grid tab, select the Grid Manager tab -> Members tab, and then click Grid Properties -> Edit from the
Toolbar.
2. In the Grid Properties editor, select the General tab, and then select one of the following:
— Detailed: This is the default type. When you select this, Grid Manager displays detailed information on all
administrative changes such as the timestamp of the change, administrator name, changed object name,
and the new values of all properties in the logged message.
— Brief: Provides information on administrative changes such as the changed object name and action in the
log message. The logged message does not show timestamp or admin name.

Viewing the Audit Log

To view an audit log:
1. From the Administration tab, select the Logs tab -> Audit Log tab.
2. Optionally, use the filters to narrow down the audit log messages you want to view. Click Show Filters to enable
the filters. Configure the filter criteria, and then click Apply.
Based on your filter criteria (if any), Grid Manager displays the following in the Audit Log viewer:
— Timestamp: The date, time, and time zone the task was performed. The time zone is the time zone
configured on the member.
— Admin: The admin user who performed the task.

Note: The admin user displayed as $admin group name$ represents an internal user. You can create a admin
filter with “matches expression” equals ^[^$] to filter out internal users.

— Action: The action performed. This can be CALLED, CREATED, DELETED, LOGIN_ALLOWED, LOGIN_DENINED,
MESSAGE, and MODIFIED.
— Object Type: The object type of the object involved in this task. This field is not displayed by default. You
can select this for display.
— Object Name: The name of the object involved in this task.
— Execution Status: The execution status of the task. Possible values are Executed, Normal, Pending Approval
and Scheduled.
— Message: Detailed information about the performed task.
You can also do the following in the log viewer:
• Toggle between the single line view and the multi-line view for display.
• Navigate to the next or last page of the file using the paging buttons.
• Refresh the audit log view.
• Click the Follow icon to have the appliance automatically refresh the log every five seconds.
• Download the log.
• Clear the contents of the audit log.
• Use filters and the Go To function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Export or print the content of the log.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1345

Monitoring the Appliance

Searching in the Audit Log

Instead of paging through the audit log file to locate messages, you can have the appliance search for messages with
certain text strings.
To search for specific messages:
• Enter a search value in the search field below the filters, and then click the Search icon.
The appliance searches through the audit log file and highlights the search value in the viewer. You can use the
arrow keys next to the Search icon to locate the previous or next message that contains the search value.

Downloading the Audit Log

You can download the audit log file to a specified directory, if you want to analyze it later.
To download an audit log file:
1. From the Administration tab, select the Logs tab -> Audit Log tab, and then click the Download icon.
2. Navigate to a directory where you want to save the file, optionally change the file name (the default name is
auditLog.tar.gz), and then click OK. If you want to download multiple audit log files to the same location, rename
each downloaded file before downloading the next.

Note: If your browser has a pop-up blocker enabled, you must turn off the pop-up blocker or configure your
browser to allow pop-ups for downloading files.

Viewing the Replication Status

The Replication Status panel reports the status of the database replication between Grid members and Grid Master,
and between the two nodes in an independent HA pair. You can use this information to check the health of the Grid
and HA pair activity.
To view the current replication status, from the Grid tab, select the Grid Manager tab -> Members tab, and then click
Toggle Replication Status View.
Grid Manager can display the following replication information for each member:
• Name: The FQDN (fully qualified domain name) of the appliance.
• Send Queue: The size of the queue from the Grid Master to the Grid member.
• Last Send: The timestamp of the last replication information sent by the Grid Master.
• Receive Queue: The size of the queue from the Grid member to the Grid Master.
• Last Receive: The timestamp of the last replication information sent received by the Grid Master.
• Member Replication Status: The replication status between the member and the Grid Master. Grid Manager
displays the status in green when the status is fine or red when the member is offline.
• HA Replication Status: The HA replication status between the active and passive nodes. The status is at the
member level, not at the node level. Grid Manager displays the status in red when one of the nodes is offline.
• Status: The current operational status of the appliance. The status can be one of the following:
— Green: The appliance is operating normally in a “Running” state.
— Yellow: The appliance is connecting or synchronizing with its Grid Master.
— Red: The Grid member is offline, is not licensed (that is, it does not have a DNSone license with the Grid
upgrade that permits Grid membership), is upgrading or downgrading, or is shutting down.
• IPv4 Address: The IPv4 address of the appliance or the VIP of an HA pair.
• IPv6 Address: The IPv6 address of the appliance or the VIP of an HA pair.
• Identify: This field appears only if your appliance has the unit identification button. This can be On or Off. When
you identify the appliance by pressing the UID button on the appliance or through the GUI or CLI command, this
field displays On. Otherwise, this is Off.

1346 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring Tools

• DHCP, DNS, TFTP, HTTP,FTP, NTP, bloxTools, Captive Portal, DNS Accelerator Usage, Discovery, Reporting: The
current status of the service. The status can be one of the following:
— Green: The service is enabled and running properly.
— Yellow: The service is enabled, but there may be some issues that require attention.
— Red: The service is enabled, but it is not running properly. A red status icon can also appear temporarily
when a service is enabled and begins running, but the monitoring mechanism has not yet notified the
Infoblox GUI.
— Gray: The service is not configured or it is disabled.
• Hardware Type: The hardware type of the appliance, such as IB-1400.
• Serial Number: The serial number of the appliance.
• DB Utilization: The percentage of the database that is currently in use.
• Comment: Information about the appliance.
• Site: The location to which the member belongs. This is one of the predefined extensible attributes.
• HA: Indicates whether the member is an HA pair. If the member is an HA pair, Grid Manager displays the status
of the HA pair.
• Hardware Model: The hardware model of the appliance.
You can do the following:
• Use filters and the Go To function to narrow down the list. With the autocomplete feature, you can just enter the
first few characters of an object name in the Go to field and select the object from the possible matches.
• Create a quick filter to save frequently used filter criteria. For information, see Using Quick Filters on page 77.
• Modify some of the data in the table. Double click a row of data, and either edit the data in the field or select an
item from a drop-down list. Note that some fields are read-only. For more information about this feature, see
Modifying Data in Tables on page 70.
• Edit the properties of a member.
— Click the check box beside a member, and then click the Edit icon.
• Delete a member.
— Click the check box beside a member, and then click the Delete icon.
• Export or print the list.

Using the Traffic Capture Tool

You can capture the traffic on one or all of the ports on a NIOS appliance, and then view it using a third-party network
protocol analyzer application, such as the Wireshark – Network Protocol Analyzer™.
The NIOS appliance saves all the traffic it captures in a .cap file and compresses it into a .tar.gz file. Your management
system must have a utility that can extract the .tar file from the .gzip file, and an application that can read the .cap
(capture) file format.

Note: This feature captures traffic of all the direct responses received from the cache accelerator on the IB-4030.

This section explains the process of capturing traffic, and how to download the traffic capture file to your
management system. After that, you can extract the traffic capture file and view it with a third-party traffic analyzer
application. The traffic capture file is shared between NIOS admin users.

Note: The NIOS appliance always saves a traffic capture file as tcpdumpLog.tar.gz. If you want to download multiple
traffic capture files to the same location, rename each downloaded file before downloading the next.

To capture traffic on a member:

1. From the Grid tab, select the Grid Manager tab -> Members tab, and then click Traffic Capture from the Toolbar.
2. In the Traffic Capture dialog box, complete the following:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1347

Monitoring the Appliance

— Member: Grid Manager displays the selected member on which you want to capture traffic. If no member is
displayed or if you want to specify a different member, click Select. When there are multiple members, Grid
Manager displays the Member Selector dialog box from which you can select one. You cannot capture
traffic on an offline member.
— Interface: Select the port on which you want to capture traffic. Note that if you enabled the LAN2 failover
feature, the LAN and LAN2 ports generate the same output. (For information about the LAN2 failover
feature, see About Port Redundancy on page 457.)
— LAN: Select this to capture all the traffic the LAN port receives and transmits.
— MGMT: Select this to capture all the traffic the MGMT port receives and transmits.
— LAN2: Select to capture all the traffic the LAN2 port (if enabled) receives and transmits.
— All: Select this to capture the traffic addressed to all ports. Note that the NIOS appliance only captures
traffic that is addressed to it.
— LANx nnnn: If you have configured VLANs on the LAN1 or LAN2 port, the appliance displays the VLANs
in the format LANx nnnn, where x represents the port number and nnnn represents the associated
VLAN ID.

Note: Riverbed virtual appliances support capturing traffic only on the LAN port.

— Seconds to run: Specify the number of seconds you want the traffic capture tool to run.
3. Capture Control: Click the Start icon to start the capture. A warning message appears indicating that this report
will overwrite the existing file. Click Yes. You can click the Stop icon to stop the capture after you start it.
4. Uncompressed Capture File Size: Click Download to download the captured traffic after the capture stops and
then save the file. You can rename the file if you want. You cannot download the traffic report when the tool is
running. Grid Manager updates the size of the report when the capture tool is running.
5. Use terminal window commands (Linux) or a software application (such as StuffIt™ or WinZip™) to extract the
contents of the .tar.gz file.
6. When you see the traffic.cap file in the directory where you extract the .tar.gz file, open it with a third-party
network protocol analyzer application.

Using the Capacity Report

You can view the capacity usage and object type information of an appliance in a capacity report. The capacity report
displays capacity and object type information of an independent appliance, a Grid Master, or a Grid member. For an
HA pair, the report displays information on the active node.
The top half of the panel displays a capacity summary, and the bottom half displays the object types the appliance
supports and the total counts for each object type.
To view a capacity report:
• From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click Capacity
Report from the Toolbar.
The capacity summary contains the following information:
• Name: The name of the appliance.
• Role: The role of the appliance. The value can be Grid Master, Grid Master Candidate, Grid Member, or
Standalone.
• Hardware Type: The type of hardware. For an HA pair, the report displays the hardware type for both the active
and passive nodes.
• Object Capacity: The maximum number of objects the appliance can support.
• Total Objects: The total number of objects currently in the database.
• % Capacity Used: The percentage of the capacity in use.
• Reporting Volume Sent Today: The percentage of the data transmission to the reporting server.

1348 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring Tools

The capacity report filters object types you can manage through the appliance. You can configure the object types you
want to see in the following table by completing the following in the Minimum Object Total filter:
• Minimum Object Total: Enter the minimum number of objects within an object type of which Grid Manager
displays. In the Object Type table, Grid Manager displays only the object types that contain at least the specified
number of objects you enter in this field.
The capacity report displays the following information:
• Object Type: The type of objects. For example, DHCP Lease, Admin Group, or PTR Record. For objects that are
only used for internal system operations, the report groups and shows them under Other.
• Total: The total number of objects for the specific object type.
You can print the object type information or export it to a CSV file.

Participating in the Customer Experience Improvement Program

Administrators with superuser accounts can configure a Grid Master or an independent appliance to email reports
monthly and after each upgrade to Infoblox Technical Support and other specified recipients. The reports are also
included in support bundles that you download.
The reports provide status and event information about the Grid or independent appliance and its services. The
report is an XML document that includes the following information:
• The phone home feature version.
• The report type, such as periodic and test.
• The time of the report.
• The Infoblox Support ID that was assigned to the account.
• Information about the Grid, such as its NIOS version, name, VIP, Grid Master hostname, LAN IP, and the number
of Grid members and appliances in the Grid.
• The upgrade history of the Grid.
• Information about each Grid member, such as the hostname, IP address, status, role (such as standalone,
master), and if the member is an HA pair. If the member is a peer in a DHCP failover association, the report also
includes the DHCP failover status.
• Hardware information, such as the hardware type, serial number, HA status, and uptime.
• Information about the interfaces, such as the interface name and IP addresses.
• Resource usage information, such as CPU and system temperature, and CPU, database, disk, and memory
usage.
Note that if the appliance is configured to send email notifications to an SMTP relay server, as described in Notifying
Administrators on page 232, the appliance sends the phone home reports to the relay server as well.
To configure the Grid Master to email status reports:
1. From the Grid tab, select the Grid Manager tab -> Members tab.
2. Expand the Toolbar and click Grid Properties -> Edit.
3. In the Grid Properties editor, select the Customer Improvement tab, and then complete the following:
— Participate in Infoblox Customer Experience Improvement Program: Select the check box to send product
usage data to Infoblox on a periodic basis. Infoblox uses this data to improve product functionality.
— Support ID: Enter the Infoblox Support ID that was assigned to your account. It must be a number with four
to six digits. Infoblox includes this ID in the data report.
— Send notifications to:
— Infoblox Support: Select this to email the reports to Infoblox Technical Support.
— Additional email addresses: Optionally, you can specify up to 16 additional recipients. Click the Add
icon and enter the email addresses of the recipients.
— Send Test Report: Click this to send a test report to the specified recipients.
4. Save the configuration and click Restart if it appears at the top of the screen.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1349

Monitoring the Appliance

Monitoring DNS Transactions

The NIOS appliance provides tools for monitoring DNS transactions and mitigating cache poisoning from UDP (User
Datagram Protocol) traffic on source port 53. Cache poisoning can occur when a DNS server accepts maliciously
created unauthentic data. The DNS server ends up locally caching the incorrect entries and serving them to users that
make the same DNS requests. In a maliciously created situation, the attacker can redirect Internet traffic from the
legitimate host to another host that the attacker controls.
You can configure the appliance to track invalid DNS responses for recursive DNS queries. The appliance tracks DNS
responses that arrive on invalid ports or have invalid TXIDs (DNS transaction IDs). Both invalid ports and invalid TXIDs
could be indicators of cache poisoning. An invalid port is a DNS response that arrives from UDP (User Datagram
Protocol) port 53 with either one of the following conditions:
• There are no outstanding DNS requests from the port on which the response arrives.
• The TXID of the DNS response matches the TXID of an outstanding request. However, the request was sent from
a port other than the port on which the response arrives.
An invalid TXID is a DNS response that arrives from UDP port 53, and the TXID does not match the TXID of an
outstanding DNS request.
Figure 37.1 illustrates how the appliance detects an invalid port and an invalid TXID.

Figure 37.1 Invalid Port and Invalid TXID

1 A client sends a DNS 2 The Infoblox DNS server sends

request to the Infoblox a DNS request to an authoritative
DNS server DNS server

Infoblox
TXID
DNS Server
65534 Port 10024 UDP
UDP Port 53 (Random Port) Port 53
Authoritative
Client
Port 10024 DNS Server

3 DNS server sends a

Port 10028 valid response to
Infoblox DNS server

5 The appliance detects an invalid

TXID port or TXID, logs the event,
65380 and sends an SNMP trap and/or
e-mail when the thresholds
are exceeded
4 The malicious server
Malicious sends “spoofed”
Source DNS responses and
guesses the TXID
and the UPD port

Both invalid ports and invalid TXIDs could be indicators of DNS cache poisoning, although a small number of them
is considered normal in situations where valid DNS responses arrive after the DNS queries have timed out. You can
configure the appliance to track these indicators, and you can view their status. You can also configure thresholds for
them. When the number of invalid ports or invalid TXIDs exceeds the thresholds, the appliance logs an event in the
syslog file and sends an SNMP trap and e-mail notification, if you enable them. You can then configure rate limiting
rules to limit incoming traffic or completely block connections from primary sources that send the invalid DNS
responses.

1350 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring Tools

Rate limiting is a token bucket system that accepts packets from a source based on the rate limit. You can configure
the number of packets per minute that the Infoblox DNS server accepts from a specified source. You can also
configure the number of packets for burst traffic, which is the maximum number of packets that the token bucket can
accept. Once the bucket reaches the limit for burst traffic, it discards the packets and starts receiving new packets
according to the rate limit.
The appliance monitors only UDP traffic from remote port 53 for the following reasons:
• The attacks that the appliance monitors do not happen over TCP.
• DNS responses are sent only from port 53. The appliance discards DNS responses that are sent from other
ports.
To monitor invalid ports and invalid TXIDs on the Infoblox DNS server, follow these procedures:
1. Enable DNS network monitoring and DNS alert monitoring. For information, see Enabling and Disabling DNS Alert
Monitoring on page 1351.
2. Configure the thresholds for DNS alert indicators. For information, see Configuring DNS Alert Thresholds on page
1352.
3. Enable SNMP traps and e-mail notifications. For information, see Configuring SNMP on page 1365.
4. Review the DNS alert status. For information, see Viewing DNS Alert Indicator Status on page 1352.
5. Identify the source of the attack by reviewing the DNS alert status, syslog file, and SNMP traps. For information
on SNMP traps for DNS alerts, see Threshold Crossing Traps on page 1405.
To mitigate cache poisoning, you can limit incoming traffic or completely block connections from specific sources, as
follows:
• Enable rate limiting on the DNS server. For information, see Enabling and Disabling Rate Limiting from External
Sources on page 1353.
• Configure rate limit traffic rules from specific sources. For information, see Configuring Rate Limiting Rules on
page 1354.
You can verify the rate limiting rules after you configure them. For information, see Viewing Rate Limiting Rules on
page 1354.

Enabling and Disabling DNS Alert Monitoring

The appliance monitors only UDP traffic on port 53 for recursive queries, and then reports invalid DNS responses.
DNS alert monitoring is disabled by default. For an HA pair, you must enable DNS alert monitoring on both the active
and passive nodes.
To enable DNS network monitoring and DNS alert monitoring:
1. Log in to the Infoblox CLI as a superuser account.
2. Enter the following CLI command:
set monitor dns on
The appliance displays the following:
Turning on DNS Network Monitoring...
3. Enter the following command:
set monitor dns alert on
When you enable DNS alert monitoring and DNS network monitoring is disabled, the appliance automatically enables
DNS network monitoring and displays the following:
DNS Network Monitoring is disabled. It must be enabled for alerting to function.
Enable DNS Monitoring now? (y or n):
You can also disable DNS network monitoring and DNS alert monitoring using the following commands:
set monitor dns off
set monitor dns alert off

Note: When you restart DNS network monitoring, you also reset the SNMP counters for DNS alerts.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1351

Monitoring the Appliance

You can then view the alert status to identify the primary source of invalid DNS responses. For information, see
Viewing DNS Alert Indicator Status on page 1352.

Viewing DNS Alert Indicator Status

To view DNS alert indicator status:
1. Log in to the Infoblox CLI as a superuser account.
2. Enter the following CLI command:
show monitor dns alert status
The appliance displays historical alert counts and up to five primary sources that generate invalid DNS
responses, as shown in the following example:

Data last updated: Mon Oct 6 14:47:12 2008

DNS Alert1m5m15m60m24hEver
============================================
port8 12 1212 12 12
txid8 12 1212 12 12

There were 80 DNS responses seen in the last minute.

10% were to an invalid port.
10% had an invalid TXID.

Primary sources of invalid responses:

4.4.4.4 (unknown) sent 4
2.2.2.2 (unknown) sent 3
7.7.7.7 (unknown) sent 1
The appliance attempts to resolve the hostnames of the sources that sent invalid responses, if the DNS resolver is
enabled. If the appliance cannot resolve a hostname, it displays “unknown” as the hostname of the invalid response.

Configuring DNS Alert Thresholds

You can configure thresholds for DNS alerts to control when the appliance tracks DNS attacks on UDP port 53 and
issues SNMP traps and e-mail notifications.

Note: Ensure that you enable SNMP traps and e-mail notifications. For information, see Configuring SNMP on page
1365.

You can configure thresholds for both invalid ports and invalid TXIDs. The default thresholds for both invalid ports
and TXIDs are 50%. When the number of invalid ports or invalid TXIDs exceeds the thresholds, the appliance logs the
event and sends SNMP traps and notifications. You can configure the thresholds either as absolute packet counts or
as percentages of the total traffic during a one minute time interval.
To configure DNS alert thresholds:
1. Log in to the Infoblox CLI as a superuser account.
2. Enter the following CLI command:
set monitor dns alert modify port | txid over threshold_value packets | percent
where
port | txid = Enter port to set the threshold for invalid ports, or enter txid to set the threshold for invalid
TXIDs.
threshold_value = Enter the number of packets or percentage for the threshold.

1352 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring Tools

packets | percent = Enter packets if you want to track the total packet count, or enter percentage if you
want to track a percentage of the total traffic. For a percentage-based threshold, the appliance does not
generate a threshold crossing event if the traffic level is less than 100 packets per minute.
For example, if you want the appliance to send a DNS alert when the percentage of DNS responses arriving on invalid
ports from UDP port 53 exceeds 70% per minute, you can enter the following command:
set monitor dns alert modify port over 70 percent
If you want the appliance to send a DNS alert when the total number of packets with invalid TXIDs from UDP port 53
is over 100 packets per minute, you can enter the following command:
set monitor dns alert modify txid over 100 packets
When there is a DNS alert, the appliance logs an event in the syslog file and sends an SNMP trap and e-mail
notification if enabled.

Viewing DNS Alert Thresholds

You can view the DNS alert thresholds. The appliance displays the current thresholds. If you have not configured new
thresholds, the appliance displays the default thresholds, which are 50% for both invalid port and TXID.
To view the DNS alert thresholds:
1. Log in to the Infoblox CLI as a superuser account.
2. Enter the following CLI command:
show monitor dns alert
The appliance displays the threshold information as shown in the following example:
DNS Network Monitoring is enabled.
Alerting is enabled.
DNS Alert Threshold (per minute)
===========================================
port over 70% of packets
txid over 100 packets

Enabling and Disabling Rate Limiting from External Sources

You can mitigate cache poisoning on your DNS server by limiting the traffic or blocking connections from UDP port 53.
To enable rate limiting from sources:
1. Log in to the Infoblox CLI as a superuser account.
2. Enter the following CLI command:
set ip_rate_limit on
The appliance displays the following:
Enabling rate limiting will discard packets and may degrade performance.
Are you sure? (y or n):

Note: When you enable rate limiting, the appliance discards packets based on the configured rate limiting rules.
This might affect the DNS performance when the appliance discards valid DNS responses.

3. Enter y to enable rate limiting.

When you enable rate limiting, the appliance applies the rate limiting rules that you configured. You might want to
configure the rate limiting rules before enabling rate limiting. For information on how to configure rate limiting rules,
see Configuring Rate Limiting Rules on page 1354.
You can also disable rate limiting by entering the following command:
set ip_rate_limit off
When you disable rate limiting, the appliance stops applying the rate limiting rules.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1353

Monitoring the Appliance

Configuring Rate Limiting Rules

You configure rate limiting rules to limit access or block connections from UDP port 53. The rules take effect when you
enable rate limiting.
When adding rules, ensure that you do not include an IP address that matches the IP address of either the Grid Master
or Grid member. Doing this could affect VPN connectivity. To configure rate limiting rules:
1. Log in to the Infoblox CLI as a superuser account.
2. Enter the following CLI command:
set ip_rate_limit add source all | ip_address [/mask] limit packets/m [burst
burst_packets]
where
all | ip_address = Enter all or 0.0.0.0 if you want to limit all traffic from all sources, or enter the IP
address from which you want to limit the traffic.
[/mask] = Optionally, enter the netmask of the host from which you want to limit the traffic.
packets = Enter the number of packets per minute that you want to receive from the source.
[burst burst_packets] = Optionally, enter burst and the number of packets for burst traffic. This is the
maximum number of packets accepted.
The following are sample commands and descriptions for rate limiting rules:
• To block all traffic from host 10.10.1.1, enter the following command:
set ip_rate_limit add source 10.10.1.1 limit 0
• To limit traffic to five packets per minute from host 10.10.1.2, enter the following command:
set ip_rate_limit add source 10.10.1.2 limit 5/m
• To limit the traffic to five packets per minute from host 10.10.2.1/24 with an allowance for burst traffic of 10
packets, enter the following command:
set ip_rate_limit add source 10.10.2.1/24 limit 5/m burst 10
• To limit the traffic to 5000 packets per minute from all sources, enter the following command:
set ip_rate_limit add source all limit 5000/m

Removing Rate Limiting Rules

You can remove the existing rate limiting rules that limit access or block connections from UDP port 53.
To remove all the existing rules:
1. Log in to the Infoblox CLI as a superuser account.
2. Enter the following CLI command:
— To remove the rate limiting rule that limits traffic from all sources, enter:
set ip_rate_limit remove source all
or
— To remove all of the rate limiting rules from all sources, enter:
set ip_rate_limit remove all
To remove one of the existing rules for an existing host:
1. Log in to the Infoblox CLI as a superuser account.
2. Enter the following CLI command:
set ip_rate_limit remove source ip-address[/mask]

Viewing Rate Limiting Rules

You can view the existing rate limiting rules that limit access or block connections from UDP port 53.
To view rate limiting rules:
1. Log in to the Infoblox CLI as a superuser account.

1354 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Monitoring Tools

2. Enter the following CLI command:

show ip_rate_limit
The appliance displays the rules, as shown in the following example:
IP rate limiting is enabled.
Source Limit Burst
============================================
10.10.1.1 0 packets/minute 0 packets
10.10.1.2 5 packets/minute 5 packets
10.10.2.1/24 5 packets/minute 10 packets
all 5000packets/minute 5000 packets

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1355

Monitoring the Appliance

1356 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 38 DHCP Fingerprint Detection
This chapter explains the Infoblox DHCP fingerprint detection feature and how to configure it on the appliance. It also
explains how to configure DHCP fingerprints for IPv4 and IPv6.
It contains the following sections:
• Infoblox DHCP Fingerprint Detection on page 1358
— About DHCP Fingerprints on page 1359
— Standard and Custom DHCP Fingerprints on page 1359
— Administrative Permissions on page 1360
• Enabling and Disabling DHCP Fingerprint Detection on page 1360
• Configuring DHCP Fingerprints on page 1360
— Adding New DHCP Fingerprints on page 1361
— Modifying Custom DHCP Fingerprints on page 1361
— Deleting Custom DHCP Fingerprints on page 1362
— Viewing DHCP Fingerprint Information on page 1362

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1357

DHCP Fingerprint Detection

Infoblox DHCP Fingerprint Detection

The NIOS appliance utilizes DHCP fingerprint detection to identify IPv4 and IPv6 mobile devices such as laptop
computers, tablets and smart phones, on your network. Due to the broadcast and pervasive nature of DHCP, using
DHCP fingerprint detection is an efficient way to perform system identification and inventory. You can use DHCP
fingerprint detection to track devices on your network, block those that are not allowed (such as gaming consoles and
home routers), and plan for future growth by accessing trending information such as the number of Apple iPhones
versus that of Android phones.
When a remote DHCP client sends a DHCP REQUEST message, it includes a set of DHCP options, such as option 55
and 60. Option 55 contains an option number sequence the appliance uses to interpret the list of DHCP options that
the client requests. The appliance returns the values of these requested options if the information is available.
Option 60 contains a value that indicates the device type of the requesting client. Information in option 55 or 60 is
incorporated to form a unique identifier known as the DHCP fingerprint, which the appliance uses to identify the
requesting client.
On an Infoblox appliance, DHCP fingerprint detection is enabled by default for all new installations. You can disable
this feature at the Grid and member levels. For information, see Enabling and Disabling DHCP Fingerprint Detection
on page 1360. As illustrated in Figure 38.1, the appliance automatically matches option 55 and then option 60 in
DHCP REQUEST messages against standard and custom DHCP fingerprints in the database. Once the appliance finds
a match, it either grants or denies a lease to the requesting client based on the DHCP fingerprint filters that you apply
to the DHCP range. For information about how to configure DHCP fingerprints, see Configuring DHCP Fingerprints on
page 1360. For information about how to define and apply DHCP fingerprint filters, see Defining DHCP Fingerprint
Filters on page 1204 and Applying Filters to DHCP Objects on page 1204. To obtain trending information about the
top OSs (operating systems) or vendor IDs for remote clients, Infoblox provides a few reports from which you can
extract data. For information about reports, see Infoblox Reporting and Analytics on page 1451.

Figure 38.1 DHCP Fingerprint Detection

A remote client requests for a lease. Its

vendor ID matches the DHCP fingerprint of
a gaming console. Based on the DHCP Remote Clients
fingerprint filter criteria, the appliance
denies a lease to the requesting client.

Grid Master Grid Member

Standard and
custom DHCP
fingerprints cached A remote client requests for a lease. Its
in NIOS database. Reporting option number sequence matches the
Server DHCP fingerprint of an Android phone.
Based on the DHCP fingerprint filter criteria,
the appliance grants a lease to the
The reporting server collects requesting client.
data about the remote clients
and generates reports you can
use to monitor the devices.

1358 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox DHCP Fingerprint Detection

About DHCP Fingerprints

When a DHCP client sends a REQUEST message and includes DHCP option 55 (the parameter request list) and option
60 (the vendor identifier), it provides information about its OS and device type. The combination of the option
sequence or vendor ID in option 55 or 60 is used to infer the OS and device type of the remote client. These
parameters are then incorporated into a DHCP fingerprint that provides unique information about this client.
For example, the option number sequence for a Microsoft Windows XP system in option 55 can be one of the
following:
1,15,3,6,44,46,47,31,33,249,43
1,15,3,6,44,46,47,31,33,249,43,252
1,15,3,6,44,46,47,31,33,249,43,252,12
15,3,6,44,46,47,31,33,249,43
15,3,6,44,46,47,31,33,249,43,252
28,2,3,15,6,12,44,47
The option number sequence for an Apple iPhone can be one of the following:
1,3,6,15,119,78,79,95,252
1,3,6,15,119,95,252,44,46,47
In addition, DHCP option 60 tracks vendor ID. This information can be very generic or quite specific. For example, the
vendor ID MSFT 5.0 for a Microsoft Windows XP system and a Windows Vista system can be the same. For certain
Cisco VoIP devices, the vendor ID can be Cisco Systems, Inc. IP Phone, which is very generic; or it can be Cisco
Systems, Inc. IP Phone 7912, which is more specific. Depending on how specific the option number sequence
and the vendor ID are, this information can form a unique identifier, the DHCP fingerprint, for a remote client.

Note: If you have enabled firewall, and if the corresponding firewall rules or policies are set to modify options 55 and
60 of the remote DHCP client to mask the identity of the client, then NIOS fingerprinting will not be able to
fingerprint the clients.

Standard and Custom DHCP Fingerprints

Standard DHCP fingerprints are automatically installed on the appliance when you first set it up or after you have
completed an upgrade from previous NIOS releases to NIOS 6.7 and later. Note that new DHCP fingerprints are added
to the appliance during a major NIOS upgrade. For more information about upgrades, see About Upgrades on page
521.

Note: When you upgrade to NIOS 6.7 and later, DHCP fingerprint detection is disabled during the upgrade. You must
enable it if you want the appliance to use DHCP fingerprint detection. For information, see Enabling and
Disabling DHCP Fingerprint Detection on page 1360.

You can configure custom DHCP fingerprints for devices whose DHCP fingerprints are not captured in the standard
DHCP fingerprints. For information about how to add custom DHCP fingerprints, see Adding New DHCP Fingerprints
on page 1361.
Both standard and custom DHCP fingerprints are cached in memory for matching purposes. Depending on the
information provided in a DHCP fingerprint, the appliance first matches the option number sequence sent in the DHCP
REQUEST message. If option 55 is not included in the request or if there is no match from the cached DHCP
fingerprints, the appliance then tries to match the vendor ID in option 60. When there is an option number sequence
match, the appliance displays the name of the DHCP fingerprint in Grid Manager. If there is no option number
sequence match but there is a vendor ID match, the appliance displays the vendor ID. For information about how to
view fingerprint information, see Viewing DHCP Fingerprint Information on page 1362.
You can also create IPv4 and IPv6 DHCP fingerprint filters and then apply them as class filters to specific IPv4 and
IPv6 DHCP ranges and range templates. For information about how to configure and use DHCP fingerprint filters, see
About DHCP Fingerprint Filters on page 1202.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1359

DHCP Fingerprint Detection

Administrative Permissions
DHCP fingerprint detection is enabled by default for new installations. For upgrades, you must enable this feature
after the upgrade is completed. For information, see Enabling and Disabling DHCP Fingerprint Detection. No special
licenses are required for this feature.
Superusers can add, modify, and delete DHCP fingerprints and DHCP fingerprint filters. Limited-access users with
Read/Write permission to DHCP fingerprints can add, modify, and delete DHCP fingerprints while those who have
Read-only permission can only view information in the Data Management tab -> DHCP tab -> Fingerprints tab. For
information about administrative permissions, see About Administrative Permissions on page 195.

Enabling and Disabling DHCP Fingerprint Detection

Grid DHCP fingerprint detection is enabled by default for new installations, and no special licenses are required. You
can disable this or override the Grid setting at a member level. Note that when you enable DHCP fingerprint detection,
there will be a slight impact on DHCP performance.
When you enable DHCP fingerprint on an HA pair, both peers in a failover association maintain the same DHCP
fingerprinting state (enabled or disabled) even when one of the peers fails or becomes operational again. Note that
both peers must be in the same Grid for the fingerprinting state to stay the same. For information about DHCP failover,
see About DHCP Failover on page 1178.
To enable and disable Grid DHCP fingerprinting:
1. Grid: From the Data Management tab, select the DHCP tab, and then click Grid DHCP Properties from the Toolbar.
Member: From the Data Management tab, select the DHCP tab -> Members tab -> Members -> member check box,
and then click the Edit icon.
2. In the Grid DHCP Properties or Member DHCP Properties editor, select the Fingerprinting tab.
3. Complete the following
— Enable Fingerprint Detection: Deselect this check box to disable the feature. You can enable DHCP
fingerprint detection again by selecting the check box. Click Override to change the configuration for a
member, or click Inherit to inherit the Grid setting.
4. Save the configuration and click Restart at the top of the screen.

Configuring DHCP Fingerprints

The appliance installs standard DHCP fingerprints when you first install or upgrade to NIOS 6.7 and later. You cannot
modify standard DHCP fingerprints nor delete them, but you can disable them. When you disable a DHCP fingerprint,
the appliance disables the associated option number sequence and vendor ID, and it cannot match a remote device
against the disabled DHCP fingerprint.
When you add a new DHCP fingerprint, the appliance marks it as a custom DHCP fingerprint. For information about
adding custom DHCP fingerprints, see Adding New DHCP Fingerprints on page 1361. You can modify information
about custom DHCP fingerprints, and you can delete them. For information, see Modifying Custom DHCP Fingerprints
and Deleting Custom DHCP Fingerprints on page 1362. When you delete a custom DHCP fingerprint, the appliance
moves it to the Recycle Bin, if enabled. You can later restore it from the Recycle Bin if needed.
Activities, such as additions, modifications, and deletions of DHCP fingerprints, are recorded in the audit log. For
information about how to use the audit log, see Using the Audit Log on page 1344.

Note: The appliance periodically updates the cached DHCP fingerprints. When you add, modify, or delete a DHCP
fingerprint, you do not need to restart services but it may take up to two minutes before the appliance updates
the DHCP fingerprint.

1360 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring DHCP Fingerprints

Adding New DHCP Fingerprints

To add a custom DHCP fingerprint:
1. From the Data Management tab, select the DHCP tab -> Fingerprints tab, and then click the Add icon.
2. In the Add DHCP Fingerprint wizard, complete the following:
— Name: Enter the name of the custom DHCP fingerprint. The name must be unique, and it cannot contain any
UTF-8 characters.
— Device Class: From the drop-down list, select the device category to which this new fingerprint belongs. You
can also enter a new device class here. When you enter a device class that already exists, the appliance
matches the entry and uses the class from the current list. Device class is used for filtering purposes. For
information about DHCP fingerprint filters, see Defining DHCP Fingerprint Filters on page 1204.
— Protocol: From the drop-down list, select the protocol used for custom DHCP fingerprint.
— Option Number Sequence: Click the Add icon in the table. The appliance adds a row to the table. Click the
row and enter the DHCP option number you want the appliance to validate. Valid values are from 0 to 255.
When you enter more than one option, you must use commas (without spaces) to separate the numbers.
For example, you can enter 1,15,3,6,44,46,47,31,33 for a Windows XP system.
You can also select an option sequence and click the Delete icon to delete it. Note that if you enter an
option sequence that already exists in a standard DHCP fingerprint, you must disable that standard
fingerprint before you can add the option sequence to the new DHCP fingerprint.
— Vendor Identifier: Click the Add icon in the table. The appliance adds a row to the table. Click the row and
enter a vendor ID for this fingerprint. You can add more than one vendor ID. You can also select a vendor ID
and click the Delete icon to delete it.
— Comment: Enter additional information about the custom DHCP fingerprint.
— Disabled: Select this if you want to save the configuration for the DHCP fingerprint but do not want to
activate it yet. You can clear this check box when you are ready to use this DHCP fingerprint.
3. Save the configuration or click Next to define extensible attributes. For information, see Using Extensible
Attributes on page 427.
To schedule this task, click the Schedule icon at the top of the wizard. In the Schedule Change panel, click Later, and
then specify a date, time, and time zone.

Modifying Custom DHCP Fingerprints

You can modify custom DHCP fingerprints, but not standard ones. Note that the appliance periodically updates the
cached DHCP fingerprints. When you modify a DHCP fingerprint, you do not need to restart services but it may take
up to two minutes before the appliance updates the DHCP fingerprint.
To modify a custom DHCP fingerprint:
1. From the Data Management tab, select the DHCP tab -> Fingerprints tab -> custom_fingerprint check box, and then
click the Edit icon.
2. The DHCP Fingerprint editor provides the following tabs from which you can modify information:
— General: Modify general information, such as the name and device class, as described in Adding New DHCP
Fingerprints on page 1361. Note that when you change the name of a DHCP fingerprint, the old name no
longer exists, and you cannot use it for searching or filtering purposes. You may not be able to modify all
fields in a standard DHCP fingerprint.
— Extensible Attributes: Add and delete extensible attributes that are associated with the DHCP fingerprint.
You can also modify the values of extensible attributes. For information, see Using Extensible Attributes on
page 427. Note that you cannot modify extensible attributes for standard fingerprints.
3. Save the configuration.
To schedule this task, click the Schedule icon at the top of the wizard. In the Schedule Change panel, click Later, and
then specify a date, time, and time zone.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1361

DHCP Fingerprint Detection

Deleting Custom DHCP Fingerprints

When you delete a custom DHCP fingerprint, the appliance moves it to the Recycle Bin, if enabled. You can later
restore the DHCP fingerprint if needed. Note that you cannot delete standard DHCP fingerprints.
To delete a custom DHCP fingerprint:
1. From the Data Management tab, select the DHCP tab -> Fingerprints tab -> custom_fingerprint check box, and then
click the Delete icon.
2. In the Delete Confirmation dialog box, click Yes to delete the DHCP fingerprint.
To schedule this task, click the Delete icon -> Schedule Delete. In the Schedule Deletion dialog box, click Delete Later,
and then specify a date, time, and time zone.

Viewing DHCP Fingerprint Information

The following are a few ways you can view DHCP fingerprint information:
• In a Grid with a reporting server, you can view reports that contain information about the top OSs and device
types of the leasing clients in your network. For more information, see DHCP Dashboards on page 1498.
• The appliance provides a few predefined smart folders from which you can view lease information about
specific device groups, such as gaming consoles and Microsoft Windows devices. For more information, see
Predefined Smart Folders on page 176.
• When the appliance finds a DHCP fingerprint match for a client, Grid Manager displays either the fingerprint
name or the vendor ID in the following panels of Grid Manager: IP List, Current Lease, Lease History, and DHCP
Range panels. You can see this information in the Fingerprints column in these panels.
• The appliance records all DHCP fingerprint related activities in the audit log. For more information, see Using the
Audit Log on page 1344.

1362 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 39 Monitoring with SNMP
This chapter describes how you can use SNMP (Simple Network Management Protocol) to monitor NIOS appliances
in your network. It contains the following sections:
• Understanding SNMP on page 1364
— About SNMPv1 and SNMPv2 on page 1365
— About User-Based Security Model in SNMPv3 on page 1365
• Configuring SNMP on page 1365
— Configuring SNMPv3 Users on page 1366
— Modifying SNMPv3 Users on page 1367
— Deleting SNMPv3 Users on page 1367
— Accepting Queries on page 1367
— Adding Trap Receivers on page 1368
— Defining Thresholds for Traps on page 1369
— Setting SNMP and Email Notifications on page 1371
— Setting SNMP System Information on page 1368
— Testing the SNMP Configuration on page 1375
• SNMP MIB Hierarchy on page 1376
— MIB Objects on page 1377
— System Object IDs on page 1377
• Infoblox MIBs on page 1378
— Loading the Infoblox MIBs on page 1379
— ibTrap MIB on page 1380
— ibPlatformOne MIB on page 1419
— ibDHCPOne MIB on page 1434
— ibDNSOne MIB on page 1441
— IB-DNSSERV-MIB on page 1444
— IB-DNSHITRATIO-MIB on page 1445
— IB-DNSQUERYRATE-MIB on page 1445
— IB-DHCPSERV-MIB on page 1445

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1363

Monitoring with SNMP

Understanding SNMP
You can use SNMP (Simple Network Management Protocol) to manage network devices and monitor their processes.
An SNMP-managed device, such as a NIOS appliance, has an SNMP agent that collects data and stores them as
objects in MIBs (Management Information Bases). The SNMP agent can also send traps (or notifications) to alert you
when certain events occur within the appliance or on the network. You can view data in the SNMP MIBs and receive
SNMP traps on a management system running an SNMP management application, such as HP OpenView, IBM Tivoli
NetView, or any of the freely available or commercial SNMP management applications on the Internet.

Figure 39.1 SNMP Overview

Traps

Queries SNMP Management System

NIOS Appliance

MIB Agent

MIB MIB MIB

MIB

The NIOS appliance supports SNMPv1, SNMPv2, and SNMPv3. It also adheres to the following RFCs:
• RFC 3411, An Architecture for Describing Simple Network Management Protocol (SNMP) Management
Frameworks
• RFC 3412, Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)
• RFC 3413, Simple Network Management Protocol (SNMP) Applications
• RFC 3414, User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMP)
• RFC 3416, Version 2 of the Protocol Operations for the Simple Network Management Protocol (SNMP)
• RFC 3418, Management Information Base (MIB) for the Simple Network Management Protocol (SNMP)
• RFC 1155, Structure and identification of Management information for TCP/IP-based internets
• RFC 1213, Management Information Base for Network Management of TCP/IP-based internets:MIB-II
• RFC 2578, Structure of Management Information Version 2 (SMIv2)

1364 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring SNMP

About SNMPv1 and SNMPv2

SNMPv1 is the initial implementation of SNMP. It operates over protocols such as UDP (User Datagram Protocol) and
IP (Internet Protocol). SNMPv2 includes improvements in performance and security. It adds new protocol operations
such as GetBulk and Inform, which allow the management system to request larger blocks of data from the agent.
Both SNMPv1 and SNMPv2 use common strings that are sent in clear text to authenticate clients.
The NIOS appliance supports SNMPv1 and SNMPv2 in which the SNMPv2 agent acts as a proxy agent for the SNMPv1
management systems. When an SNMPv1 management system sends a query to the appliance, the SNMPv2 proxy
agent forwards the request to the SNMPv1 agent. The proxy agent maps the SNMPv1 trap messages to the SNMPv2
trap messages, and then forward the messages to the management system.
You can enable the appliance to receive queries from SNMPv1 and SNMPv2 management systems. You can also add
SNMPv1 and SNMPv2 management systems to receive traps from the appliance. For information about how to
configure SNMPv1 and SNMPv2 on the appliance, see Configuring SNMP on page 1365.

About User-Based Security Model in SNMPv3

SNMPv3 adds security and remote configuration enhancements to SNMPv1 and SNMPv2. The NIOS appliance
supports the USM (User-based Security Model) in SNMPv3 for the authentication, encryption, and decryption of
SNMP data. SNMPv3 uses the same MIB objects as those supported in SNMPv1 and SNMPv2.
SNMPv3 provides the following security measures:
• Data integrity: Ensure that SNMP data is not maliciously modified by unauthorized entities during its
transmission through the network. This protects against unauthorized management operations, such as
falsifying the value of a MIB object.
• Authentication: Verify the identities of the origin of the SNMP data to protect against masquerade threats that
may temper the identity of users who have the appropriate authorization to send and receive SNMP data.
• Confidentiality: Ensure that unauthorized users cannot eavesdrop on any data exchanges between SNMP
agents and management systems, depending on local policies of the systems.
• Timeliness: Ensure that the SNMP data is received in a timely manner to prevent malicious reordering of data by
unauthorized entities.
To enable SNMPv3 on the NIOS appliance to provide user-based security, you must first configure SNMPv3 users on
the appliance to enable access by SNMP management systems. The appliance supports HMAC-MD5-96 and
HMAC-SHA-96 hash functions as the authentication protocols, and DES (Data Encryption Standard) and AES
(Advanced Encryptions Standard) as the encryption methods for SNMPv3 users. For information, see Configuring
SNMP on page 1365.

Configuring SNMP

Note: SNMP operation is not supported across the NIOS appliance’s LAN2 interface.

You can configure the appliance to receive SNMP queries from specific management systems and send SNMP traps
to specific trap receivers. SNMP operation supports both IPv4 and IPv6 networks. The appliance supports SNMPv1,
SNMPv2, and SNMPv3. You can set up either SNMPv1/SNMPv2 or SNMPv3, or all of them for the Grid. You can also
override the Grid settings at a member level.
To configure SNMPv1 and SNMPv2 on the appliance, do the following:
• Enable the NIOS appliance to accept queries, as described in Accepting Queries on page 1367.
• Specify the management systems to which the appliance sends traps, as described in Adding Trap Receivers on
page 1368.
• Specify system information using managed objects in MIB-II, the standard MIB defined in RFC 1213. For
information, see Setting SNMP System Information on page 1368.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1365

Monitoring with SNMP

To configure SNMPv3 on the appliance, do the following:

• Add an SNMPv3 user and set up authentication and privacy protocols. For information, see Configuring SNMPv3
Users on page 1366. After you set up an SNMPv3 user, you can modify and delete it. For information, see
Modifying SNMPv3 Users on page 1367 and Deleting SNMPv3 Users on page 1367.
• Enable the NIOS appliance to accept queries, as described in Accepting Queries on page 1367.
• Specify the management systems to which the appliance sends traps, as described in see Adding Trap
Receivers.
• Specify system information using managed objects in MIB-II, the standard MIB defined in RFC 1213. For
information, see Setting SNMP System Information on page 1368.

Configuring SNMPv3 Users

To enable SNMPv3, you must first configure SNMPv3 users on the appliance. For information about SNMPv3, see
About User-Based Security Model in SNMPv3 on page 1365.
To configure an SNMPv3 user:
1. From the Administration tab, select the SNMPv3 Users tab, and then click the Add icon.
2. In the Add SNMPv3 User wizard, complete the following:
— Name: Enter a user name for the SNMPv3 management system.
— Authentication Protocol: Select one of the following:
— MD5: Select this to use the HMAC-MD5-96 authentication protocol to authenticate the SNMPv3 user.
This protocol uses the MD5 (Message-Digest algorithm 5) hash function in HMAC (Hash-based
Message Authentication Code) and truncates the output to 96 bits. The output is included as part of the
SNMP message sent to the receiver. For detailed information about the protocol, refer to RFC1321, The
MD5 Message-Digest Algorithm.
— SHA: Select this to use the HMAC-SHA-96 authentication protocol to authenticate the SNMPv3 user.
This protocol uses the SHA (Secure Hash Algorithm) hash function and truncates the output to 96 bits.
The output is included as part of the SNMP message sent to the receiver.
— None: Select this to decline using any authentication protocol for this SNMPv3 user. When you select
this option, you are not required to enter a password.
• Password: Enter a password for the selected authentication protocol.
• Confirm Password: Enter the same password.
— Privacy Protocol: Select one of the following:
— DES: Select this to use DES for data encryption. DES is a block cipher that employs a 56-bit key size and
64-bit block size in the encryption.
— AES: Select this to use AES for data encryption. AES is a symmetric-key encryption standard that
comprises three block ciphers, AES-128, AES-192, and AES-256. Each of these ciphers has a 128-bit
block size and a key size of 128, 192, and 256 bits, respectively.
— None: Select this to decline using any privacy protocol for this SNMPv3 user. When you select this
option, you are not required to enter a password.
• Password: Enter a password for the privacy protocol.
• Confirm Password: Enter the same password.
— Comment: Enter useful information about the SNMP user, such as location or department.
— Disable: Select this check box to retain an inactive profile for this SNMP user in the configuration. You can
clear this check box to activate the profile.

Note: If an SNMPv3 user is configured to send SNMP queries, you cannot delete the user.

3. Click Next to define extensible attributes. For information, see Using Extensible Attributes on page 427.
4. Save the configuration.

1366 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring SNMP

Modifying SNMPv3 Users

1. From the Administration tab, select the SNMPv3 Users tab -> snmpv3user, and then click the Edit icon.
2. The SNMPv3 User editor provides the following tabs from which you can edit data:
— General: Modify the data as described in Configuring SNMPv3 Users on page 1366.
— Extensible Attributes: Add and delete extensible attributes that are associated with the SNMPv3 user
account. You can also modify the values of extensible attributes. For information, see Using Extensible
Attributes on page 427.
3. Save the configuration.

Deleting SNMPv3 Users

When you delete an SNMPv3 user that is configured to send queries or receive traps, a warning message states that
the SNMPv3 is associated with the corresponding function. You can then decide whether you want to delete the user
or not.
To delete an SNMPv3 user:
1. From the Administration tab, select the SNMPv3 Users tab -> snmpv3user, and then click the Delete icon.
2. In the Delete confirmation dialog box, click Yes.

Note: You cannot schedule the deletion of an SNMPv3 user.

Accepting Queries
You can allow specific management systems to send SNMP queries to a NIOS appliance. For SNMPv1 and SNMPv2,
you must specify a community string. The appliance accepts queries only from management systems that provide the
correct community string. You can also specify SNMPv3 users to send queries. For information about configuring
SNMPv3 users, see Configuring SNMPv3 Users on page 1366.
To configure an appliance to accept SNMP queries:
1. Grid: From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
Member: From the Grid tab, select the Grid Manager -> Members tab -> member, and then click the Edit icon.
2. In the Grid Properties or Grid Member Properties editor, select the SNMP tab. To override Grid settings, click
Override in the Grid Member Properties editor.
3. Complete the following in the SNMP section.
— Enable SNMPv1/SNMPv2 Queries: Select this to accept SNMPv1 and SNMPv2 queries from management
systems.
— Community String: Enter a text string that the management system must send together with its queries
to the appliance. A community string is similar to a password in that the appliance accepts queries only
from management systems that send the correct community string. Note that this community string
must match exactly what you enter in the management system.
— Engine ID: Displays the engine ID of the appliance that manages the SNMP agent. The management system
needs this ID to send traps to the appliance. If the appliance is an HA pair, this field displays the engine IDs
for both the active and passive nodes.
— Enable SNMPv3 Queries: Select this to enable queries from SNMPv3 management systems. Click the Add
icon to add SNMPv3 users that you have configured on the appliance. In the SNMPv3 User Selector dialog
box, click the SNMPv3 user you want to add. The appliance displays the selected SNMPv3 users in the
table. You can add comments in the table. You can also select an SNMPv3 user and click the Delete icon to
remove it from the table. Note that a disabled SNMPv3 user cannot send queries to the appliance.
4. Save the configuration.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1367

Monitoring with SNMP

Adding Trap Receivers

You can enable the NIOS appliance to send traps to specific management systems using either SNMPv1/SNMPv2 or
SNMPv3, or all versions of SNMP. You can then add management systems that are allowed to receive traps from the
appliance. Note that you cannot enable both SNMPv1/SNMPv2 and SNMPv3 on the same trap receiver. The appliance
sends traps when certain events occur. You can enable SNMP traps and add trap receivers to the Grid. You can also
override the Grid settings at the member level.
To enable the appliance to send traps and to add trap receivers, do the following:
1. Grid: From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
Member: From the Grid tab, select the Grid Manager -> Members tab -> member, and then click the Edit icon.
2. In the Grid Properties or Grid Member Properties editor, select the SNMP tab. To override Grid settings, click
Override in the Grid Member Properties editor.
3. Complete the following in the SNMP tab:
— Enable SNMPv1/SNMPv2 Traps: Select this to enable the appliance to send traps to specified management
systems.
— Community String: Enter a text string that the NIOS appliance sends to the management system
together with its traps. Note that this community string must match exactly what you enter in the
management system.
— Enable SNMPv3 Traps: Select this to enable the appliance to send traps to specified SNMPv3 users.
4. Click the Add icon and select one of the following from the drop-down menu to add an SNMP trap receiver:
— SNMPv1/SNMPv2: Select this to add an SNMPv1 or SNMPv2 management system as a trap receiver. Grid
Manager adds a row to the table. In the Address field, enter the IP address of the SNMP management
system to which you want the SNMP agent on the appliance to send traps. You can enter more than one trap
receiver. To remove a trap receiver from the list, select the address, and then click the Delete icon.
— SNMPv3: Select this to add an SNMPv3 management system as a trap receiver. Grid Manager displays the
SNMPv3 User Selector dialog box. Click the name of the SNMPv3 user in the dialog box. Grid Manager adds
the user to the table. In the Address field, enter the IP address of the SNMP management system to which
you want the SNMP agent on the appliance to send traps. You can add more than one trap receiver. To
remove a trap receiver from the list, select the address, and then click the Delete icon.
Trap receiver IP addresses may be in IPv4 or IPv6 format.
In the Trap Receiver table, Grid Manager displays the following information about the trap receivers:
— Address: The IPv4 or IPv6 address of the trap receiver. Note that when an SNMPv3 user is disabled,
SNMPv1/SNMPv2 traps are disabled. You can modify the IP address of the trap receiver even when the
following are disabled: SNMPv3 users, SNMPv1/SNMPv2 traps, and SNMPv3 traps.
— SNMPv3 User: The user name of the SNMPv3 trap receiver. This is for SNMPv3 only.
— Comment: Information you entered about the management system.
5. Save the configuration.

Setting SNMP System Information

You can enter values for certain managed objects in MIB-II, the standard MIB defined in RFC 1213. Management
systems that are allowed to send queries to the appliance can query these values. You can enter these values for the
Grid and specific members. You can also override the Grid values at a member level.
To enter system information:
1. Grid: From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
Member: From the Grid tab, select the Grid Manager -> Members tab -> member, and then click the Edit icon.
2. In the Grid Properties or Grid Member Properties editor, select the SNMP tab. To override Grid settings, click
Override in the Grid Member Properties editor.

1368 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring SNMP

3. Complete the following in the SNMP tab. For an HA member, click Override Node 2 settings to enter information
for node 2 of the HA pair.
— sysContact: Enter the name of the contact person for the appliance.
— sysLocation: Enter the physical location of the appliance.
— sysName: Enter the fully qualified domain name of the appliance.
— sysDescr: Enter useful information about the appliance, such as the software version it is running.
4. Save the configuration and click Restart if it appears at the top of the screen.

Defining Thresholds for Traps

Threshold events for appliance performance are configurable. For each event, you can set a value that triggers the
appliance to send a trap and another value at which the appliance sends a CLEAR trap. The appliance sends a CLEAR
trap the first time the event value reaches the reset value after it reached the trigger value.
To define the threshold values:
1. Grid: From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
Member: From the Grid tab, select the Grid Manager -> Members tab -> member, and then click the Edit icon.
2. In the Grid Properties or Grid Member Properties editor, click Toggle Advanced Mode, and then select the SNMP
Threshold tab. To override Grid settings, click Override in the Grid Member Properties editor.
3. Complete the following in the SNMP Threshold tab. Each of the following event types have default Trigger and
Reset values. You can change the values for any of them. You can set SNMP thresholds above or below which the
appliance sends SNMP traps and email notifications, if configured to do so. When any allocated usage exceeds
the Trigger value, the appliance sends an SNMP trap and email notification to the designated destination, and
the status icon for that usage turns red. When usage drops to the Reset value, the status color goes back to
normal and turns green.
— CPU Usage: The percentage of the CPU that is currently in use. The default Trigger value is 81%, and the
default Reset value is 70%. Note that these default values are set to disable the CPU usage trap. You can
enable this trap and configure the trigger and reset values using the CLI command set thresholdtrap.
— Database Objects: The percentage of database capacity that is currently in use. The default Trigger value is
80%, and the default Reset value is 70%.
— Disk: The percentage of the primary hard disk that is currently in use. The default Trigger value is 85%, and
the default Reset value is 70%.
— File Distribution Usage: The percentage of the file distribution storage capacity that is currently in use on
the selected member. The default Trigger value is 90%, and the default Reset value is 70%.
— IPAM Utilization: For a network, this is the percentage based on the IP addresses in use divided by the total
addresses in the network and for a network container that contains subnets, this is the percentage of the
total address space defined within the container regardless of whether any of the IP addresses in the
subnets are in use. The default Trigger value is 95% and the default Reset value is 85%. The status icon
turns red when utilization crosses the configured trigger value. When utilization is below the trigger value,
the status color turns blue.
— Memory: The percentage of the system memory that is currently in use. The default Trigger value is 90%,
and the default Reset value is 80%.
— Network Capacity: When the Grid is part of a Master Grid, this is the percentage of the Master Grid’s
network capacity that is used by the Grid’s networks. The default Trigger value is 85% and default Reset
value is 75%.
— Recursive Clients: The percentage of the limit of concurrent recursive queries. The default Trigger value is
80%, and the default Reset value is 30%. You must also enable the recursive client limit in order for the
appliance to send recursive client traps. For information about how to set this limit, see Restricting
Recursive Client Queries on page 770. When you configure the Trigger and Reset values, ensure that you do
not set them too low or too close together. If the Trigger and Reset values are too close together, the
appliance may send excessive traps and email notifications because both trigger and reset traps are sent
based on the calculated value of simultaneous recursive client queries. For example, when you set the

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1369

Monitoring with SNMP

recursive client limit at 50, Trigger value at 71%, and Reset value at 70%, the value for simultaneous
recursive client queries is calculated at 50 x .71 = 35 (integer math truncation) and 50 x .70 = 35. This
could result in the appliance sending trigger and reset traps for the same value of simultaneous recursive
client queries.
— Root File System: The percentage of the root file system ("/") that is currently in use. The default Trigger
value is 85%, and the default Reset value is 70%.
— Swap Usage: The percentage of the swap area that is currently in use. The factory default Trigger value is
20% and the factory default Reset value is 10%. The swap usage threshold varies based on the appliance
models. The Infoblox GUI displays zero for both the Trigger and Reset values indicating the optimized usage
of platform specific default values. The swap usage threshold is set to 50% for 2 GB appliances and 20%
for all other appliances. For information about available memory on each appliance model, see Table 39.1.
— Reporting: The number of reports created on the system that can trigger an SNMP trap. The default Trigger
value is 85, and the default Reset value is 70. Note that the maximum number of reports supported per Grid
is 300. This field is displayed only when you have configured a reporting server.
— Reporting Volume: The percentage of data transmissions to the reporting server. The default Trigger value is
80%, and the default Reset value is 71%. This field is displayed only when you have configured a reporting
server.
— Threat Protection Dropped Traffic: The percentage of packets dropped based on the threat protection rule
configuration. The default Trigger value is 90%, and the default Reset value is 70%. This field is displayed
only when Threat Protection licenses are installed on the appliance. When the percentage of Threat
Protection dropped traffic exceeds the Trigger value or drops below the Reset value, the appliance sends an
SNMP trap and an email notification—if configured to do so. For information about setting SNMP traps and
email notifications, see Setting SNMP and Email Notifications on page 1371.
— Threat Protection Total Traffic: The percentage of total traffic received (dropped and passed packets) on the
external interfaces. The default Trigger value is 90%, and the default Reset value is 70%. This field is
displayed only when Threat Protection licenses are installed on the appliance. When the percentage of total
Threat Protection traffic exceeds the Trigger value or drops below the Reset value, the appliance sends an
SNMP trap and an email notification—if configured to do so. For information about setting SNMP traps and
email notifications, see Setting SNMP and Email Notifications on page 1371.
If you have installed Threat Protection licenses on the appliance and are using the Infoblox External DNS
Security feature, Grid Manager displays the following for Trigger events per second and Reset events per
second:
— Alert Rate: The number of SNMP traps sent per second when the appliance sends alerts while passing
packets based on threat protection rule configuration. The default Trigger value is 1 and the default Reset
value is 0.
— Drop Rate: The number of SNMP traps sent per second when the appliance drops packets based on the
threat protection rule configuration. The default Trigger value is 1 and the default Reset value is 0.
If you have installed an RPZ license on the NIOS appliance, you can configure the thresholds to monitor the RPZ
hit rate in the Response Policy Zones Hit Rate Configuration section. For information, see Configuring
Thresholds for RPZ Hit Rate on page 1713.
4. Save the configuration and click Restart if it appears at the top of the screen.

The following table lists available Infoblox appliance models and their available memory:

1370 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring SNMP

Table 39.1 Overview of Available Memory for Infoblox Appliance Models

Infoblox Appliance Series Appliance Model Memory

Cloud Platform Virtual CP-V2200 12 GB
Appliances
CP-V1400 8 GB
CP-V800 2 GB
Advanced Appliances PT-4000-10GE 10 GE
PT-4000 24 GB
PT-2200 12 GB
PT-1400 8 GB
Network Insight Appliances ND-4000 64 GB
ND-2200 24 GB
ND-1400 16 GB
ND-800 8 GB
Trinzic Appliances Infoblox-4010 24 GB
TE-2220 12 GB
TE-2210 12 GB
TE-1420 8 GB
TE-1410 8 GB
TE-820 2 GB
TE-810 2 GB
TE-100 2 GB
DNS Cache Acceleration IB-4030-10GE 10 GE
Appliances
IB-4030 24 GB

Setting SNMP and Email Notifications

You can specify the event types that trigger trap and email notifications.
To set SNMP trap and email notifications:
1. Grid: From the Grid tab, select the Grid Manager tab, and then select Grid Properties -> Edit from the Toolbar.
Member: From the Grid tab, select the Grid Manager -> Members tab -> member, and then click the Edit icon.
2. In the Grid Properties or Grid Member Properties editor, click Toggle Advanced Mode, and then select the
Notification tab. To override Grid settings, click Override in the Grid Member Properties editor.
3. Complete the following:
— Enable All SNMP Notifications: Select this check box if you want the appliance to send SNMP notifications
(traps) for all events to the configured trap receivers. This is selected by default. To send SNMP notifications
for specific events to the configured trap receiver, select the check box for respective event type.
For information on configuring trap receivers, see Adding Trap Receivers on page 1368.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1371

Monitoring with SNMP

— Enable All Email Notifications: Select this check box if you want the appliance to send email notifications
(traps) for all events to the configured email recipients. This is deselected by default. To send email
notifications for specific events to the configured email recipients, select the check box for each respective
event type. For more information, see Selecting SNMP and Email Notification Types on page 1372.
For information on enabling email notifications and specifying recipients, see Notifying Administrators on
page 232.
— Alternatively, you can select specific event types from the table, and specify whether you want the
appliance to send SNMP Notifications and Email notifications for each type of event.
4. Save the configuration and click Restart if it appears at the top of the screen.

Selecting SNMP and Email Notification Types

Instead of enabling and receiving SNMP and email notifications for all hardware and software events, you can select
specific alert types when a specific hardware or software encounters issues. To enable SNMP or email notifications
for specific event types, select the corresponding check boxes in the Notification tab of the Grid Properties or Member
Properties editor. The following table lists the event types you can select:

Table 39.2 Event Types

Event Type Description

BGP Sends notifications when the BGP software has failed. For more information, see
ibProbableCause Values (OID 3.1.1.1.2.4.0) on page 1386.
Backup Sends notifications about the status of backup operation. For more information,
see Processing and Software Failure Traps on page 1398.
BloxTools Sends notifications about the status of bloxTools. For more information, see
Object State Change Traps on page 1414.
CPU Sends notifications about the status of CPU usage. For more information, see
Threshold Crossing Traps on page 1405.
CaptivePortal Sends notifications about the Captive Portal service. For more information, see
ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID 3.1.1.1.2.10.0) on
page 1393.
Clear Sends notifications when the SNMP trap is cleared. When you select the check
box, the CLEAR trap is sent for the following software failures: LDAP servers,
OCSP responders, LCD, Serial Console, OSPF, OSPF6, BGP, HSM, Controld, SSH,
HTTP, Cluster, Login, and Duplicate IP. For file distribution, the trap is sent when
the service is restored. If you deselect the check box, the CLEAR trap is not sent
when any of the mentioned software fails. For more information, see
ibProbableCause Values (OID 3.1.1.1.2.4.0) on page 1386.
Cloud API Sends notifications about whether the Cloud API service is functioning or not. for
information about Cloud Network Automation, see Introduction to Cloud
Network Automation on page 362.
Cluster Sends notifications about the status of NIOS clusterd process. For more
information, see Processing and Software Failure Traps on page 1398.
Controld Sends notifications about the NIOS controld process. For more information, see
Processing and Software Failure Traps on page 1398.
DHCP Sends notifications about the status of DHCP service. For more information, see
ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID 3.1.1.1.2.10.0) on
page 1393.

1372 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring SNMP

Event Type Description

DNS Sends notifications about the status of DNS service. For more information, see
ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID 3.1.1.1.2.10.0) on
page 1393.
DNS Integrity Check Sends notifications about whether DNS integrity check is functioning or not. For
information about DNS integrity check, see About DNS Integrity Check for
Authoritative Zones on page 836.
DNS Integrity Check Sends notifications about whether DNS integrity check connection is functioning
Connection or not. For more information, see ibPreviousState (OID 3.1.1.1.2.9.0) and
ibCurrentState (OID 3.1.1.1.2.10.0) on page 1393.
Database Sends notifications about the database status. For more information, see
Processing and Software Failure Traps on page 1398.
Disconnected Grid Sends notifications about whether a Grid has been disconnected from the
Master Grid. For more information, see Object State Change Traps on page 1414.
Discovery Sends notifications about the discovery status. For information about the
Discovery feature, seeInfoblox Network Insight on page 653.
Discovery Conflict Sends notifications about conflicts between the DHCP address and the existing
IP address. For more information, see Processing and Software Failure Traps on
page 1398.
Discovery Unmanaged Sends notifications related to the discovery of unmanaged devices and
networks. You can configure the maximum number of unmanaged objects the
appliance discovers and how often it notifies about these events. For more
information about how to configure these parameters, see Defining Seed
Routers for Probe Members on page 684.
Disk Sends notifications about the status of the primary disk. For more information,
see Equipment Failure Traps on page 1397.
DuplicateIP Sends notifications when there are duplicate IP addresses. For more
information, see ibProbableCause Values (OID 3.1.1.1.2.4.0) on page 1386.
ENAT Sends notifications about the Ethernet port status. For more information, see
ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID 3.1.1.1.2.10.0) on
page 1393.
File Distribution Usage Sends notifications about the HTTP file distribution process. For more
information, see Processing and Software Failure Traps on page 1398.
FTP Sends notifications about the status of FTP service. For more information, see
Processing and Software Failure Traps on page 1398.
Fan Sends notifications about the status of the system fan. For more information, see
Equipment Failure Traps on page 1397.
HA Sends notifications about the status of the HA port link. For more information,
see ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID 3.1.1.1.2.10.0)
on page 1393.
HSM Sends notifications about the status of the HSM operation. For more
information, see ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID
3.1.1.1.2.10.0) on page 1393.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1373

Monitoring with SNMP

Event Type Description

HTTP Sends notifications about the status of the HTTP service. For more information,
see ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID 3.1.1.1.2.10.0)
on page 1393.
IFMAP Sends notifications about the status of the IF-MAP service. For more information,
see ibProbableCause Values (OID 3.1.1.1.2.4.0) on page 1386.
IPAM Utilization Sends notifications about the percentage of IPv4 addresses that are used in a
network. For a network container that contains subnets, this indicates the
percentage of the total address space defined within the container regardless of
whether any of the IP addresses are used in the subnetwork. For more
information, see Threshold Crossing Traps on page 1405.
Load Balancer Device Sends notifications about whether the LB device is in sync or not.
LCD Sends notifications about the status of the LCD process. For more information,
see Processing and Software Failure Traps on page 1398.
LDAP Servers Sends notifications about whether LDAP servers are available or not. For more
information, see ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID
3.1.1.1.2.10.0) on page 1393.
License Sends notifications when the license has been revoked. For more information,
see Revoked License Trap on page 1418.
Login Sends notifications when the login details are incorrect. For more information,
see Processing and Software Failure Traps on page 1398.
MGM Sends notifications about the status of the multi-Grid configuration. For more
information, see Object State Change Traps on page 1414.
MSServer Sends notifications about the status of Microsoft Servers for Microsoft
management. For more information, see ibPreviousState (OID 3.1.1.1.2.9.0) and
ibCurrentState (OID 3.1.1.1.2.10.0) on page 1393.
Memory Sends notifications about the status of the system memory. For more
information, see Threshold Crossing Traps on page 1405.
NTP Sends notifications about the status of the NTP service. For more information,
see ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID 3.1.1.1.2.10.0)
on page 1393.
Network Sends notifications about the status of the LAN port. For more information, see
Threshold Crossing Traps on page 1405.
OCSP Responders Sends notifications about the status of OCSP responders.
OSPF Sends notifications about the ospfd process. For more information, see
Processing and Software Failure Traps on page 1398.
OSPF6 Sends notifications about the ospf process for IPv6. For more information, see
ibProbableCause Values (OID 3.1.1.1.2.4.0) on page 1386.
PowerSupply Sends notifications about the status of the power supply. For more information,
see Equipment Failure Traps on page 1397.
RAID Sends notifications about the RAID array status. For more information, see
Equipment Failure Traps on page 1397.
Recursive Clients Sends notifications about whether the DNS recursive server is under flood
attacks. For more information, see Threshold Crossing Traps on page 1405.

1374 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Configuring SNMP

Event Type Description

RIR SWIP Sends notifications about the status of the RIR SWIP registration. For more
information, see ibProbableCause Values (OID 3.1.1.1.2.4.0) on page 1386.
Reporting Sends notifications about the status of the reporting database. For more
information, see Threshold Crossing Traps on page 1405.
RootFS Sends notifications about the status of the root file system. For more
information, see Threshold Crossing Traps on page 1405.
SNMP Sends notifications about the status of the SNMP server. For more information,
see Processing and Software Failure Traps on page 1398.
SSH Sends notifications about the status of the sshd process. For more information,
see Processing and Software Failure Traps on page 1398.
SerialConsole Sends notifications when the serial console login has failed or the admin failed
to login to the serial console. For more information, see Processing and Software
Failure Traps on page 1398.
Swap Usage Sends notifications about whether the swap usage has exceeded the trigger or
reset value. For more information, see Defining Thresholds for Traps on page
1369
Syslog Sends notifications when the syslog process stops. For more information, see
Processing and Software Failure Traps on page 1398.
System Sends notifications about the status of the NIOS system. For more information,
see Process Started and Stopped Traps on page 1418.
TFTP Sends notifications about the status of the TFTP service. For more information,
see Processing and Software Failure Traps on page 1398.
Threat Protection Sends notifications about whether the threat protection service for Infoblox DNS
Protection is functioning properly. For more information, see ibPreviousState
(OID 3.1.1.1.2.9.0) and ibCurrentState (OID 3.1.1.1.2.10.0) on page 1393.
TAXII Sends notifications when you start and stop the TAXII service.

Testing the SNMP Configuration

After you configure SNMP on the appliance, you can do the following to test your SNMP configuration:
• From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box, and then select Test
SNMP from the Toolbar.
The appliance sends a “test trap” string to the trap receiver and displays a confirmation message at the top of the
screen if your SNMP configuration is properly set up. If your SNMP configuration is not complete or if it is invalid, the
appliance displays an error message. You can check your configuration and try again.
The following is a sample test trap that the trap receiver can get:
2011-04-04 17:37:14 10.32.2.80 [UDP: [10.32.2.80]:49244->[10.32.2.80]]:
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-MIB::snmpTrapOID
SNMPv2-MIB::sysName.0 = STRING: 'Test trap'

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1375

Monitoring with SNMP

SNMP MIB Hierarchy

In addition to implementing its own enterprise MIBs, Infoblox supports the standard MIBs defined in RFC-1213,
Management Information Base for Network Management of TCP/IP-based internets: MIB-II.
The Infoblox MIBs are part of a universal hierarchical structure, usually referred to as the MIB tree. The MIB tree has
an unlabeled root with three subtrees. Figure 39.2 illustrates the branch of the MIB tree that leads to the Infoblox
enterprise MIBs. Each object in the MIB tree has a label that consists of a textual description and an OID (object
identifier). An OID is a unique dotted-decimal number that identifies the location of the object in the MIB tree. Note
that all OIDs begin with a dot (.) to indicate the root of the MIB tree.
As shown in Figure 39.2, Infoblox is a branch of the Enterprise subtree. IANA (Internet Assigned Numbers Authority)
administers the Enterprise subtree, which is designated specifically for vendors who define their own MIBs. The
IANA-assigned enterprise number of Infoblox is 7779; therefore, the OIDs of all Infoblox MIB objects begin with the
prefix .1.3.6.1.4.1.7779. In addition, IB-DNSSERV and IB-DHCPSERV are branches of the Enterprise subtree as well.
The Infoblox SNMP subtree branches down through two levels, ibProduct and ibOne, to the Infoblox MIBs: ibTrap,
ibPlatformOne, ibDNSone, and ibDHCPOne. The ibTrap MIB defines the traps that NIOS appliances send, and the
ibPlatformOne, ibDNSone, and ibDHCPOne MIBs provide information about the appliance. For detailed information
about these MIBS, see Infoblox MIBs on page 1378.

Figure 39.2 MIB Hierarchy

(.0) (.1) (.0)

International Telegraph and International Organization CCITT and ISO
Telephone Consultative Committee for Standardization (ISO)
(CCITT)
(.1.3)
ORG

(.1.3.6)
U.S. Department of Defense (DOD)

(.1.3.6.1)
Internet

(.1.3.6.1.4)
Private

(.1.3.6.1.4.1)
Enterprise

(.1.3.6.1.4.1.7779) (.1.3.6.1.4.1.32) (.1.3.6.1.4.1.9999)

Infoblox IB-DNSSERV IB-DHCPSERV

(.1.3.6.1.4.1.7779.3)
Infoblox SNMP Tree

(.1.3.6.1.4.1.7779.3.1)
ibProduct

(.1.3.6.1.4.1.7779.3.1.1)
ibOne

(.1.3.6.1.4.1.7779.3.1.1.1) (.1.3.6.1.4.1.7779.3.1.1.2) (.1.3.6.1.4.1.7779.3.1.1.3) (.1.3.6.1.4.1.7779.3.1.1.4)

ibTrap ibPlatformOne ibDNSOne ibDHCPOne

1376 NIOS Administrator Guide (Rev. A) NIOS 7.3

 SNMP MIB Hierarchy

MIB Objects
The Infoblox MIB objects were implemented according to the guidelines in RFCs 1155 and 2578. They specify two
types of macros for defining MIB objects: OBJECT-TYPE and NOTIFICATION-TYPE. These macros contain clauses that
describe the characteristics of an object, such as its syntax and its status. OBJECT-TYPE macros describe MIB objects,
and NOTIFICATION-TYPE macros describe objects used in SNMP traps.
Each object in the ibPlatformOne, ibDNSone, and ibDHCPOne MIBs contains the following clauses from the
OBJECT-TYPE macro:
• OBJECT-TYPE: Provides the administratively-assigned name of the object.
• SYNTAX: Identifies the data structure of the object, such as integers, counters, and octet strings.
• MAX-ACCESS: Identifies the type of access that a management station has to the object. All Infoblox MIB objects
provide read-only access.
• STATUS: Identifies the status of the object. Values are current, obsolete, and deprecated.
• DESCRIPTION: Provides a textual description of the object.
• INDEX or AUGMENTS: An object that represents a conceptual row must have either an INDEX or AUGMENTS
clause that defines a key for selecting a row in a table.
• OID: The dotted decimal object identifier that defines the location of the object in the universal MIB tree.
The ibTrap MIB defines the SNMP traps that a NIOS appliance can send. Each object in the ibTrap MIB contains the
following clauses from the NOTIFICATION-TYPE macro:
• NOTIFICATION-TYPE: Provides the administratively-assigned name of the object.
• OBJECTS: Provides an ordered list of MIB objects that are in the trap.
• STATUS: Identifies the status of the object. Values are current, obsolete, and deprecated.
• DESCRIPTION: Provides the notification information.

System Object IDs

Infoblox uses the SNMP system object identifier sysObjectID to identify Infoblox appliances. The following is a
definition of sysObjectID from the SNMPv2 MIB, Management Information Base (MIB) for the Simple Network
Management Protocol (SNMP):

OBJECT-TYPE sysObjectID
SYNTAX Object Identifier
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The vendor's authoritative identification of the network management
subsystem contained in the entity. This value is allocated within the SMI
enterprises subtree (1.3.6.1.4.1) and provides an easy and unambiguous
means for determining `what kind of box' is being managed. For example, if
vendor `Flintstones,Inc.' was assigned the subtree 1.3.6.1.4.1.424242, it could
assign the identifier 1.3.6.1.4.1.424242.1.1 to its `Fred Router'.”

Table 39.3 lists the enterprise IDs and their corresponding Infoblox hardware platforms that an SNMP query can
return when you request the sysObjectID value. Note that the IDs shown in the table do not include
1.3.6.1.4.1.7779.1. (the infobloxProducts prefix).

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1377

Monitoring with SNMP

Table 39.3 sysObjectID for Infoblox Hardware

ID Description Definition
1000 ibDefault Default environments, such as chroot
1001 ibRsp2 vNIOS appliances on Riverbed Services Platforms
1002 ibCisco Cisco servers
1003 ibvm vNIOS appliances on VMware ESX or ESXi servers
1004 ibvnios Virtual NIOS
1031 ib4030 Infoblox-4030 appliances
1032 ib4030 Infoblox-4030 appliances
1401 ib810 Trinzic 810 appliances
1402 ib820 Trinzic 820 appliances
1403 ib1410 Trinzic 1410 appliances
1404 ib1420 Trinzic 1420 appliances
1405 ib1400 Trinzic Reporting 1400 appliances
1406 ib800 Trinzic Reporting 800 appliances
1411 ib2200 Trinzic Reporting 2200 appliances
1412 ib2210 Trinzic 2210 appliances
1413 ib2220 Trinzic 2220 appliances
1421 ib4010 Infoblox-4010 appliances
1422 ib4030 Infoblox-4030 appliances
1423 ib4000 Infoblox-4000 appliances
1407 pt1400 Infoblox Advanced 1400 appliances
1414 pt2200 Infoblox Advanced 2200 appliances
1424 pt4000 Infoblox Advanced 4000 appliances

Infoblox MIBs
You can configure a NIOS appliance as an SNMP-managed device so that an SNMP management station can send
queries to the appliance and retrieve information from its MIBs. Perform the following tasks to access the Infoblox
MIBs:
1. Configure a NIOS appliance to accept queries, as described in Configuring SNMPv3 Users on page 1366.
2. Load the MIB files onto the management system. To obtain the latest Infoblox MIB files:
a. From the Data Management tab, select the Grid tab -> Grid Manager tab, and then select Download -> SNMP
MIBs from the Toolbar.
b. In the Save As dialog box, navigate to a directory to which you want to save the MIBs.
c. Click Save.
3. Use a MIB browser or SNMP management application to query the objects in each MIB.
The NIOS appliance allows read-only access to the MIBs. This is equivalent to the Get and Get Next operations in
SNMP.

1378 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Loading the Infoblox MIBs

If you are using an SNMP manager toolkit with strict dependency checking, you must download the following Infoblox
MIBs in the order they are listed:
1. IB-SMI-MIB.txt
2. IB-TRAP-MIB.txt
3. IB-PLATFORMONE-MIB.txt
4. IB-DNSONE-MIB.txt
5. IB-DHCPONE-MIB.txt
6. IB-DNSSERV-MIB.txt
7. IB-DHCPSERV-MIB.txt
8. IB-DHCPV6ONE-MIB.txt
In addition, if the SNMP manager toolkit you use requires a different MIB file naming convention, you can rename the
MIB files accordingly.

NET-SNMP MIBs
NIOS appliances support NET-SNMP (formerly UCD-SNMP), a collection of applications used to implement the SNMP
protocol. The NET-SNMP MIBs provide the top-level infrastructure for the SNMP MIB tree. They define, among other
things, the objects in the SNMP traps that the agent sends when the SNMP engine starts and stops. For information
about NET-SNMP and the MIB files distributed with NET-SNMP, refer to http://net-snmp.sourceforge.net/.
For SNMP traps to function properly, you must download the following NET-SNMP MIBs directly from
http://net-snmp.sourceforge.net/docs/mibs/:
• NET-SNMP-MIB
• UCD-SNMP-MIB

Note: Ensure that you save the MIBs as text files in the directory to which you save all the other MIB files.

BGP4 MIB
Infoblox supports BGP4 (Border Gateway Protocol) for DNS anycast addressing. BGP is configured to send SNMP traps
to neighboring routers, as defined in RFC4273 Definitions of Managed Objects for BGP-4. You must enable and
configure the SNMP trap receiver on the Grid member for the member to send SNMP traps. For information, see SNMP
MIB Hierarchy on page 1376.
The BGP protocol service is configured to send SNMP queries about BGP runtime data. The information is returned
using the following OIDs and definitions:

OID Definition
1.3.6.1.2.1.15.900.1.1 Number of peers
1.3.6.1.2.1.15.900.1.2 Number of active peers
1.3.6.1.2.1.15.900.1.3 Number of AS path entries
1.3.6.1.2.1.15.900.1.4 Number of BGP community entries
1.3.6.1.2.1.15.900.1.5 Total number of prefixes

For each configured BGP peer (a, b, c, d), the information is returned using the following OIDs and definitions:

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1379

Monitoring with SNMP

OID Definition
1.3.6.1.2.1.15.900.1.9.a.b.c.d.1 IP address: same as a.b.c.d
1.3.6.1.2.1.15.900.1.9.a.b.c.d.2 State: 0=down, 1=up
1.3.6.1.2.1.15.900.1.9.a.b.c.d.3 ASN
1.3.6.1.2.1.15.900.1.9.a.b.c.d.4 Prefixes
1.3.6.1.2.1.15.900.1.9.a.b.c.d.5 Up/Down time

ibTrap MIB
NIOS appliances send SNMP traps when events, internal process failures, or critical service failures occur. The ibTrap
MIB defines the types of traps that a NIOS appliance sends and the value that each MIB object represents. The
Infoblox SNMP traps report objects which the ibTrap MIB defines. Figure 39.3 illustrates the ibTrap MIB structure. It
provides the OID and textual description for each object.

Note: OIDs shown in the illustrations and tables in this section do not include the prefix .1.3.6.1.4.1.7779.

The ibTrap MIB comprises two trees, ibTrapOneModule and ibNotificationVarBind. The ibTraponeModule tree
contains objects for the types of traps that a NIOS appliance sends. The ibNotificationVarBind tree contains objects
that the Infoblox SNMP traps report. You cannot send queries for the objects in this MIB module. The objects are used
only in the SNMP traps.

Figure 39.3 ibTrapOne MIB Structure

(3.1.1.1) ibTrap MIB

(3.1.1.1.1) (3.1.1.1.2)
ibTrapOneModule ibNotificationVarBind
(3.1.1.1.1.1) (3.1.1.1.2.1.0)
ibEquipmentFailureTrap ibNodeName

(3.1.1.1.2.2.0)
(3.1.1.1.1.2) ibTrapSeverity
ibProcessingFailureTrap
(3.1.1.1.2.3.0)
ibObjectName
(3.1.1.1.1.3)
ibThresholdCrossingEvent (3.1.1.1.2.4.0)
ibProbableCause

(3.1.1.1.1.4) (3.1.1.1.2.5.0)
ibStateChangeEvent ibSubsystemName

(3.1.1.1.2.6.0)
(3.1.1.1.1.5) ibCurThresholdValue
ibProcStartStopTrap
(3.1.1.1.2.7.0)
ibThresholdHigh
(3.1.1.1.1.6)
ibRevokedLicenseTrap (3.1.1.1.2.8.0)
ibThresholdLow
(3.1.1.1.1.7)
ibOperationTrap (3.1.1.1.2.9.0)
ibPreviousState

(3.1.1.1.2.10.0)
ibCurrentState

(3.1.1.1.2.11.0)
ibTrapDesc

1380 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Interpreting Infoblox SNMP Traps

Depending on the SNMP management application your management system uses, the SNMP traps you receive may
list the OIDs for all relevant MIB objects from both the ibTrapOneModule and ibNotificationVarBind trees. For OIDs
that have string values, the trap lists the text. For OIDs that contain integers, you can use the tables in this section to
find out the values. Some SNMP management applications list only the object names and their corresponding values
in the SNMP traps. Whether or not your SNMP management application lists OIDs, you can use the tables in this
section to find out the corresponding value and definition for each MIB object.
The following is a sample trap a NIOS appliance sends:
418:Jan 31 18:52:26 (none) snmptrapd[6087]: 2008-01-31 18:52:26 10.35.1.156 [UDP:
[10.35.1.156]:32772]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (1080)
0:00:10.80 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.7779.3.1.1.1.1.4.0
SNMPv2-SMI::enterprises.7779.3.1.1.1.2.1.0 = STRING: "10.35.1.156"
SNMPv2-SMI::enterprises.
7779.3.1.1.1.2.3.0 = STRING: "ntp_sync" SNMPv2-SMI::enterprises.7779.3.1.1.1.2.9.0 =
INTEGER: 15 SNMPv2-SMI::enterprises.7779.3.1.1.1.2.10.0 = INTEGER: 16
SNMPv2-SMI::enterprises.7779.3.1.1.1.2.11.0 = STRING: "The NTP service is out of
synchronization."
The sample trap lists the OIDs and their corresponding values that can help you identify the cause of an event or
problem. To identify the possible cause and recommended actions for the trap, use the ibTrapDesc tables. For
information, see ibTrapDesc (OID 3.1.1.1.2.11.0) on page 1396.
You can interpret the sample trap as follows:
Using the ibTrapOneModule table, you find out OID 7779.3.1.1.1.1.4.0 represents an Object State Change trap. This
trap includes the following objects: ibNodeName, ibOjectName, ibPreviousState, ibCurrentState, and ibtrapDesc. For
each object, the trap displays the OID and its corresponding value. The following is how you can interpret the rest of
the trap:
• ibNodeName (OID 7779.3.1.1.1.2.1.0)
— Using the ibNotificationVarBind (OID 3.1.1.1.2) table, you find out OID 7779.3.1.1.1.2.1.0 represents the
MIB object ibNodeName, which is the IP address of the appliance on which the trap occurred. Therefore, the
statement “7779.3.1.1.1.2.1.0 = STRING: "10.35.1.156" SNMPv2-SMI::enterprises.” tells
you the IP address of the appliance on which the trap occurred.
• ibObjectName (OID 7779.3.1.1.1.2.3.0)
— The statement “7779.3.1.1.1.2.3.0 = STRING: "ntp_sync" SNMPv2-SMI::enterprises.” tells
you the MIB object ibOjectName, which is the name of the object for which the trap was generated, has a
value of “ntp_sync” that indicates NTP synchronization issues.
• ibPreviousState (OID 7779.3.1.1.1.2.9.0)
— The statement “7779.3.1.1.1.2.9.0 = INTEGER: 15 SNMPv2-SMI::enterprises.” tells you the
MIB object ibPreviousState, which indicates the previous state of the appliance, has a value of 15. Using
the ibPreviousState and ibCurrentState Values table, you know that 15 represents “ntp-sync-up”, which
means the NTP server was up and running.
• ibCurrentState (OID 7779.3.1.1.1.2.10.0)
— The statement “7779.3.1.1.1.2.10.0 = INTEGER: 16 SNMPv2-SMI::enterprises.” tells you the
MIB object ibCurrentState, which indicates the current state of the appliance, has a value of 16. Using the
ibPreviousState and ibCurrentState Values table, you know that 16 represents “ntp-sync-down”, which
means the NTP server is now out of sync.
• ibTrapDesc (OID 7779.3.1.1.1.2.11.0)
— The last statement “7779.3.1.1.1.2.11.0 = STRING: "The NTP service is out of
synchronization." states the description of the trap. Using the Object State Change Traps table for
ibTrapDesc, you can find out the trap description and recommended actions for this problem.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1381

Monitoring with SNMP

Types of Traps (OID 3.1.1.1.1)

ibTrapOneModule defines the types of traps that the NIOS appliance can send. There are five types of SNMP traps.
Table 39.4 describe the types of traps and their objects in the ibTrapOneModule tree.

Table 39.4 ibTrapOneModule

OID Trap Type MIB Object Description

3.1.1.1.1.1 Equipment ibEquipmentFailureTrap The NIOS appliance generates this trap when a
Failure hardware failure occurs. This trap includes the
following objects:
• ibNodeName
• ibTrapSevertiy
• ibObjectName (equipment name)
• ibProbableCause
• ibTrapDesc
For a list of trap descriptions, see Equipment
Failure Traps on page 1397.
3.1.1.1.1.2 Processing and ibProcessingFailureTrap The NIOS appliance generates this trap when a
Software failure occurs in one of the software processes. This
Failure trap includes the following objects:
• ibNodeName
• ibTrapSeverity
• ibSubsystemName
• ibProbableCause
• ibTrapDesc
For a list of trap descriptions, see Processing and
Software Failure Traps on page 1398.

1382 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

OID Trap Type MIB Object Description

3.1.1.1.1.3 Threshold ibThresholdCrossingEvent The NIOS appliance generates this trap when any of
Crossing the following events occur:
• System memory or disk usage exceeds 90%.
• CPU usage exceeds the trigger value for 15
seconds.
• A problem occurs when the Grid Master
replicates its database to its Grid members.
• DHCP address usage crosses a watermark
threshold. For more information about tracking
IP address usage, see Threshold Crossing
Traps on page 1405.
• The number or percentage of the DNS security
alerts exceeds the thresholds of the DNS
security alert triggers.
This trap includes the following objects:
• ibNodeName
• ibTrapSeverity
• ibObjectName (threshold name)
• ibCurThresholdvalue
• ibThresholdHigh
• ibThresholdLow
• ibTrapDesc
For a list of trap descriptions, see Threshold
Crossing Traps on page 1405.
3.1.1.1.1.4 Object State ibStateChangeEvent The NIOS appliance generates this trap when there
Change is a change in its state, such as:
• The link to one of the configured ports goes
down, and then goes back up again.
• A failover occurs in an HA (high availability)
pair configuration.
• A member connects to the Grid Master.
• An appliance in a Grid goes offline.
This trap includes the following objects:
• ibNodeName
• ibTrapSeverity
• ibObjectName
• ibPreviousState
• ibCurrentState
• ibTrapDesc
For a list of possible trap descriptions, see Object
State Change Traps on page 1414.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1383

Monitoring with SNMP

OID Trap Type MIB Object Description

3.1.1.1.1.5 Process Started ibProcStartStopTrap The NIOS appliance generates this type of trap
and Stopped when any of the following events occur:
• When you enable HTTP redirection.
• When you change the HTTP access setting.
• When you change the HTTP session time out
setting.
• When a failover occurs in an HA pair
configuration.
This trap includes the following objects:
• ibNodeName
• ibSubsystemName
• ibTrapDesc
For a list of possible trap descriptions, see Process
Started and Stopped Traps on page 1418.
3.1.1.1.1.6 ibRevokedLicenseTrap The NIOS appliance generates this trap when a
license is revoked.
This trap includes the following objects:
• ibNodeName
• ibTrapSeverity
• ibSubsystemName
• ibTrapDesc
3.1.1.1.1.7 ibOperationTrap The NIOS appliance generates this trap when a
software operation is noteworthy.
This trap includes the following objects:
• ibNodeName
• ibTrapSeverity
• ibSubsystemName
• ibProbableCause
• ibTrapDesc

Trap Binding Variables (OID 3.1.1.1.2)

Each SNMP trap contains information about the event or the problem. The Infoblox SNMP traps include MIB objects
and their corresponding values from the ibNotificationVarBind module. Table 39.5 describes the objects in the
ibNotificationVarBind module.

Table 39.5 ibNotificationVarBind (OID 3.1.1.1.2)

Note: The OIDs shown in the following table do not include the prefix “.1.3.6.1.4.1.7779.”.

MIB Object
OID Description
(Type)
3.1.1.1.2.1.0 ibNodeName The IP address of the appliance on which the trap occurs. This may or
(DisplayString) may not be the same as the appliance that sends the trap. This object
is used in all types of traps.

1384 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

MIB Object
OID Description
(Type)
3.1.1.1.2.2.0 ibTrapSeverity The severity of the trap. There are five levels of severity. See Trap
(Integer) Severity (OID 3.1.1.1.2.2.0) on page 1386 for details.

3.1.1.1.2.3.0 ibObjectName The name of the object for which the trap was generated. This is used
(DisplayString) in the Equipment Failure traps, Threshold Crossing Event traps, and
the Object State Change traps. The following shows what this object
represents depending on the type of traps:
• Equipment Failure traps: The equipment name.
• Threshold Crossing Event traps: The object name of the trap.
• State Change traps: The object that changes state.
3.1.1.1.2.4.0 ibProbableCause The probable cause of the trap. See ibProbableCause Values on page
(Integer) 1386 for the definitions of each value.

3.1.1.1.2.5.0 ibSubsystemName The subsystem for which the trap was generated, such as NTP or
(DisplayString) SNMP. This object is used in the Processing and Software Failure traps
and the Process Start and Stop traps. See ibSubsystemName Values
(OID 3.1.1.1.2.5.0) on page 1391 for definitions.
3.1.1.1.2.6.0 ibCurThresholdValue The current value of the threshold counter. This object is used in the
(Integer) Threshold Crossing traps.

3.1.1.1.2.7.0 ibThresholdHigh This object is used in Threshold Crossing traps. For CPU usage, this is
(Integer) the trigger value of the SNMP trap. For DHCP address usage, this is the
value of the high watermark. This only applies when the appliance
sends a trap to indicate that DHCP address usage is above the
configured high watermark value for a DHCP address range. For more
information, see Threshold Crossing Traps on page 1405.
3.1.1.1.2.8.0 ibThresholdLow This object is used in Threshold Crossing traps. For CPU usage, this is
(Integer) the reset value of the SNMP trap. For DHCP address usage, this is the
value for the low watermark. This only applies when the appliance
sends a trap to indicate that DHCP address usage went below the
configured low watermark value for a DHCP address range. For more
information, see Threshold Crossing Traps on page 1405.
3.1.1.1.2.9.0 ibPreviousState The previous state of the appliance. This object is used in the Object
(Integer) State Change traps. See ibPreviousState (OID 3.1.1.1.2.9.0) and
ibCurrentState (OID 3.1.1.1.2.10.0) on page 1393 for definitions of
each value.
3.1.1.1.2.10.0 ibCurrentState The current state of the appliance. This object is used in the Object
(Integer) State Change traps. See ibPreviousState (OID 3.1.1.1.2.9.0) and
ibCurrentState (OID 3.1.1.1.2.10.0) on page 1393 for the definition
of each value.
3.1.1.1.2.11.0 ibTrapDesc The description of the trap. This object is used in all types of traps.
(DisplayString) See ibTrapDesc (OID 3.1.1.1.2.11.0) on page 1396 for the
description, possible cause, and recommended actions for each
Infoblox SNMP trap.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1385

Monitoring with SNMP

Trap Severity (OID 3.1.1.1.2.2.0)

The object ibTrapSeverity defines the severity level for each Infoblox SNMP trap. There are five levels of severity.

Value Description

1 Undetermined
2 Informational: Event that requires no further action.
3 Minor: Event that does not require user intervention.
4 Major: Event that requires user intervention and assistance from Infoblox
Technical Support.
5 Critical: Problem that affects services and system operations, and requires
assistance from Infoblox Technical Support.

ibProbableCause Values (OID 3.1.1.1.2.4.0)

Table 39.6 lists the values that are associated with the object ibProbableCause (OID 3.1.1.1.2.4.0). These values
provide information about the events such as hardware, software for process failures, that trigger SNMP traps.

Table 39.6 ibProbableCause Values

OID 3.1.1.2.4.0
Value Equipment, Software, or Process Failure Traps
ibProbableCause
0 ibClear SNMP Trap is cleared.
1 ibUnknown An unknown failure has occurred.
2 ibPrimaryDiskFailure Primary drive is full.
3 ibFanFailure-old Unused.
4 ibPowerSupplyFailure A power supply failure has occurred.
5 ibDBFailure A database daemon monitoring failure has occurred.
6 ibApacheSoftwareFailure An apache software failure has occurred.
7 ibSerialConsoleFailure An Infoblox serial console software failure has occurred.
11 ibControldSoftwareFailure A controld failure has occurred.
12 ibUpgradeFailure A system upgrade failure has occurred.
13 ibSNMPDFailure SNMP Server failure has occurred.
15 ibSSHDSoftwareFailure An SSH daemon failure has occurred.
16 ibNTPDSoftwareFailure An NTP daemon failure has occurred.
17 ibClusterdSoftwareFailure A cluster daemon failure has occurred.
18 ibLCDSoftwareFailure An LCD daemon failure has occurred.
19 ibDHCPdSoftwareFailure A DHCP daemon monitoring failure has occurred.
20 ibNamedSoftwareFailure A named daemon monitoring failure has occurred.
21 ibAuthServerGroupDown NAC Authentication server group is down.

1386 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

OID 3.1.1.2.4.0
Value Equipment, Software, or Process Failure Traps
ibProbableCause
22 ibAuthServerGroupUp NAC Authentication server group is up.
24 ibNTLMSoftwareFailure An NTLM monitoring failure has occurred.
25 ibNetBIOSDaemonFailure A NetBIOS daemon monitoring failure has occurred.
26 ibWindowBindDaemonFailure An NT domain service monitoring failure has occurred.
27 ibTFTPDSoftwareFailure A TFTPD daemon failure has occurred.
28 ibUNUSED28 Unused.
29 ibBackupSoftwareFailure Backup failed.
30 ibBackupDatabaseSoftwareFailure Database backup failed.
31 ibBackupModuleSoftwareFailure Module backup failed.
32 ibBackupSizeSoftwareFailure File size exceeded the quota. Backup failed.
33 ibBackupLockSoftwareFailure Another backup is in progress. Backup will not be
performed.
34 ibHTTPFileDistSoftwareFailure An HTTP file distribution daemon failure has occurred.
35 ibOSPFSoftwareFailure An OSPF routing daemon failure has occurred.
36 ibAuthDHCPNamedSoftwareFailure An auth named server failure has occurred.
37 ibFan1Failure Fan 1 failure has occurred.
38 ibFan2Failure Fan 2 failure has occurred.
39 ibFan3Failure Fan 3 failure has occurred.
40 ibFan1OK Fan 1 is OK.
41 ibFan2OK Fan 2 is OK.
42 ibFan3OK Fan 3 is OK.
44 ibFTPDSoftwareFailure An FTPD daemon failure has occurred.
45 ibBloxtoolsSoftwareFailure A Bloxtools service failure has occurred.
46 ibPowerSupplyOK The power supply is OK.
47 ibWebUISoftwareFailure A WebUI software failure has occurred.
48 ibUNUSED48 Unused.
49 ibADAgentSyncFailure An AD agent client synchronizing domain data failure has
occurred.
50 ibIFMAPSoftwareFailure An IF-MAP server failure has occurred.
51 ibCaptivePortalSoftwareFailure A Captive Portal service failure has occurred.
52 ibDuplicateIPAddressFailure A Duplicate IP Address has been detected.
53 ibBGPSoftwareFailure An BGP routing daemon failure has occurred.
54 ibRevokedLicense A license has been revoked.
58 ibGUILoginFailure An admin failed to log in to the GUI.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1387

Monitoring with SNMP

OID 3.1.1.2.4.0
Value Equipment, Software, or Process Failure Traps
ibProbableCause
59 ibSerialConsoleLoginFailure An admin failed to log in to the serial console.
60 ibSystemReboot A system reboot was initiated.
61 ibSystemRestart A system restart was initiated.
62 ibZoneTransferFailure A zone transfer failure occurred.
63 ibDHCPLeaseConflict DHCP address conflicts with an existing lease.
64 ibDHCPAddressConflict DHCP address conflicts with an existing fixed address.
65 ibDHCPRangeConflict DHCP address conflicts with an existing range.
66 ibDHCPHostConflict DHCP address conflicts with an existing host.
67 ibSyslogFailure A syslog daemon failure occurred.
68 ibPowerSupply1Failure Power supply 1 failure has occurred.
69 ibPowerSupply2Failure Power supply 2 failure has occurred.
70 ibPowerSupply1OK Power supply 1 is OK.
71 ibPowerSupply2OK Power supply 2 is OK.
72 ibReportingTaskSwFailure A reporting task monitoring failure has occurred.
73 ibReportingDbBackupFailure A reporting db backup/restore operation failure has
occurred.
74 ibFan4Failure Fan 4 failure has occurred.
75 ibFan5Failure Fan 5 failure has occurred.
76 ibFan6Failure Fan 6 failure has occurred.
77 ibFan7Failure Fan 7 failure has occurred.
78 ibFan8Failure Fan 8 failure has occurred.
79 ibFan4OK Fan 4 is OK.
80 ibFan5OK Fan 5 is OK.
81 ibFan6OK Fan 6 is OK.
82 ibFan7OK Fan 7 is OK.
83 ibFan8OK Fan 8 is OK.
84 ibOSPF6SoftwareFailure OSPF for IPv6 failed.
85 ibOCSPResponderFailure OCSP responder failed.
86 ibReportingAlertTriggered A reporting alert is triggered.
87 ibCapturedQueriesUploadFailure Upload for captured DNS queries failed.
88 ibLDAPServerFailure The LDAP server failed.
89 ibRIRWIPRegistrationFailure RIR SWIP registration failed.
90 ibPowerSupply1Removed Power supply 1 has been removed.

1388 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

OID 3.1.1.2.4.0
Value Equipment, Software, or Process Failure Traps
ibProbableCause
91 ibPowerSupply2Removed Power supply 2 has been removed.
92 ibIPMISensorErrorDetected Error detected on the sensor for the IPMI port (used for
LOM)
93 ibDiscoveryConsolidatorTaskSwFailure Discovery service on the Consolidator failed.
94 ibDiscoveryCollectorTaskSwFailure Discovery service on probes failed.
95 ibDiscoveryBackupSwFailure Discovery backup service failed.
96 ibThreatProtectionAutoDownloadFailure Automatic download of threat protection rule failed.
97 ibThreatProtectionPublishFailure Threat protection rule publish failed.
98 ibPassiveHANodeARPConnectivityFailure HA node failed to connect to local router.
99 ibPassiveHANodeARPConnectivitySuccess HA node successfully connects to local router.
100 ibDNSIntegrityCheckConnectionFailed Connection between Grid member and Grid Master failed.
101 ibDNSIntegrityCheckPrimaryServersFailed DNS data (NS RRset) check for Grid primaries failed.
102 ibDNSIntegrityCheckNameserversFailed DNS data (NS RRset) check for name servers failed.
103 ibCloudAPIFailure Cloud API service failed.
104 ibRpzRefreshFailure An RPZ refresh failure has occurred.
3001 ibRAIDIsOptimal The system’s RAID array is now running in an optimal
state.
3002 ibRAIDIsDegraded The system’s RAID array is in a degraded state.
3003 ibRAIDIsRebuilding The system’s RAID array is rebuilding.
3004 ibRAIDStatusUnknown Unable to retrieve RAID array state!
3005 ibRAIDBatteryIsOK The system’s RAID battery is OK.
3006 ibRAIDBatteryFailed A RAID battery failure has occurred.
3007 ibRAIDOptimalMismatch The system's RAID array is now running in an optimal state
(Mismatched disk(s) found).
3008 ibRAIDDegradedMismatch The system's RAID array is in a degraded state
(Mismatched disk(s) found).
3009 ibRAIDRebuildingMismatch The system's RAID array is rebuilding (Mismatched disk(s)
found).
3010 ibRAIDBatteryWeak Please replace the system's RAID battery soon.
3011 ibRAIDIsDegradedDisk1 The system's RAID array is in a degraded state. RAID Disk1
is EMPTY.
3012 ibRAIDIsDegradedDisk2 The system's RAID array is in a degraded state. RAID Disk2
is EMPTY.
3013 ibRAIDIsDegradedDisk3 The system's RAID array is in a degraded state. RAID Disk3
is EMPTY.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1389

Monitoring with SNMP

OID 3.1.1.2.4.0
Value Equipment, Software, or Process Failure Traps
ibProbableCause
3014 ibRAIDIsDegradedDisk4 The system's RAID array is in a degraded state. RAID Disk4
is EMPTY.
3015 ibRAIDIsDegradedDisk5 The system's RAID array is in a degraded state. RAID Disk5
is EMPTY.
3016 ibRAIDIsDegradedDisk6 The system's RAID array is in a degraded state. RAID Disk6
is EMPTY.
3017 ibRAIDIsDegradedDisk7 The system's RAID array is in a degraded state. RAID Disk7
is EMPTY.
3018 ibRAIDIsDegradedDisk8 The system's RAID array is in a degraded state. RAID Disk8
is EMPTY.
3019 ibRAIDIsRebuildingDisk1 The system's RAID array is rebuilding. RAID Disk1 is
OFFLINE.
3020 ibRAIDIsRebuildingDisk2 The system's RAID array is rebuilding. RAID Disk2 is
OFFLINE.
3021 ibRAIDIsRebuildingDisk3 The system's RAID array is rebuilding. RAID Disk3 is
OFFLINE.
3022 ibRAIDIsRebuildingDisk4 The system's RAID array is rebuilding. RAID Disk4 is
OFFLINE.
3023 ibRAIDIsRebuildingDisk5 The system's RAID array is rebuilding. RAID Disk5 is
OFFLINE.
3024 ibRAIDIsRebuildingDisk6 The system's RAID array is rebuilding. RAID Disk6 is
OFFLINE.
3025 ibRAIDIsRebuildingDisk7 The system's RAID array is rebuilding. RAID Disk7 is
OFFLINE.
3026 ibRAIDIsRebuildingDisk8 The system's RAID array is rebuilding. RAID Disk8 is
OFFLINE.
3027 ibRAIDDegradedMismatchDisk1 The system's RAID array is in a degraded state
(Mismatched disk(s) found). RAID Disk1 is EMPTY.
3028 ibRAIDDegradedMismatchDisk2 The system's RAID array is in a degraded state
(Mismatched disk(s) found). RAID Disk2 is EMPTY.
3029 ibRAIDDegradedMismatchDisk3 The system's RAID array is in a degraded state
(Mismatched disk(s) found). RAID Disk3 is EMPTY.
3030 ibRAIDDegradedMismatchDisk4 The system's RAID array is in a degraded state
(Mismatched disk(s) found). RAID Disk4 is EMPTY.
3031 ibRAIDDegradedMismatchDisk5 The system's RAID array is in a degraded state
(Mismatched disk(s) found). RAID Disk5 is EMPTY.
3032 ibRAIDDegradedMismatchDisk6 The system's RAID array is in a degraded state
(Mismatched disk(s) found). RAID Disk6 is EMPTY.
3033 ibRAIDDegradedMismatchDisk7 The system's RAID array is in a degraded state
(Mismatched disk(s) found). RAID Disk7 is EMPTY.

1390 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

OID 3.1.1.2.4.0
Value Equipment, Software, or Process Failure Traps
ibProbableCause
3034 ibRAIDDegradedMismatchDisk8 The system's RAID array is in a degraded state
(Mismatched disk(s) found). RAID Disk8 is EMPTY.
3035 ibRAIDRebuildingMismatchDisk1 The system's RAID array is rebuilding (Mismatched disk(s)
found). RAID Disk1 is OFFLINE.
3036 ibRAIDRebuildingMismatchDisk2 The system's RAID array is rebuilding (Mismatched disk(s)
found). RAID Disk2 is OFFLINE.
3037 ibRAIDRebuildingMismatchDisk3 The system's RAID array is rebuilding (Mismatched disk(s)
found). RAID Disk3 is OFFLINE.
3038 ibRAIDRebuildingMismatchDisk4 The system's RAID array is rebuilding (Mismatched disk(s)
found). RAID Disk4 is OFFLINE.
3039 ibRAIDRebuildingMismatchDisk5 The system's RAID array is rebuilding (Mismatched disk(s)
found). RAID Disk5 is OFFLINE.
3040 ibRAIDRebuildingMismatchDisk6 The system's RAID array is rebuilding (Mismatched disk(s)
found). RAID Disk6 is OFFLINE.
3041 ibRAIDRebuildingMismatchDisk7 The system's RAID array is rebuilding (Mismatched disk(s)
found). RAID Disk7 is OFFLINE.
3042 ibRAIDRebuildingMismatchDisk8 The system's RAID array is rebuilding (Mismatched disk(s)
found). RAID Disk8 is OFFLINE.
4001 ibDisconnectGridAttachFailed A disconnected Grid failed to attach to the Master Grid.
4002 ibDisconnectedGridDetachFailed A disconnected Grid failed to detach from the Master Grid.
4003 ibDisconnectedGridDetachFailedSubgrid An offline Grid failed to detach from the Master Grid.
Offline
4004 ibDisconnectedGridSnapshotFailed The snapshot operation failed on a disconnected Grid.
4005 ibDnssecAutomaticKSKRolloverApproching An automatic rollover of the KSK will be performed in
seven days.
4006 ibDnssecManualKSKRolloverDueApproching A manual KSK rollover is due within the next seven days.
4007 ibDnssecAutomaticKSKRolloverDone The KSK has been automatically rolled over.
4008 ibDnssecManualKSKRolloverDone The KSK has been manually rolled over.
4009 ibDnssecKSKRolloverOverdue The KSK rollover is overdue.

ibSubsystemName Values (OID 3.1.1.1.2.5.0)

Table 39.7 lists the values that are associated with the object ibSubsystemName (OID 3.1.1.1.2.5.0). These values
provide information about the subsystems that trigger the traps.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1391

Monitoring with SNMP

Table 39.7 ibSubsystemName Values

OID 3.1.1.1.2.5.0
Value
ibSubsystemName
0 Uses the original ibObjectName and ibSubsystemName
when the trap is cleared. The process failure trap is
appended to the CLEAR trap descriptions.
1 N/A
2 N/A
3 N/A
4 N/A
5 Db_jnld
6 httpd
7 serial_console
11 controld
12 N/A
13 Snmpd
15 Sshd
16 Ntpd
17 Clusterd
18 Lcd
19 Dhcpd
20 Named
24 NTLM
25 Netbiosd
26 Winbindd
27 Tftpd
29 N/A
30 db_dump
31 N/A
32 Scheduled_backups
33 N/A
34 HTTPd
35 OSPF

1392 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibPreviousState (OID 3.1.1.1.2.9.0) and ibCurrentState (OID 3.1.1.1.2.10.0)

The ibPreviousState object indicates the state of the appliance before the event triggered the trap. The ibCurrentState
object indicates the current state of the appliance. Table 39.8 shows the message and description for each state.

Table 39.8 ibPreviousState and ibCurrentState Values

Value Description Definition

1 ha-active The HA pair is in ACTIVE state.
2 ha-passive The HA pair is in PASSIVE state.
3 ha-initial The HA pair is in INITIAL state.
4 Grid-connected The Grid member is connected to the Grid Master.
5 Grid-disconnected The Grid member is not connected to the Grid Master.
6 enet-link-up The ethernet port link is active.
7 enet-link-down The ethernet port link is inactive.
8 replication-online The replication is online.
9 replication-offline The replication is offline.
10 replication-snapshotting The replication is snapshotting.
11 service-up The service is up.
12 service-down The service is down.
13 ha-replication-online The HA pair replication is online.
14 ha-replication-offline The HA pair replication is offline.
15 ntp-syn-up The NTP server is synchronizing.
16 ntp-syn-down The NTP server is out of synchronization.
17 ms-server-up Microsoft server is up.
18 ms-server-down Microsoft server is down.
19 ms-service-up Microsoft service connection is active.
20 ms-service-down Microsoft service connection is inactive.
21 nac-server-group-down NAC Authentication server group is down.
22 nac-server-group-up NAC Authentication server group is up.
23 mgm-service-up MGM service is active.
24 mgm-service-down MGM service is inactive.
25 ha-active-active HA Pair is in Dual Active state.
26 ftp-service-working FTP service is working.
27 ftp-service-failed FTP service failed.
28 ftp-service-inactive FTP service is inactive.
29 tftp-service-working TFTP service is working.
30 tftp-service-failed TFTP service failed.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1393

Monitoring with SNMP

Value Description Definition

31 tftp-service-inactive TFTP service is inactive.
32 dns-service-working DNS service is working.
33 dns-service-failed DNS service failed.
34 dns-service-inactive DNS service is inactive.
35 ntp-service-working NTP service is working.
36 ntp-service-failed NTP service failed.
37 ntp-service-inactive NTP service is inactive.
38 http-file-dist-service-working HTTP File Dist service is working.
39 http-file-dist-service-failed HTTP File Dist service failed.
40 http-file-dist-service-inactive HTTP File Dist service is inactive.
41 bloxtools-service-working bloxTools service is working.
42 bloxtools-service-warning bloxTools service is in warning state.
43 bloxtools-service-failed bloxTools service failed.
44 bloxtools-service-inactive bloxTools service is inactive.
45 dhcp-service-working DHCP service is working.
46 dhcp-service-warning DHCP service is in warning state.
47 dhcp-service-failed DHCP service failed.
48 dhcp-service-inactive DHCP service is inactive.
49 captive-portal-service-working Captive portal service is working.
50 captive-portal-service-failed Captive portal service failed.
51 captive-portal-service-inactive Captive portal service inactive.
52 ifmap-service-working IF-MAP service is working.
53 ifmap-service-failed IF-MAP service failed.
54 ifmap-service-inactive IF-MAP service inactive.
56 hsm-group-down HSM operation failed.
57 hsm-group-up HSM operation succeeded.
59 reporting-service-working Reporting service is working.
60 reporting-service-failed Reporting service failed.
61 reporting-service-inactive Reporting service inactive.
62 dns-cache-acceleration-working DNS cache acceleration is working.
63 dns-cache-acceleration-failed DNS cache acceleration failed.
64 dns-cache-acceleration-inactive DNS cache acceleration is inactive.
65 ocsp-responders-ok All OCSP responders are available.
66 ocsp-responder-failed At least one OCSP responder has become unavailable.

1394 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Value Description Definition

67 ocsp-responders-unavailable All OCSP responders are out of service.
68 ocsp-service-inactive OCSP service is inactive.
69 subgrid-attached In a Multi-Grid configuration, sub Grid is attached to the
Master Grid.
70 subgrid-detached In a Multi-Grid configuration, sub Grid is detached from
the Master Grid.
71 snapshot-disabled In a Multi-Grid configuration, the snapshot of the Grid’s
current state is disabled.
72 snapshot-enabled In a Multi-Grid configuration, the snapshot of the Grid’s
current state is enabled.
73 lb-device-up Load balancer device is working.
74 lb-device-down Load balancer device is down.
76 ldap-servers-ok All LDAP servers are available.
77 ldap-server-failure At least one LDAP server is unavailable.
78 ldap-servers-unavailable All LDAP servers are unavailable.
79 ldap-service-inactive LDAP service is inactive.
80 sgm-state-online SGM is online.
81 sgm-state-offline SGM is offline.
82 discovery-consolidator-service-working Service on discovery the consolidator for Network Insight
is working.
83 discovery-consolidator-service-warning Service on discovery the consolidator for Network Insight
is in warning state.
84 discovery-consolidator-service-failed Service on discovery the consolidator for Network Insight
failed.
85 discovery-consolidator-service-inactive Service on discovery the consolidator for Network Insight
is inactive.
86 discovery-collector-service-working Service on discovery probes for Network Insight is
working.
87 discovery-collector-service-warning Service on discovery probes for Network Insight is in
warning state.
88 discovery-collector-service-failed Service on discovery probes for Network Insight failed.
89 discovery-collector-service-inactive Service on discovery probes for Network Insight is
inactive.
90 threat-protection-service-working Threat protection service for Infoblox DNS Protection is
working.
91 threat-protection-service-warning Threat protection service for Infoblox DNS Protection is in
warning state
92 threat-protection-service-failed Threat protection service for Infoblox DNS Protection
failed.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1395

Monitoring with SNMP

Value Description Definition

93 threat-protection-service inactive Threat protection service for Infoblox DNS Protection is
inactive.
94 mgm-external-storage-disabled MGM external storage is disabled.
95 dns-integrity-check-failed DNS Integrity check for authoritative zones failed.
96 dns-integrity-check-working DNS Integrity check for authoritative zones is working.
97 dns-integrity-check-severity-indetermined DNS Integrity check severity is None.
98 dns-integrity-check-severity-normal DNS Integrity check severity is NORMAL.
99 dns-integrity-check-severity-informational DNS Integrity check severity is INFORMATIONAL.
100 dns-integrity-check-severity-warning DNS Integrity check severity is WARNING.
101 dns-integrity-check-severity-severe DNS Integrity check severity is SEVERE.
102 dns-integrity-check-severity-critical DNS Integrity check severity is CRITICAL.
103 cloud-api-service-working Cloud API service is working.
104 cloud-api-service-failed Cloud API service failed.
105 cloud-api-service-inactive Could API service is inactive.
106 dns-service-dtc-failed DNS sub-feature DNS Traffic Control failed.
107 raid-status-is-unavailable RAID hardware status is unavailable.
108 raid-status-is-available RAID hardware status is available again.
109 ipmi-device-warning IPMI device is not available.
110 ipmi-device-unavailable IPMI device repeatedly is not available.
111 ipmi-device-available IPMI device is available again.
112 rpz-refresh-working RPZ refresh is working.
113 rpz-refresh-failed RPZ refresh failed.
114 rpz-refresh-unknown RPZ refresh unknown.
117 high-rpz-hit-rate RPZ hit rate exceeds the normal value.
118 normal-rpz-hit-rate RPZ hit rate has returned to normal value.

ibTrapDesc (OID 3.1.1.1.2.11.0)

The ibTrapDesc object lists the trap messages of all Infoblox SNMP traps. This section lists all the SNMP traps by their
trap types. Each trap table describes the trap message, severity, cause, and recommended actions.

Note: Contact Infoblox Technical Support for assistance when the recommended actions do not resolve the
problems.

1396 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Equipment Failure Traps

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0 OID 3.1.1.1.2.2
Primary Drive Full
Primary drive is full. Major The primary disk drive Review the syslog file to identify the
reached 100% of usage. possible cause of this problem.

Fan Monitoring
Fan <n> failure has Minor The specified fan <n> Inspect the specified fan for mechanical or
occurred. failed, where <n> electrical problems.
indicates the fan number.
Fan <n> is OK. Informational The specified fan <n> is No action is required.
functioning properly,
where <n> indicates the
fan number.
Power Supply Failure: monitored at 1 minute
A power supply Major The power supply failed. Inspect the power supply for the possible
failure has occurred. cause of the failure.
Power supply <n> Major The specified power Inspect the specified power supply for the
failure has occurred. supply <n> failed, where possible cause of the failure.
<n> indicates the power
supply number.
The power supply is Informational The power supply is No action is required.
OK. functioning properly.
Power supply <n> is Informational The specified power No action is required.
OK. supply <n> is functioning
properly, where <n>
indicates the power
supply number.
RAID monitoring, at 1 minute interval
A RAID battery failure Major The system RAID battery Inspect the battery for the possible cause of
has occurred. failed. The alert light is the failure.
red.
The system’s RAID Informational The system RAID battery No action is required.
battery is OK. is charging and
functioning properly. The
alert light changed from
red to green.
Unable to retrieve Undetermined The appliance failed to Review the syslog file to identify the
RAID array state! retrieve the RAID array possible cause of this problem.
state. The alert light is
red.
The system’s RAID Informational The RAID system is No action is required.
array is now running functioning at an optimal
in an optimal state. state.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1397

Monitoring with SNMP

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0 OID 3.1.1.1.2.2
The system’s RAID Major The RAID system is Review the syslog file to identify the
array is in a degrading. The specified possible cause of this problem.
degraded state. RAID RAID Disk <n> is empty,
Disk <n> is EMPTY. where <n> indicates the
RAID disk number.
The system’s RAID Minor The RAID system is No action is required.
array is rebuilding. rebuilding. The specified
RAID Disk <n> is RAID Disk <n> is offline,
OFFLINE. where <n> indicates the
RAID disk number.
Syslog Backup Processes
The syslog backup Informational Rotated syslog files are No action is required.
process is uploaded successfully to
successful. the external backup
server.
The syslog backup Major Failed to forward the Review the syslog messages to identify the
process failed. rotated syslog files to the possible cause of this problem.
external backup server.

Processing and Software Failure Traps

Note: The ibSubsystemName object is associated with certain traps of the Processing and Software Failure traps.
Therefore, you cannot map all the traps of the Processing and Software Failure traps with the
ibSubsystemName. If there is no value in the ibSubsystemName, then it belongs to the N/A category. For more
information on the values for the ibSubsystemName, see the Table 39.7 on page 1392.

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0 OID 3.1.1.1.2.2
Named Daemon Failure
A named daemon Critical The named process Review the syslog file to identify the
monitoring failure failed. possible cause of this problem.
has occurred.
DHCP Daemon Failure
A DHCP daemon Critical The dhcpd process failed. Review the syslog file to identify the
monitoring failure possible cause of this problem.
has occurred.
SSH Daemon Failure
An SSH daemon Major The sshd process failed. Review the syslog file to identify the
failure has occurred. possible cause of this problem.
NTP Daemon Failure, monitored every 10 minutes
An NTP daemon Major The ntpd process failed. Review the syslog file to identify the
failure has occurred. possible cause of this problem.

1398 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0 OID 3.1.1.1.2.2
Cluster Daemon Failure
A grid daemon Critical The clusterd process Review the syslog file to identify the
failure has occurred. failed. possible cause of this problem.

LCD Daemon Failure

An LCD failure has Major The LCD process failed. 1. Inspect the LCD panel for the possible
occurred. The alert light is yellow. cause of this problem.
2. Review the syslog file to identify the
possible cause of this problem.

Apache Software httpd failure, monitored every 2 minutes

An Apache software Critical The request to monitor Review the syslog file to identify the
failure has occurred. the Apache server failed. possible cause of this problem.
Serial Console Failure
An Infoblox serial Major The Infoblox serial Review the syslog file to identify the
console software console failed. possible cause of this problem.
failure has occurred.

Controld Software Failure

A controld failure has Critical The controld process Review the syslog file to identify the
occurred. failed. possible cause of this problem.

SNMP Sub-agent Failure

An SNMP server Major The one-subagent Review the syslog file to identify the
failure has occurred. process failed. possible cause of this problem.

TFTPD and FTPD Failure

A TFTPD daemon Critical The tftpd process failed. Review the syslog file to identify the
failure has occurred. possible cause of this problem.
An FTPD daemon Critical The ftpd process failed. Review the syslog file to identify the
failure has occurred. possible cause of this problem.
HTTP File Distribution, monitored at 10 second intervals
An HTTP file Critical The HTTP file distribution Review the syslog file to identify the
distribution daemon process failed. possible cause of this problem.
failure has occurred.

DNS ONE quagga Processes (zebra & ospfd)

An OSPF routing Critical Either the zebra process Review the syslog file to identify the
daemon failure has or the ospfd process possible cause of this problem.
occurred. failed. Both the zebra and
ospfd process belongs to
ospf subsystem.

Backup Failure

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1399

Monitoring with SNMP

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0 OID 3.1.1.1.2.2
Backup failed. Minor The backup failed. Review the syslog file to identify the
One of the following possible cause of this problem.
could be the cause of the
failure:
• The appliance could
not access a backup
directory.
• The backup was
interrupted by one of
the following signals:
SIGINT, SIGHUP, or
SIGTERM.
• Incorrect login or
connection failure in
an FTP backup.
• The backup failed to
create temporary
files.

Database Backup Failure

Database backup Not The db_dump process Review the syslog file to identify the
failed. implemented failed. possible cause of this problem.

Backup Module Failure

Module backup Not The backup of product- Review the syslog file to identify the
failed. implemented specific files failed. possible cause of this problem.

Backup File Size Exceeded

File size exceeded Not The backup failed Limit the size of the backup file to less than
the quota. Backup implemented because the file size 5GB.
failed. exceeded the limit of
5GB.
Another backup is in Not The backup failed Wait until the backup or restore is complete
progress. Backup will implemented because of an attempt to before starting another backup.
not be performed. back up or merge files
while another backup or
restore was in progress.

1400 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0 OID 3.1.1.1.2.2

Watchdog Process Monitoring

WATCHDOG: Critical The watchdog process Review the syslog file to identify the
<registered client detected a registered possible cause of this problem.
name> failed on client failure on a specific
<server IP address> server.
The <registered client
name> could be one of the
following:
• Clusterd _timeout
• DB_Sentinel
• Process_Manager
• Clusterd_monitor
• Disk_monitor

Microsoft Server
Microsoft server Major The Microsoft server Check that the Microsoft server is
<hostname>/<IP could not be reached. connected to the network and configured
address> has failed. properly.
Microsoft server Informational The Microsoft server can No action is required.
<hostname>/<IP be reached and is
address> is OK. functioning properly.

Microsoft
DNS/DHCP Service
Service connection Major The Microsoft DNS Check that the DNS service is configured
to Microsoft DNS service is not responding. and running on the Microsoft server.
server
<hostname>/<IP
address> has failed.
Service connection Major The Microsoft DHCP Check that the DHCP service is configured
to Microsoft DHCP service is not responding. and running on the Microsoft server.
server
<hostname>/<IP
address> has failed.
Service connection Informational The Microsoft DNS No action is required.
to Microsoft DNS service is responding.
server
<hostname>/<IP
address> is OK.
Service connection Informational The Microsoft DHCP No action is required.
to Microsoft DHCP service is responding.
server
<hostname>/<IP
address> is OK.
NAC Authentication Server Group

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1401

Monitoring with SNMP

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0 OID 3.1.1.1.2.2
NAC Authentication Major None of the servers in the Review the syslog.
server group is down NAC authentication
server group can be
reached.
NAC Authentication Informational The NAC authentication No action is required.
server group is up server group is
responding.

GUI Login
A GUI login failure Major An admin failed to log in Check the credentials of the admin.
has occurred to the GUI.

Serial Console Login

A Serial Console Major An admin failed to log in Check the credentials and permissions, and
login failure has through the serial check that the serial console is enabled.
occurred console.
Reboot
The system is Informational A system reboot No action is required.
rebooting. command was sent.
DHCP Lease Conflict
DHCP address Major The discovery process In the IP Map or List panel, select a
conflicts with an found a DHCP lease conflicting address, and then click Resolve
existing lease. conflict. Conflict. For more information, see
Resolving DHCP Lease Conflicts on page
647.
DHCP Fixed Address Conflict
DHCP address Major The discovery process In the IP Map or List panel, select a
conflicts with an found a fixed address conflicting address, and then click Resolve
existing fixed conflict. Conflict. For more information, see
address. Resolving Fixed Address Conflicts on page
648.
DHCP Range Conflict
DHCP address Major The discovery process In the IP Map or List panel, select a
conflicts with an found a conflict with an conflicting address, and then click Resolve
existing range. existing range. Conflict. For more information, see
Resolving DHCP Range Conflicts on page
648.
DHCP Host Conflict
DHCP address Major The discovery process In the IP Map or List panel, select a
conflicts with an found a conflict with an conflicting address, and then click Resolve
existing host existing host address. Conflict. For more information, see
address. Resolving Host Conflicts on page 648.
Syslog Daemon Failure

1402 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0 OID 3.1.1.1.2.2
Syslog daemon is Critical Syslog process stopped. Review the syslog file to identify the
not running. possible cause of this problem.

Process Stop/Start
The system stopped Major The system restarted a Review the syslog file to identify the
and started a process. possible cause of this problem.
process.

Zone Transfer Failed

A zone transfer Major A zone transfer failed. Review the syslog file to identify the
failure has occurred. possible cause of this problem.

RPZ Refresh Failed

RPZ refresh failure Critical An RPZ refresh has failed. Review the syslog file to identify the
has occurred. The appliance sends this possible cause of this problem.
trap only when RPZ
refresh from all the
configured primary
servers fail.

Clear
SNMP Trap is N/A The SNMP Trap for LCD No action is required.
cleared. LCD failure failure is cleared.
SNMP Trap is N/A The SNMP Trap for Serial No action is required.
cleared. Serial Console is cleared.
Console
SNMP Trap is N/A The SNMP Trap for No action is required.
cleared. ControlD ControlD failure is
failure cleared.
SNMP Trap is N/A The SNMP Trap for GUI No action is required.
cleared. GUI Login Login is cleared.
SNMP Trap is N/A The SNMP Trap for Serial No action is required.
cleared. Serial Console Login is cleared.
Console Login
SNMP Trap is N/A The SNMP Trap for SSHD No action is required.
cleared. SSHD failure failure is cleared.

Restart
The system is being Informational A system restart No action is required.
restarted. command was sent.

DNS Integrity Check

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1403

Monitoring with SNMP

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0 OID 3.1.1.1.2.2
Cannot perform DNS N/A The DNS integrity check No action is required.
Integrity Check cannot be performed
because the because the appliance is
appliance is unable unable to connect to the
to connect to the external DNS server.
external DNS server.
There are list of
nameservers failure:
<IP addresses>

1404 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Threshold Crossing Traps

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause
Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0
System Memory Usage
System has run Major memory The appliance ran out of memory. Review the syslog
out of memory. The appliance encountered this file to identify the
problem when one of the following possible cause of
occurred: this problem.
• The total free memory on the
appliance was less than or
equal to 0%.
• The total physical memory was
less than the total free memory.
• The percentage of free memory
compared to the total physical
memory was less than 5%, and
the free swap percentage was
less than 80%.
• The percentage of free memory
compared to the total physical
memory was less than 5%, plus
the numbers of both swap INs
and swap OUTs were greater
than or equal to 3,200.
• The percentage of free memory
compared to the total physical
memory was between 5% and
10%, the free swap percentage
was greater than or equal to
80%, plus the numbers of both
swap INs and swap OUTs were
greater than or equal to 3,200.
• The percentage of free memory
compared to the total physical
memory was greater than 10%,
the free swap percentage was
less than 80%, plus the
numbers of both swap INs and
swap OUTs were greater than or
equal to 3,200.

Note: Free memory = free physical

RAM + free cache buffers.
The high threshold for swap
pages is 3,200.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1405

Monitoring with SNMP

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0
System memory Minor memory The memory usage on the appliance Review the syslog
usage exceeds exceeded the configured Trigger file to identify the
the critical value. For more information, see possible cause of
threshold value. Defining Thresholds for Traps on this problem.
page 1369.
The appliance encountered this
problem when one of the following
occurred:
• The percentage of free memory
compared to the total physical
memory was less than 5%, and
the free swap percentage was
less than 90%.
• The percentage of free memory
compared to the total physical
memory was less than 5%, plus
the number of swap INs was
less than 3,200 and the number
of swap OUTs was greater than
or equal to 3,200.
• The percentage of free memory
compared to the total physical
memory was between 5% and
10%, and the free swap
percentage was less than 80%.
• The percentage of free memory
compared to the total physical
memory was greater than 5%,
plus the number of swap INs
was less than 3,200 and the
number of swap OUTs was
greater than or equal to 3,200.

Note: Free memory = free physical

RAM + free cache buffers.
The high threshold for swap
pages is 3,200.

System memory Minor memory The memory usage on the system is No action is
is OK. at or below the Reset value after it required.
went above the Trigger value.

1406 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0

Primary Hard Drive Usage (monitored every 30 seconds)

System primary Minor disk_usage The appliance sends this trap when Review the syslog
hard disk usage is primary hard disk usage first file to identify the
over threshold exceeds the configured Trigger possible cause of
value. value. The default value is 85. The this problem.
alert light is yellow.
For more information, see Defining
Thresholds for Traps on page 1369.
Primary drive is Major disk_usage The primary hard disk usage Review the syslog
full. exceeded 95%. The alert light is red. file to identify the
possible cause of
this problem.
Primary drive Minor disk_usage The appliance sends this trap when No action is
usage is OK. the primary hard disk usage first required.
moves at or below the configured
Reset value after it exceeded the
Trigger value. The default is 70. The
alert light is green.
CPU Usage
CPU usage above Major cpu_usage CPU usage exceeded the Trigger Monitor CPU usage.
threshold value. value for 15 seconds.
For more information, see Defining
Thresholds for Traps on page 1369.
CPU usage OK. Minor cpu_usage CPU usage dipped below the reset No action is
value after the “CPU usage above required.
threshold value” trap was sent.

Note: Use the CLI command set thresholdtrap to enable the CPU usage trap and configure the trigger and reset
values. For information, refer to the Infoblox CLI Guide.

Swap Usage
System swap Major swap_usage System swap space usage exceeded Monitor System
space usage the Trigger value. swap usage.
exceeds the For more information, see Defining
critical threshold Thresholds for Traps on page 1369.
value.
System swap Minor swap_usage System swap space usage dipped No action is
space usage is below the reset value after it required.
OK. exceeded the Trigger value.
Replication Statistics Monitoring

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1407

Monitoring with SNMP

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0
Grid queue N/A For send trap: The system encountered this Review the syslog
replication Cluster_Send_ problem when all of the following file to identify the
problem. Queue conditions occurred: possible cause of
For receive • The node was online. this problem.
trap: • The number of the replication
Cluster_Recv_ queue being sent from the
Queue master column was greater than
0, or the number of the queue
received was greater than 0.
• It was more than 10 minutes
since the last replication queue
was sent and monitored.
DHCP Range Threshold Crossing
DHCP high N/A Threshold The system encountered this Review the syslog
threshold problem when the address usage in file to identify the
crossed: the DHCP range is greater than the possible cause of
Member: configured High Trigger value. this problem.
<DHCP server
node VIP>
Network:
<network>/
<network view>
Range: <DHCP
range>/ <network
view>
High Trigger Mark:
<high percentage>
(95% by default)
High Reset Mark:
<reset
percentage> (80%
by default)
Current Usage:
<current usage
percentage>
Active Leases:
<number of active
leases>
Available Leases:
<number of
available leases>
Total Addresses:
<total addresses>

1408 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0
DHCP high N/A Threshold The system encountered this
threshold reset: problem when the address usage in
Member: the DHCP range goes below the
Reset value after it hit the Trigger
<DHCP server
value.
node VIP>
Network:
<network>/
<network view>
Range: <DHCP
range>/<network
view>
High Trigger Mark:
<high percentage>
(95% by default)
High Reset Mark:
<reset
percentage> (80%
by default)
Current Usage:
<current usage
percentage>
Active Leases:
<number of active
leases>
Available Leases:
<number of
available leases>
Total Addresses:
<total addresses>
IPAM Utilization Threshold Crossing
Network IPAM N/A Threshold The appliance sends this trap when Review the syslog
Utilization the IPAM utilization for a network is file to identify the
capacity usage is above the configured Trigger value. possible cause of
over the this problem.
threshold value.
Network:
<network>/
<network view>

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1409

Monitoring with SNMP

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0
Network N/A Threshold The appliance sends this trap when Review the syslog
Container IPAM the IPAM utilization for a network file to identify the
Utilization container is above the configured possible cause of
capacity usage is Trigger value. this problem.
over the
threshold value.
Network
container:
<network>/
<network view>
Network IPAM N/A Threshold The appliance sends this trap when Review the syslog
Utilization the IPAM utilization for a network is file to identify the
capacity usage is below the configured Reset value. possible cause of
OK. Network: this problem.
<network>/
<network view>
Network N/A Threshold The appliance sends this trap when Review the syslog
Container IPAM the IPAM utilization for a network file to identify the
Utilization container is below the configured possible cause of
capacity usage is Reset value. this problem.
OK. Network
container:
<network>/
<network view>
DHCP DDNS Updates Deferred
DHCP DNS N/A Threshold The DNS updates were deferred Review the syslog
updates deferred: because of DDNS update errors. file to identify the
Retried at least possible cause of
once: <number of this problem.
retries>
Maximum
number of
deferred updates
since start of
problem episode
(or restart): <max
number>
RPZ Hit Rate
RPZ hit rate N/A Threshold The appliance sends this trap when Review the syslog
exceed normal the RPZ hit rate exceeds the file to identify the
value. configured Trigger value. possible cause of
this problem.
RPZ hit rate has N/A Threshold The appliance sends this trap when Review the syslog
returned to the RPZ hit rate equals the file to identify the
normal value. configured Reset value. possible cause of
this problem.

1410 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0

Threat Protection Total Traffic

Threat Protection N/A Threshold The appliance sends this trap when Review the syslog
Service total the Treat Protection total traffic file to identify the
traffic is above exceeds the configured Trigger possible cause of
threshold. value. this problem.
Threat Protection N/A Threshold The appliance sends this trap when Review the syslog
Service total the Threat Protection total traffic is file to identify the
traffic is OK. less than the configured Reset value. possible cause of
this problem.

Threat Protection Dropped Traffic

Threat Protection N/A Threshold The appliance sends this trap when Review the syslog
Service dropped the Treat Protection dropped traffic file to identify the
traffic is above exceeds the configured Trigger possible cause of
threshold. value. this problem.
Threat Protection N/A Threshold The appliance sends this trap when Review the syslog
Service dropped the Threat Protection dropped traffic file to identify the
traffic is OK. is less than the configured Reset possible cause of
value. this problem.

Database Capacity Usage

Database Minor db_usage The appliance database usage Increase the
capacity used is exceeded the configured threshold database capacity.
over the value.
threshold value.
Database Minor db_usage The appliance database usage is No action is
capacity used is less than the configured threshold required.
OK. value.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1411

Monitoring with SNMP

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0

DNS Monitor
DNS security Major dns_security_ DNS security alert. There were actual 1. Review the
alert. There were port DNS responses to invalid ports in following:
actual DNS the last minute, comprising — DNS alert
responses to percent% of all responses. Primary status
invalid ports in sources: ip_address sent count, — syslog file
the last minute, ip_address sent count.
comprising 2. Limit access or
where
percent% of all block
• actual is the total number of connections
responses.
DNS responses arrive on invalid from the
Primary sources:
ports. primary
ip_address sent
count, ip_address • percent% is the percentage of sources. For
sent count. invalid DNS responses over the information,
total number of DNS responses. see Configuring
• ip_address is the IP address of Rate Limiting
the primary source that Rules on page
generated the invalid DNS 1354.
responses.
• count is the number of invalid
responses generated by the
specified IP address.
Example:
DNS security alert. There were 1072
DNS responses to invalid ports in
the last minute, comprising 92% of
all responses. Primary sources:
10.0.0.0 sent 1058, 2.2.2.2 sent 14.

1412 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0
DNS security N/A dns_security_t DNS security alert. There were actual 1. Review the
alert. There were xid DNS responses with invalid TXID in following:
actual DNS the last minute, comprising — DNS alert
responses with percent% of all responses. Primary status
invalid TXID in the sources: ip_address sent count,
— syslog file
last minute, ip_address sent count.
comprising 2. Limit access or
where
percent% of all block
• actual is the total number of connections
responses.
DNS responses that have from the
Primary sources:
invalid TXIDs. primary
ip_address sent
count, ip_address • percent% is the percentage of sources. For
sent count. invalid DNS responses over the information,
total number of DNS responses. see Configuring
• ip_address is the IP address of Rate Limiting
the primary source that Rules on page
generated the invalid DNS 1354.
responses.
• count is the number of invalid
responses generated by the
specified IP address.
Example:
DNS security alert. There were 1072
DNS responses with invalid TXID in
the last minute, comprising 92% of
all responses. Primary sources:
10.0.0.0 sent 1058, 2.2.2.2 sent 14.

RootFS Partition Monitor

Root file system is Major Root The Root filesystem usage exceeded Review the syslog
full. filesystem the maximum. file to identify the
possible cause of
this problem.
Root file system Minor Root The appliance sends this trap when Review the syslog
disk usage is over filesystem the Root filesystem usage first file to identify the
threshold value. exceeds the configured Trigger possible cause of
value. this problem.
Root file system Minor Root The appliance sends this trap when No action
disk usage is OK. filesystem the Root filesystem disk usage first
moves at or below the configured
Reset value after it exceeded the
Trigger value. For information on
setting the Trigger and Reset values,
see Defining Thresholds for Traps on
page 1369.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1413

Monitoring with SNMP

ibTrapDesc ibObjectName
Recommended
OID ibTrapSeverity OID Description/Cause Actions
3.1.1.1.2.11.0 3.1.1.1.2.3.0

Reporting
Reporting drive is Major Reporting Reporting drive reached the Review the syslog
full. maximum capacity. file to identify the
possible cause of
this problem.
Reporting drive Minor Reporting The appliance sends this trap when Review the syslog
usage is over the Reporting volume first exceeds file to identify the
threshold value. the configured Trigger value. The possible cause of
default Trigger value is 80. this problem.
Reporting drive Minor Reporting The appliance sends this trap when No action
usage is OK. the Reporting volume first moves at
or below the configured Reset value
after it exceeded the Trigger value.
The default Reset value is 71.
For information on setting the Trigger
and Reset values, see Defining
Thresholds for Traps on page 1369.
File Distribution
File Distribution N/A File File distribution service storage Review the syslog
services storage Distribution reached the configured threshold file to identify the
usage reached value. possible cause of
the threshold this problem.
value.

Object State Change Traps

ibTrapDesc
ibTrapSeverity Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0
Service Shutdown
Shutting down services Major The appliance is shutting down its No action is required.
due to database services while synchronizing the
snapshot. database with the Grid Master.
Network Interfaces Monitoring
LAN1 port link is down. Major The LAN1 port is up, but the link is Check the LAN1 link
Please check the down. connection.
connection.
LAN2 port link is down. Major The LAN2 port is up, but the link is Check the LAN2 link
Please check the down. connection.
connection.
HA port link is down. Major The HA port is up, but the link is down. Check the HA link
Please check the connection.
connection.

1414 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibTrapDesc
ibTrapSeverity Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0
MGMT port link is down. Major The MGMT port is enabled, but the link Check the MGMT link
Please check the is down. connection.
connection.
LAN1 port link is up. Major The LAN1 port link is up and running. No action is required.
LAN2 port link is up. Major The LAN2 port link is up and running. No action is required.
HA port link is up. Major The HA port link is up and running. No action is required.
MGMT port link is up. Major The MGMT port link is up and running. No action is required.
HA State Change from Initial to Active
The node has become Informational A node in an HA pair becomes active. No action is required.
ACTIVE. The HA pair starts up.

HA State Change from Passive to Active

The node has become Informational The node changed from a passive to an No action is required.
ACTIVE. active node.

HA State Change to Active-Active

The node is in an Informational The node is in the active state. No action is required.
ACTIVE-ACTIVE state.

HA State Change from Initial to Passive

The node has become Informational A node in an HA pair becomes passive. No action is required.
PASSIVE. The HA pair starts up, and the node is
not a Grid Master candidate.

Node Connected to Grid

The grid member is Informational The Grid member joined the Grid, and it No action is required.
connected to the grid is not a Grid Master candidate.
master.

Node Disconnected from Grid

The grid member is not Informational The Grid member lost its connection to No action is required.
connected to the grid the Grid Master.
master.
Replication State Monitoring
HA replication is online. Informational The HA replication is online. No action is required.
HA replication is offline. Informational The HA replication is offline. No action is required.

NTP is out of sync, monitored every 30 seconds

The NTP service is out of Major The Infoblox NTP server and the Review the syslog file to
synchronization. external NTP server are not identify the possible
synchronized. cause of this problem.
NTP Service is working. Informational The NTP service started working again. No action is required.

NTP service is synchronizing to local clock

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1415

Monitoring with SNMP

ibTrapDesc
ibTrapSeverity Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0
The NTP service is Major The Infoblox NTP server synchronizes No action is required.
synchronizing to local its clients with its local clock.
clock.

DHCP service state change

DHCP Service is working Informational The DHCP service started working No action is required.
again.
DHCP Service is in a Informational The DHCP service is in a warning state. Review the syslog file
warning state.
DHCP Service is inactive. Informational The DHCP service became inactive. Check if an admin
disabled the service.

DNS service state change

DNS Service is working. Informational The DNS service started working again. No action is required.
DNS Service is in a Informational The DNS service is in a warning state. Review the syslog file
warning state.
DNS Service is inactive. Informational The DNS service became inactive. Check if an admin
disabled the service.

NTP service state change

The NTP service resumed Informational The NTP service started working again. No action is required.
synchronization.
NTP Service is inactive. Informational The NTP service became inactive. Check if an admin
disabled the service.

TFTP service state change

TFTP Service is working Informational The TFTP service started working again. No action is required.
TFTP Service is inactive Informational The TFTP service became inactive. Check if an admin
disabled the service.

FTP service state change

FTP Service is working Informational The FTP service started working again. No action is required.
FTP Service is inactive Informational The FTP service became inactive. Check if an admin
disabled the service.

HTTP service state change

HTTP File Dist Service is Informational The HTTP file distribution service No action is required.
working started working again.
HTTP File Dist Service is Informational The HTTP file distribution service Check if an admin
inactive became inactive. disabled the service.

bloxTools service state change

BloxTools Service is Informational The bloxTools service started working No action is required.
working. again.

1416 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibTrapDesc
ibTrapSeverity Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0
BloxTools Service is in Informational The bloxTools service is in a warning Review the syslog file
warning state state.
BloxTools Service is Informational The bloxTools service became inactive. Check if an admin
inactive. disabled the service.
BloxTools Service failed. Critical The bloxTools daemon failed. Review the syslog file

Captive Portal service state change

Captive Portal Service is Informational The captive portal service started No action is required.
working. working again.
Captive Portal Service is Informational The captive portal service became Check if an admin
inactive. inactive. disabled the service.

Discovery Collector service state change

Discovery Collector Informational The discovery collector service started No action is required.
Service is working. working again.
Discovery Collector Informational The discovery collector service became Check if an admin
Service is inactive. inactive. disabled the service.

Discovery Collector service state change

Discovery Consolidator Informational The discovery consolidator service No action is required.
Service is working. started working again.
Discovery Consolidator Informational The discovery consolidator service Check if an admin
Service is inactive. became inactive. disabled the service.

IF-MAP service state change

IFMAP Service is inactive. Informational The IF-MAP service became inactive. Check if an admin
disabled the service.

LDAP service state change

LDAP service is inactive. Informational The LDAP service became inactive. Check if an admin
disabled the service.

OCSP service state change

OCSP service is working. Informational The OCSP service started working No action is required.
again.
OCSP service is inactive. Informational The OCSP service became inactive. Check if an admin
disabled the service.

Reporting service state change

Reporting Service is Informational The Reporting service started working No action is required.
working. again.
Reporting Service is Informational The Reporting service became inactive. Check if an admin
inactive. disabled the service.

Threat protection service state change

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1417

Monitoring with SNMP

ibTrapDesc
ibTrapSeverity Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0
Threat Protection Service Informational The Threat protection service started No action is required.
is working. working again.
Threat Protection Service Informational The Threat protection service became Check if an admin
is inactive. inactive. disabled the service.

RPZ refresh state change

RPZ refresh is OK. Informational An RPZ refresh succeeded. The No action is required.
appliance sends this trap when the RPZ
refresh is successful after a previous
failure.

Process Started and Stopped Traps

ibTrapDesc
ibTrapSeverity Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0
Httpd Start
The process started Informational The httpd process started. No action is required.
normally.

Httpd Stop
The process stopped Informational The httpd process stopped. No action is required.
normally.

Process Stop/Start
The system stopped and Major The system restarted a process. No action is required.
started a process.

Zone Transfer Failed

A zone transfer failure has Critical A zone transfer failed. Review the syslog file
occurred.

Revoked License Trap

ibTrapDesc ibTrapSeverity
Description/Cause Recommended Actions
OID 3.1.1.1.2.11.0
Revoked License
This trap is generated Critical A license was revoked. Obtain and install new
when a license is license
revoked

1418 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibPlatformOne MIB
The ibPlatformOne MIB provides information about the CPU temperature of the appliance, the replication status, the
average latency of DNS requests, DNS security alerts, CPU and memory utilization of the appliance, and the Infoblox
service status. Figure 39.4 illustrates the structure of the PlatformOne MIB. (Note that the OIDs in the illustration do
not include the prefix .1.3.6.1.4.1.7779.)
The ibPlatformOne MIB contains the following objects:
• ibCPUTemperature (IbString) tracks the CPU temperature of the appliance.
• ibClusterReplicationStatusTable provides information in tabular format about the replication status of the
appliance. For information, see ibClusterReplicationStatusTable on page 1421.
• ibNetworkMonitor provides information about the average latency of authoritative and nonauthoritative replies
to DNS queries for different time intervals. It also provides information about invalid DNS responses that arrive
on invalid ports or have invalid DNS transaction IDs. For information, see ibNetwork Monitor on page 1422.
• ibHardwareType (IbString) provides information about the hardware platform. For an Infoblox appliance, it
provides the model number of the Infoblox hardware platform. For vNIOS appliances, it identifies whether the
hardware platform is Riverbed or VMware.
• ibHardwareId (IbString) provides the hardware ID of the NIOS appliance.
• ibSerialNumber (IbString) provides the serial number of the Infoblox hardware platform.
• ibNiosVersion (IbString) provides the version of the NIOS software.
• ibSystemMonitor provides information about the CPU and memory utilization of the appliance. For information,
see ibSystemMonitor on page 1429.
• ibGridStatus provides information about an appliance. It indicates whether the appliance is a Grid Master,
member, or an independent appliance.
• ibHAStatus provides information about the HA status of a member. It indicates if the member is part of an HA
configuration, and if it is the active or passive node.
• ibGridMasterCandStatus indicates if a member is a Grid Master candidate.
• ibGridMasterVIP provides the Grid Master virtual IP address.
• ibGridReplicationState provides information about the replication status.
The ibPlatformOne MIB also contains the following tables that provide status of the Infoblox services as well as
system and hardware services on the appliance you query:
• ibMemberServiceStatusTable provides status of the Infoblox services, such as the DNS and DHCP services, on a
queried appliance. For information, see ibMemberServiceStatusTable on page 1429.
• ibMemberNodeServiceStatusTable provides status of the system and hardware services on a queried
appliance. For information, see ibMemberNodeServiceStatusTable on page 1432.
• ibMemberPassiveNodeServiceStatusTable provides status of the system and hardware services on the passive
node of an HA pair if the queried appliance is the VIP or the active node of an HA pair. For independent
appliances and the passive nodes of HA pairs, this table does not display any status. For information, see
ibMemberPassiveNodeServiceStatusTable on page 1433.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1419

Monitoring with SNMP

Figure 39.4 ibPlatformOne MIB Structure

(3.1.1.2) ibPlatformOne MIB

(3.1.1.2.1) ibPlatformOneModule

(3.1.1.2.1.1)
ibCPUTemperature

(3.1.1.2.1.2)
ibClusterReplicationStatusTable ibClusterReplicationStatusTable Objects on page

(3.1.1.2.1.3)
ibNetworkMonitor ibNetWorkMonitor Objects on page 1423

(3.1.1.2.1.4)
ibHardwareType

(3.1.1.2.1.5)
ibHardwareId

(3.1.1.2.1.6)
ibSerialNumber

(3.1.1.2.1.7)
ibNiosVersion

(3.1.1.2.1.8) ibSystemMonitor Objects3 on page 1429

ibSystemMonitor

(3.1.1.2.1.9)
ibMemberServiceStatusTable ibMemberServiceStatusTable Objects on page 1430

(3.1.1.2.1.10)
ibMemberNodeServiceStatusTable ibMemberNodeServiceStatusTable Objects on page 1433

(3.1.1.2.1.11)
ibMemberPassiveNodeServiceStatusTable ibMemberPassiveNodeServiceStatusTable Objects on page
1433
(3.1.1.2.1.12)
ibGridStatus

(3.1.1.2.1.13)
ibHAStatus

(3.1.1.2.1.14)
ibGridMasterCandStatus
(3.1.1.2.1.15)
ibGridMasterVIP

(3.1.1.2.1.16)
ibGridReplicationState

1420 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibClusterReplicationStatusTable
ibClusterRepliactionStatusTable (object ID 3.1.1.2.1.2.1) provides information about the Grid replication status. For
information about Infoblox SNMP traps, see ibTrapDesc (OID 3.1.1.1.2.11.0) on page 1396.
Figure 39.5 shows the sub branches of ibClusterReplicationStatusTable.

Figure 39.5 ibClusterReplicationStatusTable Objects

(3.1.1.2.1.2)
ibClusterReplicationStatusTable

(3.1.1.2.1.2.1)
ibClusterReplicationStatusEntry

(3.1.1.2.1.2.1.1)
ibNodeIPAddress

(3.1.1.2.1.2.1.2)
ibNodeReplicationStatus

(3.1.1.2.1.2.1.3)
ibNodeQueueFromMaster

(3.1.1.2.1.2.1.4)
ibNodeLastRepTimeFromMaster

(3.1.1.2.1.2.1.5)
ibNodeQueueToMaster
(3.1.1.2.1.2.1.6)
ibNodeLastRepTimeToMaster

Table 39.9 provides information about the ibClusterReplicationStatusTable objects.

Table 39.9 ibClusterReplicationStatusTable Objects

Object  Description
(Type)
ibClusterReplicationStatusEntry A conceptual row that provides information about the Grid replication status.
The status indicates whether the appliance is sending replication queues,
receiving queues, or having problems with the replication.
ibNodeIPAddress IP address of a Grid member.
(IbIpAddr)
ibNodeReplicationStatus Replication status of the Grid member. The replication status can be one of the
(IbString) following: online, offline, or snapshotting.
ibNodeQueueFromMaster “Sent” queue size from master.
(Integer)
ibNodeLastRepTimeFromMaster Last sent time from master.
(IbString)
ibNodeQueueToMaster “Receive” queue size from master.
(Integer)
ibNodeLastRepTimeToMaster Last receive time from master.
(IbString)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1421

Monitoring with SNMP

ibNetwork Monitor
As shown in Figure 39.6, the ibNetwork Monitor has one subtree, ibNetworkMonitorDNS, that branches out into the
following:
• ibNetworkMonitorDNSActive (Integer) reports on whether DNS latency monitoring is enabled. You can enable
DNS latency monitoring using the CLI command set monitor dns. For more information, see Enabling and
Disabling DNS Alert Monitoring on page 1351. This is the only object in this branch. When you send a query for
this object, the appliance responds with either “active” (1) or “nonactive” (0).
• ibNetworkMonitorDNSNonAA provides information about the average latency of nonauthoritative replies to DNS
queries for 1-, 5-, 15-, and 60-minute intervals. For information, see ibNetworkMonitorDNSNonAA Objects on
page 1425.
• ibNetworkMonitorDNSAA provides information about the average latency of authoritative replies to DNS queries
for 1-, 5-, 15-, and 60-minute intervals. For information, see ibNetworkMonitorDNSAA Objects on page 1426.
• ibNetworkMonitorDNSSecurity provides information about the invalid DNS responses that arrive on invalid
ports or have invalid DNS transaction IDs. ibNetworkMonitorDNSSecurity branches out into the following:
— ibNetworkMonitorDNSSecurityInvalidPort
— ibNetworkMonitorDNSSecurityInvalidTxid
— ibNetworkMonitorDNSSecurityInvalidPortOnly (Counter)
— ibNetworkMonitorDNSSecurityInvalidPortCount (Counter)
— ibNetworkMonitorDNSSecurityInvalidTxidOnly (Counter)
— ibNetworkMonitorDNSSecurityInvalidTxidCount (Counter)
— ibNetworkMonitorDNSSecurityInvalidTxidAndPort (Counter)
For information, see Table 39.12 on page 1427.

1422 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Figure 39.6 ibNetWorkMonitor Objects

(3.1.1.2.1.3)
ibNetworkMonitor

(3.1.1.2.1.3.1)
ibNetworkMonitorDNS

(3.1.1.2.1.3.1.1)
ibNetworkMonitorDNSActive

(3.1.1.2.1.3.1.2)
ibNetworkMonitorDNSNonAA

(3.1.1.2.1.3.1.3)
ibNetworkMonitorDNSAA

(3.1.1.2.1.3.1.4)
ibNetworkMonitorDNSSecurity

(3.1.1.2.1.3.1.4.1)
ibNetworkMonitorDNSSecurityInvalidPort

(3.1.1.2.1.3.1.4.2)
ibNetworkMonitorDNSSecurityInvalidTxid

(3.1.1.2.1.3.1.4.3)
ibNetworkMonitorDNSSecurityInvalidPortOnly

(3.1.1.2.1.3.1.4.4)
ibNetworkMonitorDNSSecurityInvalidTxidOnly

(3.1.1.2.1.3.1.4.5)
ibNetworkMonitorDNSSecurityInvalidTxidAndPort

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1423

Monitoring with SNMP

Figure 39.7 ibNetworkMonitorDNSNonAA and ibNetworkMonitorDNSAA Subtrees

(3.1.1.2.1.3.1) (3.1.1.2.1.3.1)
ibNetworkMonitorDNS ibNetworkMonitorDNS

(3.1.1.2.1.3.1.2) (3.1.1.2.1.3.1.3)
ibNetworkMonitorDNSNonAA ibNetworkMonitorDNSAA

(3.1.1.2.1.3.1.2.1) (3.1.1.2.1.3.1.3.1)
ibNetworkMonitorDNSNonAAT1 ibNetworkMonitorDNSAAT1
(3.1.1.2.1.3.1.2.1.1) (3.1.1.2.1.3.1.3.1.1)
ibNetworkMonitorDNSNonAAT1AvgLatency ibNetworkMonitorDNSAAT1AvgLatency
(3.1.1.2.1.3.1.2.1.2) (3.1.1.2.1.3.1.3.1.2)
ibNetworkMonitorDNSNonAAT1Count ibNetworkMonitorDNSAAT1Count

(3.1.1.2.1.3.1.2.2) (3.1.1.2.1.3.1.3.2)
ibNetworkMonitorDNSNonAAT5 ibNetworkMonitorDNSNonAAT5
(3.1.1.2.1.3.1.2.2.1) (3.1.1.2.1.3.1.3.2.1)
ibNetworkMonitorDNSNonAAT5AvgLatency ibNetworkMonitorDNSAAT5AvgLatency
(3.1.1.2.1.3.1.2.2.2) (3.1.1.2.1.3.1.3.2.2)
ibNetworkMonitorDNSNonAAT5Count ibNetworkMonitorDNSAAT5Count

(3.1.1.2.1.3.1.2.3) (3.1.1.2.1.3.1.3.3)
ibNetworkMonitorDNSNonAAT15 ibNetworkMonitorDNSAAT15
(3.1.1.2.1.3.1.2.3.1) (3.1.1.2.1.3.1.3.3.1)
ibNetworkMonitorDNSNonAAT15AvgLatency ibNetworkMonitorDNSAAT15AvgLatency
(3.1.1.2.1.3.1.2.3.2) (3.1.1.2.1.3.1.3.3.2)
ibNetworkMonitorDNSNonAAT15Count ibNetworkMonitorDNSAAT15Count

(3.1.1.2.1.3.1.2.4) (3.1.1.2.1.3.1.3.4)
ibNetworkMonitorDNSNonAAT60 ibNetworkMonitorDNSAAT60
(3.1.1.2.1.3.1.2.4.1) (3.1.1.2.1.3.1.3.4.1)
ibNetworkMonitorDNSNonAAT60AvgLatency ibNetworkMonitorDNSAAT60AvgLatency
(3.1.1.2.1.3.1.2.4.2) (3.1.1.2.1.3.1.3.4.2)
ibNetworkMonitorDNSNonAAT60Count ibNetworkMonitorDNSAAT60Count

(3.1.1.2.1.3.1.2.5) (3.1.1.2.1.3.1.3.5)
ibNetworkMonitorDNSNonAAT1440 ibNetworkMonitorDNSAAT1440
(3.1.1.2.1.3.1.2.5.1) (3.1.1.2.1.3.1.3.5.1)
ibNetworkMonitorDNSNonAAT1440AvgLatency ibNetworkMonitorDNSAAT1440AvgLatency
(3.1.1.2.1.3.1.2.5.2) (3.1.1.2.1.3.1.3.5.2)
ibNetworkMonitorDNSNonAAT1440Count ibNetworkMonitorDNSAAT1440Count

1424 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Table 39.10 describes the objects in ibNetworkMonitorDNSNonAA. You can send queries to retrieve values for these
objects.

Table 39.10 ibNetworkMonitorDNSNonAA Objects

Object
Description
(Type)
ibNetworkMonitorDNSNonAAT1 File that contains the objects for monitoring the average latency
of nonauthoritative replies to queries in the last minute.
ibNetworkMonitorDNSNonAAT1AvgLatency Indicates the average latency in microseconds of
(Integer) nonauthoritative replies to queries in the last minute.

ibNetworkMonitorDNSNonAAT1Count Indicates the number of queries used to calculate the average

(Integer) latency of nonauthoritative replies in the last minute.

ibNetworkMonitorDNSNonAAT5 File that contains the objects for monitoring the average latency
of nonauthoritative replies to queries in the last five minutes.
ibNetworkMonitorDNSNonAAT5AvgLatency Indicates the average latency in microseconds of
(Integer) nonauthoritative replies to queries in the last five minutes.

ibNetworkMonitorDNSNonAAT5Count Indicates the number of queries used to calculate the average

(Integer) latency of nonauthoritative replies in the last five minutes.

ibNetworkMonitorDNSNonAAT15 File that contains the objects for monitoring the average latency
of nonauthoritative replies to queries in the last 15 minutes.
ibNetworkMonitorDNSNonAAT15AvgLatency Indicates the average latency in microseconds of
(Integer) nonauthoritative replies to queries in the last 15 minutes.

ibNetworkMonitorDNSNonAAT15Count Indicates the number of queries used to calculate the average

(Integer) latency of nonauthoritative replies in the last 15 minutes.

ibNetworkMonitorDNSNonAAT60 File that contains the objects for monitoring the average latency
of nonauthoritative replies to queries in the last 60 minutes.
ibNetworkMonitorDNSNonAAT60AvgLatency Indicates the average latency in microseconds of
(Integer) nonauthoritative replies to queries in the last 60 minutes.

ibNetworkMonitorDNSNonAAT60Count Indicates the number of queries used to calculate the average

(Integer) latency of nonauthoritative replies in the last 60 minutes.

ibNetworkMonitorDNSNonAAT1440 File that contains the objects for monitoring the average latency
of nonauthoritative replies to queries in the last 24 hours.
ibNetworkMonitorDNSNonAAT1440AvgLatency Indicates the average latency in microseconds of
(Integer) nonauthoritative replies to queries in the last 24 hours.

ibNetworkMonitorDNSNonAAT1440Count Indicates the number of queries used to calculate the average

(Integer) latency of nonauthoritative replies in the last 24 hours.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1425

Monitoring with SNMP

Table 39.11 describes the objects in ibNetworkMonitorDNSAA. You can send queries to retrieve values for these
objects.

Table 39.11 ibNetworkMonitorDNSAA Objects

Object
Description
(Type)
ibNetworkMonitorDNSAAT1 File that contains the objects for monitoring the average latency
of authoritative replies to queries in the last minute.
ibNetworkMonitorDNSAAT1AvgLatency Indicates the average latency in microseconds of authoritative
(Integer) replies to queries in the last minute.

ibNetworkMonitorDNSAAT1Count Indicates the number of queries used to calculate the average

(Integer) latency of authoritative replies in the last minute.

ibNetworkMonitorDNSAAT5 File that contains the objects for monitoring the average latency
of authoritative replies to queries in the last five minutes.
ibNetworkMonitorDNSAAT5AvgLatency Indicates the average latency in microseconds of authoritative
(Integer) replies to queries in the last five minutes.

ibNetworkMonitorDNSAAT5Count Indicates the number of queries used to calculate the average

(Integer) latency of authoritative replies in the last five minutes.

ibNetworkMonitorDNSAAT15 File that contains the objects for monitoring the average latency
of authoritative replies to queries in the last 15 minutes.
ibNetworkMonitorDNSAAT15AvgLatency Indicates the average latency in microseconds of authoritative
(Integer) replies to queries in the last 15 minutes.

ibNetworkMonitorDNSAAT15Count Indicates the number of queries used to calculate the average

(Integer) latency of authoritative replies in the last 15 minutes.

ibNetworkMonitorDNSAAT60 File that contains the objects for monitoring the average latency
of authoritative replies to queries in the last 60 minutes.
ibNetworkMonitorDNSAAT60AvgLatency Indicates the average latency in microseconds of authoritative
(Integer) replies to queries in the last 60 minutes.

ibNetworkMonitorDNSAAT60Count Indicates the number of queries used to calculate the average

(Integer) latency of authoritative replies in the last 60 minutes.

ibNetworkMonitorDNSAAT1440 File that contains the objects for monitoring the average latency
of authoritative replies to queries in the last 24 hours.
ibNetworkMonitorDNSAAT1440AvgLatency Indicates the average latency in microseconds of authoritative
(Integer) replies to queries in the last 24 hours.

ibNetworkMonitorDNSAAT1440Count Indicates the number of queries used to calculate the average

(Integer) latency of authoritative replies in the last 24 hours.

1426 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Table 39.12 describes the objects in ibNetworkMonitorDNSSecurity. You receive SNMP traps with these objects when
you enable the following:
• SNMP traps
• DNS network monitoring
• DNS alert monitoring

Table 39.12 ibNetworkMonitorDNSSecurity Objects

Object
Description
(Type)
ibNetworkMonitorDNSSecurityInvalidPort Tracks the number of invalid DNS responses that arrive on
invalid ports. For information about invalid ports, see
Monitoring DNS Transactions on page 1350.
This object contains a subtree with six objects that track
invalid ports within a certain time interval. For information,
see Table 39.13.
ibNetworkMonitorDNSSecurityInvalidTxid Tracks the number of invalid TXIDs (DNS transaction IDs).
For information about invalid TXIDs, see Monitoring DNS
Transactions on page 1350.
This object contains a subtree with six objects that track
invalid TXIDs within a certain time interval. For information,
see Table 39.14.
ibNetworkMonitorDNSSecurityInvalidPortOnly Tracks the number of DNS responses with both of the
(Counter) following conditions:
• Arrive on invalid ports
• Have valid TXIDs
ibNetworkMonitorDNSSecurityInvalidTxidOnly Tracks the number of DNS responses with both of the
(Counter) following conditions:
• Arrive on valid ports
• Have Invalid TXIDs
ibNetworkMonitorDNSSecurityInvalidPortCount Tracks the total number of invalid DNS responses that arrive
(Counter) on invalid ports.

ibNetworkMonitorDNSSecurityInvalidTxidCount Tracks the total number of DNS responses that have invalid
(Counter) DNS transaction IDs.

ibNetworkMonitorDNSSecurityInvalidTxidAndPort Tracks the number of DNS responses with both of the

(Counter) following conditions:
• Arrive on invalid ports
• Have invalid TXIDs

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1427

Monitoring with SNMP

Table 39.13 describes the objects in ibNetworkMonitorDNSSecurityInvalidPort.

Table 39.13 ibNetworkMonitorDNSSecurityInvalidPort Objects

Object
Description
(Type)
ibNetworkMonitorDNSSecurityInvalidPort1 Tracks the number of invalid DNS responses that arrive on
(Integer) invalid ports in the last one minute.
ibNetworkMonitorDNSSecurityInvalidPort5 Tracks the number of invalid DNS responses that arrive on
(Integer) invalid ports in the last five minutes.
ibNetworkMonitorDNSSecurityInvalidPort15 Tracks the number of invalid DNS responses that arrive on
(Integer) invalid ports in the last 15minutes.
ibNetworkMonitorDNSSecurityInvalidPort60 Tracks the number of invalid DNS responses that arrive on
(Integer) invalid ports in the last 60 minutes.
ibNetworkMonitorDNSSecurityInvalidPort1440 Tracks the number of invalid DNS responses that arrive on
(Integer) invalid ports in the last 24 hours.
ibNetworkMonitorDNSSecurityInvalidPortCount Tracks the total number of invalid DNS responses that arrive
(Counter) on invalid ports.

Table 39.14 describes the objects in ibNetworkMonitorDNSSecurityInvalidTxid.

Table 39.14 ibNetworkMonitorDNSSecurityInvalidTxid Objects

Object
Description
(Type)
ibNetworkMonitorDNSSecurityInvalidTxid1 Tracks the number of DNS responses that have invalid DNS
(Integer) transaction IDs in the last one minute.
ibNetworkMonitorDNSSecurityInvalidTxid5 Tracks the number of DNS responses that have invalid DNS
(Integer) transaction IDs in the last five minutes.
ibNetworkMonitorDNSSecurityInvalidTxid15 Tracks the number of DNS responses that have invalid DNS
(Integer) transaction IDs in the last 15 minutes.
ibNetworkMonitorDNSSecurityInvalidTxid60 Tracks the number of DNS responses that have invalid DNS
(Integer) transaction IDs in the last 60 minutes.
ibNetworkMonitorDNSSecurityInvalidTxid1440 Tracks the number of DNS responses that have invalid DNS
(Integer) transaction IDs in the last 24 hours.
ibNetworkMonitorDNSSecurityInvalidTxidCount Tracks the total number of DNS responses that have invalid
(Counter) DNS transaction IDs.

1428 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibSystemMonitor
As shown in Figure 39.4, ibSystemMonitor (object ID 3.1.1.2.1.2.8) has the following subtrees:
• ibSystemMonitorCpu: Contains ibSystemMonitorCpuUsage (Integer) that reports the CPU usage of the
appliance.
• ibSystemMonitorMem: Contains ibSystemMonitorMemUsage (Integer) that reports the memory usage of the
appliance.

Figure 39.8 ibSystemMonitor Objects3

(3.1.1.2.1.8)
ibSystemMonitor

(3.1.1.2.1.8.1)
ibSystemMonitorCpu
(3.1.1.2.1.8.1.1)
ibSystemMonitorCpuUage

(3.1.1.2.1.8.2)
ibSystemMonitorMem

(3.1.1.2.1.8.2.1)
ibSystemMonitorMemUsage

ibMemberServiceStatusTable
As shown in Figure 39.9, ibMemberServiceStatusTable (object ID 3.1.1.2.1.2.9) has one subtree,
ibMemberServiceStatusEntry, which contains the following objects:
• ibServiceName (String) reports the names of the Infoblox services. For a list of Infoblox services, see Infoblox
Services for ibMemberServiceStatusTable.
• ibServiceStatus (Integer) reports the status of the Infoblox services. For a list of service status, see Service
Status on page 1432.
• ibServiceDesc (String) describes the details of the status.
ibMemberServiceStatusTable displays the current status of the Infoblox services on the appliance that you query. For
an HA pair, this table displays the service status of the active node. If the appliance you query is the passive node of
an HA pair, this table reflects the service status of the passive node, which can be “inactive” or “unknown.”
You can also query ibMemberNodeServiceStatusTable and ibMemberPassiveNodeServiceStatusTable that display
system and hardware status on the queried appliance. For information, see ibMemberNodeServiceStatusTable on
page 1432 and ibMemberPassiveNodeServiceStatusTable on page 1433.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1429

Monitoring with SNMP

Figure 39.9 ibMemberServiceStatusTable Objects

(3.1.1.2.1.9)
ibMemberServiceStatusTable

(3.1.1.2.1.9.1)
ibMemberServiceStatusEntry

(3.1.1.2.1.9.1.1)
ibServiceName

(3.1.1.2.1.9.1.2)
ibServiceStatus

(3.1.1.2.1.9.1.3)
ibServiceDesc

Infoblox Services for ibMemberServiceStatusTable

Table 39.15 lists the values and descriptions of the Infoblox services that appear in ibMemberServiceStatusTable.

Table 39.15 ibServiceName Values for ibMemberServiceStatusTable

Value Description Definition

1 dhcp DHCP service
2 dns DNS service
3 ntp NTP service
4 tftp File distribution using the TFTP service
5 http-file-dist File distribution using the HTTP service
6 ftp File distribution using the FTP service
7 bloxtools-move Moving the bloxTools service
8 bloxtools The bloxTools environment
9 node-status Member status
10 disk-usage Disk usage
11 enet-lan LAN port
12 enet-lan2 LAN2 port
13 enet-ha HA port
14 enet-mgmt MGMT port
15 lcd LCD
16 memory Memory
17 replication Replication service
18 db-object Database object
19 raid-summary RAID array

1430 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Value Description Definition

20 raid-disk1 RAID Disk 1 (For appliances with RAID arrays)
21 raid-disk2 RAID Disk 2 (For appliances with RAID arrays)
22 raid-disk3 RAID Disk 3 (For appliances with RAID arrays)
23 raid-disk4 RAID Disk 4 (For appliances with RAID arrays)
24 raid-disk5 RAID Disk 5 (For appliances with RAID arrays)
25 raid-disk6 RAID Disk 6 (For appliances with RAID arrays)
26 raid-disk7 RAID Disk 7 (For appliances with RAID arrays)
27 raid-disk8 RAID Disk 8 (For appliances with RAID arrays)
28 fan1 Fan 1
29 fan2 Fan 2
30 fan3 Fan 3
31 fan4 Fan 4
32 fan5 Fan 5
33 fan6 Fan 6
34 fan7 Fan 7
35 fan8 Fan 8
36 power-supply1 Power supply 1
37 power-supply2 Power supply 2
38 ntp-sync NTP synchronization
39 cpu1-temp CPU temperature
40 cpu2-temp CPU temperature
41 sys-temp System temperature
42 raid-battery RAID battery
43 cpu-usage CPU usage
44 ospf OSPF
45 bgp BGP
46 mgm-service Multi-Grid management
47 subGrid-conn Grid in Master Grid
48 network-capacity Network capacity
49 reporting Reporting service
50 dns-cache-acceleration DNS Cache Acceleration services
51 ospf6 OSPF6
57 cloud-api Cloud API service

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1431

Monitoring with SNMP

Service Status
When you query the service status on an appliance, the response includes the status of the services. Table 39.16
shows the values and descriptions of the status. Note that for internal Grid operations, the NTP service is always in
the “working” state even if it has been disabled through the Infoblox GUI.

Table 39.16 ibServiceStates Values

Value Description Definition

1 working The service is functioning properly.
2 warning The service is having some issues. Check the service or
hardware function and the syslog to identify the problem.
3 failed The service failed. Review the syslog to identify the problem.
4 inactive The service is disabled or out of service.
5 unknown The appliance cannot detect the current status of the
service.

ibMemberNodeServiceStatusTable
As shown in Figure 39.10, ibMemberNodeServiceStatusTable (object ID 3.1.1.2.1.10) has one subtree,
ibMemberNodeServiceStatusEntry, which contains the following objects:
• ibMemberNodeServiceName (String) reports the names of the system and hardware services. For a list of
service names, see Infoblox Services for ibMemberServiceStatusTable on page 1430.
• ibMemberNodeServiceStatus (Integer) reports the status of the services. For a list of service status, see Service
Status on page 1432.
• ibMemberNodeServiceDesc (String) describes the details of the status.
ibMemberNodeServiceStatusTable displays the current status of the system and hardware services on the appliance
that you query. For example, when you query an independent appliance, this table shows the information about the
independent appliance. When you query the VIP of an HA pair, this table shows the information about the active
node. For the active node of the HA pair, you can also query ibMemberPassiveNodeStatusTable to get the status of
the passive node. For information, see ibMemberPassiveNodeServiceStatusTable on page 1433.

Note: For an independent appliance and the passive node of an HA pair, no information is returned when you query
ibMemberPassiveNodeServiceStatusTable.

1432 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

Figure 39.10 ibMemberNodeServiceStatusTable Objects

(3.1.1.2.1.10)
ibMemberNodeServiceStatusTable

(3.1.1.2.1.10.1)
ibMemberNodeServiceStatusEntry

(3.1.1.2.1.10.1.1)
ibMemberNodeServiceName

(3.1.1.2.1.10.1.2)
ibMemberNodeServiceStatus

(3.1.1.2.1.10.1.3)
ibMemberNodeServiceDesc

ibMemberPassiveNodeServiceStatusTable
As shown in Figure 39.11, ibMemberPassiveNodeServiceStatusTable (object ID 3.1.1.2.1.2.11) has one subtree,
ibMemberPassiveNodeServiceStatusEntry, which contains the following objects:
• ibMemberPassiveNodeServiceName (String) reports the names of the system and hardware services. For a list
of service names, see Infoblox Services for ibMemberServiceStatusTable on page 1430.
• ibMemberPassiveNodeServiceStatus (Integer) reports the status of the services. For a list of possible service
status, see Service Status on page 1432.
• ibMemberPassiveNodeServiceDesc (String) describes details of the status.
ibMemberPassiveNodeServiceStatusTable displays the current status of the system and hardware services on the
passive node of an HA pair when you query the VIP of the HA pair. For independent appliances and the passive nodes
of HA pairs, this table does not display any status.

Figure 39.11 ibMemberPassiveNodeServiceStatusTable Objects

(3.1.1.2.1.11)
ibMemberPassiveNodeServiceStatusTable

(3.1.1.2.1.11.1)
ibMemberPassiveNodeServiceStatusEntry

(3.1.1.2.1.11.1.1)
ibMemberPassiveNodeServiceName

(3.1.1.2.1.11.1.2)
ibMemberPassiveNodeServiceStatus

(3.1.1.2.1.11.1.3)
ibMemberPassiveNodeServiceDesc

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1433

Monitoring with SNMP

ibDHCPOne MIB
The ibDHCPOne MIB provides information about address usage within a subnet, DHCP lease statistics, and DHCP
packet counts. It includes two modules, ibDHCPModule for IPv4 data and ibDHCPv6Module for IPv6 data.

ibDHCPModule
Figure 39.12 illustrates the structure of the ibDHCPModule. (Note that the OIDs shown in the illustration do not
include the prefix .1.3.6.1.4.1.7779.) ibDHCPModule contains the following objects:
• ibDHCPSubnetTable provides statistical data about the DHCP operations of the appliance. For information, see
ibDHCPSubnetTable on page 1435.
• ibDHCPStatistics maintains counters for different types of packets. For information, see ibDHCPStatistics on
page 1436.
• ibDHCPDeferredQueuesize tracks the total number of deferred DDNS updates that are currently in the queue to
be retried. When DDNS updates are deferred due to timeout or server issues, the DHCP server puts these
updates in this queue.
• ibDHCPDDNSStats monitors the average latency for the DDNS updates in microseconds and the number of
timeouts during different time intervals. For information, see ibDHCPDDNSStats on page 1437.

Figure 39.12 ibDHCPModule

(3.1.1.4) ibDHCPOne MIB

(3.1.1.4.1) ibDHCPModule

(3.1.1.4.1.1) (3.1.1.4.1.3) (3.1.1.4.1.4) (3.1.1.4.1.5)

ibDHCPSubnetTable ibDHCPStatistics ibDHCPDeferredQueuesize ibDHCPDDNSStats

(3.1.1.4.1.3.1) (3.1.1.4.1.5.1)
(3.1.1.4.1.1.1) ibDHCPDDNSAvgLatency5
ibDhcpTotalNoOfDiscovers
ibDHCPSubnetEntry

(3.1.1.4.1.3.2) (3.1.1.4.1.5.2)
(3.1.1.4.1.1.1.1) ibDhcpTotalNoOfRequests ibDHCPDDNSAvgLatency15
ibDHCPSubnetNetworkAddress

(3.1.1.4.1.3.3) (3.1.1.4.1.5.3)
(3.1.1.4.1.1.1.2) ibDhcpTotalNoOfReleases ibDHCPDDNSAvgLatency60
ibDHCPSubnetNetworkMask
(3.1.1.4.1.3.4) (3.1.1.4.1.5.4)
ibDhcpTotalNoOfOffers ibDHCPDDNSAvgLatency1440
(3.1.1.4.1.1.1.3)
ibDHCPSubnetPercentUsed
(3.1.1.4.1.3.5) (3.1.1.4.1.5.5)
ibDhcpTotalNoOfAcks ibDHCPDDNSTimeoutCount5

(3.1.1.4.1.3.6) (3.1.1.4.1.5.6)
ibDhcpTotalNoOfNacks ibDHCPDDNSTimeoutCount15

(3.1.1.4.1.3.7) (3.1.1.4.1.5.7)
ibDhcpTotalNoOfDeclines ibDHCPDDNSTimeoutCount60

(3.1.1.4.1.3.8) (3.1.1.4.1.5.8)
ibDhcpTotalNoOfInforms ibDHCPDDNSTimeoutCount1440

(3.1.1.4.1.3.9)
ibDhcpTotalNoOthers

1434 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibDHCPSubnetTable
ibDHCPSubnetTable provides statistical data about the DHCP operations of the appliance. It contains the following
objects:

Table 39.17 ibDHCPSubnetTable

Object
(Type) Description

ibDHCPSubnet Entry File that contains the objects for monitoring DHCP operations on the
appliance.
ibDHCPSubnetNetworkAddress The subnetworks, in IP address format, that have IP addresses for lease. A
(IbIpAddr) subnetwork may have many address ranges for lease.
ibDHCPSubnetNetworkMask The subnet mask in dotted decimal format.
(IbIpAddr)
ibDHCPSubnetPercentUsed The percentage of dynamic DHCP addresses leased out at this time for each
(Integer) subnet. Fixed addresses are always counted as leased for this calculation, if
the fixed addresses are within a leased address range.

Following is an example of the table as viewed through a MIB browser:

Figure 39.13 MIB Browser View 1

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1435

Monitoring with SNMP

ibDHCPStatistics
ibDHCPStatistics maintains counters for different types of packets. The counters always start with zero when the
DHCP service is restarted. Therefore, the numbers reflect the total number of packets received since the DHCP service
was last restarted on the appliance. The ibDHCPStatistics module contains the following objects:

Table 39.18 ibDHCPStatistics

Object
Description
(Type)
ibDhcpTotalNoOfDiscovers The number of DHCPDISCOVER messages that the appliance received. Clients
(Counter) broadcast DHCPDISCOVER messages when they need an IP address and
network configuration information.
ibDhcpTotalNoOfRequests The number of DHCPREQUEST messages that the appliance received. A client
(Counter) sends a DHCPREQUEST message requesting configuration information, after it
receives the DHCPOFFER message.
ibDhcpTotalNoOfReleases The number of DHCPRELEASE messages that the appliance received from its
(Counter) clients. A client sends a DHCP release when it terminates its lease on an IP
address.
ibDhcpTotalNoOfOffers The number of DHCPOFFER messages that the appliance has sent to clients.
(Counter) The appliance sends a DHCPOFFER message to a client. It contains an IP
address and configuration information.
ibDhcpTotalNoOfAcks The number of DHCPACK messages that the appliance sent to clients. It sends
(Counter) a DHCPACK message to a client to confirm that the IP address offered is still
available.
ibDhcpTotalNoOfNacks The number of DHCPNACK messages that the appliance sent to clients. It sends
(Counter) a DHCPNACK message to withdraw its offer of an IP address.

ibDhcpTotalNoOfDeclines The number of DHCPDECLINE messages that the appliance received. A client
(Counter) sends a DHCPDECLINE message if it determines that an offered IP address is
already in use.
ibDhcpTotalNoOfInforms The number of DHCPINFORM messages that the appliance received. A client
(Counter) sends a DHCPINFORM message when it has an IP address but needs
information about the network.
ibDhcpTotalNoOfOthers The total number of DHCP messages other than those used in negotiation, such
(Counter) as DHCPFORCERENEW, DHCPKNOWN, and DHCPLEASEQUERY.

1436 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibDHCPDDNSStats
ibDHCPDDNSStats monitors the average latency for the DHCP DDNS updates in microseconds and the number of
timeouts during different time intervals. The ibDHCPDDNSStats module contains the following objects:

Table 39.19 ibDHCPStatistics

Object
Description
(Type)
ibDHCPDDNSAvgLatency5 Indicates the average latency in microseconds of the DHCP DDNS updates in
(Integer) the last five minutes.

ibDHCPDDNSAvgLatency15 Indicates the average latency in microseconds of the DHCP DDNS updates in
(Integer) the last 15 minutes.

ibDHCPDDNSAvgLatency60 Indicates the average latency in microseconds of the DHCP DDNS updates in
(Integer) the last 60 minutes.

ibDHCPDDNSAvgLatency1440 Indicates the average latency in microseconds of the DHCP DDNS updates in
(Integer) the last 24 hours.

ibDHCPDDNSTimeoutCount5 The number of timeouts for the DHCP DDNS updates in the last five minutes.
(Integer)
ibDHCPDDNSTimeoutCount15 The number of timeouts for the DHCP DDNS updates in the last 15 minutes.
(Integer)
ibDHCPDDNSTimeoutCount60 The number of timeouts for the DHCP DDNS updates in the last 60 minutes.
(Integer)
ibDHCPDDNSTimeoutCount1440 The number of timeouts for the DHCP DDNS updates in the last 24 hours.
(Integer)

ibDHCPv6Module
Figure 39.14 illustrates the structure of the ibDHCPv6Module, which contains the following objects:
• ibDHCPv6SubnetTable provides statistical data about the DHCPv6 operations of the appliance. For information,
see ibDHCPv6SubnetTable on page 1439.
• ibDHCPv6Statistics maintains counters for different types of packets. For information, see ibDHCPv6Statistics
on page 1439.
• ibDHCPv6DeferredQueuesize tracks the total number of deferred DDNS updates that are currently in the queue
to be retried. When DDNS updates are deferred due to timeout or server issues, the DHCP server puts these
updates in this queue.
• ibDHCPv6DDNSStats monitors the average latency for the DDNS updates in microseconds and the number of
timeouts during different time intervals. For information, see ibDHCPv6DDNSStats on page 1440.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1437

Monitoring with SNMP

Figure 39.14 ibDHCPv6Module

( )

(3.1.1.4.2.1) (3.1.1.4.2.3) (3.1.1.4.2.4) (3.1.1.4.2.5)

ibDHCPv6SubnetTable ibDHCPv6Statistics ibDHCPv6DeferredQueuesize ibDHCPDDNSStats

(3.1.1.4.2.3.1) (3.1.1.4.2.5.1)
(3.1.1.4.2.1.1) ibDhcpv6TotalNoOfSolicits ibDHCPv6DDNSAvgLatency5
ibDHCPv6SubnetEntry

(3.1.1.4.2.3.2) (3.1.1.4.2.5.2)
(3.1.1.4.2.1.1.1) ibDhcpv6TotalNoOfRequest ibDHCPv6DDNSAvgLatency15
ibDHCPv6SubnetNetworkAddress s

(3.1.1.4.2.3.3) (3.1.1.4.2.5.3)
(3.1.1.4.2.1.1.2) ibDhcpv6TotalNoOfReleases ibDHCPv6DDNSAvgLatency60
ibDHCPv6SubnetNetworkMask
(3.1.1.4.2.3.4) (3.1.1.4.2.5.4)
ibDhcpv6TotalNoOfAdvertises ibDHCPv6DDNSAvgLatency1440

(3.1.1.4.2.3.5) (3.1.1.4.2.5.5)
ibDhcpv6TotalNoOfReplys ibDHCPv6DDNSTimeoutCount5

(3.1.1.4.2.3.6) (3.1.1.4.2.5.6)
ibDhcpv6TotalNoOfRenews ibDHCPv6DDNSTimeoutCount15

(3.1.1.4.2.3.7) (3.1.1.4.2.5.7)
ibDhcpv6TotalNoOfRebinds ibDHCPv6DDNSTimeoutCount60

(3.1.1.4.2.5.8)
(3.1.1.4.2.3.8) ibDHCPv6DDNSTimeoutCount1440
ibDhcpv6TotalNoOfDeclines

(3.1.1.4.2.3.9)
ibDhcpv6TotalNoOfInformationRequests

(3.1.1.4.2.3.10)
ibDhcpv6TotalNoOthers

1438 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibDHCPv6SubnetTable
ibDHCPSubnetTable provides statistical data about the DHCPv6 operations of the appliance. It contains the following
objects:

Table 39.20 ibDHCPSubnetTable

Object
(Type) Description

ibDHCPv6Subnet Entry File that contains the objects for monitoring DHCPv6 operations on the
appliance.
ibDHCPv6SubnetNetworkAddress The subnetworks, in IPv6 address format, that have IPv6 addresses for lease.
(IbIpAddr) A subnetwork may have many address ranges for lease.
ibDHCPv6SubnetNetworkMask The subnet mask in CIDR notation format.
(IbIpAddr)

ibDHCPv6Statistics
ibDHCPv6Statistics maintains counters for different types of packets. The counters always start with zero when the
DHCP service is restarted. Therefore, the numbers reflect the total number of packets received since the DHCP service
was last restarted on the appliance. The ibDHCPv6Statistics module contains the following objects:

Table 39.21 ibDHCPv6Statistics

Object
Description
(Type)
ibDhcpv6TotalNoOfSolicits The number of Solicit messages that the Grid member received,
(Counter) including Solicit messages embedded in Relay-Forward messages. A
DHCP client sends a Solicit message to locate DHCP servers.
ibDhcpv6TotalNoOfRequests The number of Request messages that the Grid member received. A
(Counter) DHCP client sends a Request message to request one or more IP
addresses and configuration parameters from a DHCP server.
ibDhcpv6TotalNoOfReleases The number of Release messages that the Grid member received. A
(Counter) DHCP client sends a Release message when it terminates its lease
and releases its IP address.
ibDhcpv6TotalNoOfAdvertises The number of Advertise messages that the Grid member sent. When
(Counter) a DHCP server receives a Solicit message, it can respond with an
Advertise message to indicate that the server is available for DHCP
service.
ibDhcpv6TotalNoOfReplies The number of Reply messages that the Grid member sent. A DHCP
(Counter) server sends a Reply message that includes IP addresses and
configuration parameters when it responds to Solicit, Request, Renew
or Rebind message. It sends a Reply message with configuration
parameters only when it responds to an Information-Request
message.
ibDhcpv6TotalNoOfRenews The number of Renew messages that the Grid member received. A
(Counter) DHCP client sends a Renew message to a DHCP server to extend the
lifetimes on the leases granted by the DHCP server and to update
other properties.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1439

Monitoring with SNMP

Object
Description
(Type)
ibDhcpv6TotalNoOfRebinds The number of Rebind messages that the Grid member received. A
(Counter) DHCP client sends a Rebind message to extend the lifetime of its
lease and to update configuration parameters.
ibDhcpv6TotalNoOfDeclines The number of Decline messages that the Grid member received. A
(Counter) DHCP client sends a Decline message to a DHCP server when it
discovers that the IP address offered by a DHCP server is already in
use.
ibDhcpv6TotalNoOfInformationRequests The number of Information-Request messages that the Grid member
(Counter) received. A client sends an Information-Request message to retrieve
configuration parameters, such as the IP addresses of DNS servers in
the network.
ibDhcpv6TotalNoOfOthers The total number of DHCP messages other than those used in
(Counter) negotiation.

ibDHCPv6DDNSStats
ibDHCPv6DDNSStats monitors the average latency for the DHCPv6 DDNS updates in microseconds and the number
of timeouts during different time intervals. The ibDHCPv6DDNSStats module contains the following objects:

Table 39.22 ibDHCPStatistics

Object
Description
(Type)
ibDHCPv6DDNSAvgLatency5 Indicates the average latency in microseconds of the DHCPv6 DDNS updates
(Integer) in the last five minutes.

ibDHCPv6DDNSAvgLatency15 Indicates the average latency in microseconds of the DHCPv6 DDNS updates
(Integer) in the last 15 minutes.

ibDHCPv6DDNSAvgLatency60 Indicates the average latency in microseconds of the DHCPv6 DDNS updates
(Integer) in the last 60 minutes.

ibDHCPv6DDNSAvgLatency1440 Indicates the average latency in microseconds of the DHCPv6 DDNS updates
(Integer) in the last 24 hours.

ibDHCPv6DDNSTimeoutCount5 The number of timeouts for the DHCPv6 DDNS updates in the last five
(Integer) minutes.

ibDHCPv6DDNSTimeoutCount15 The number of timeouts for the DHCPv6 DDNS updates in the last 15
(Integer) minutes.

ibDHCPv6DDNSTimeoutCount60 The number of timeouts for the DHCPv6 DDNS updates in the last 60
(Integer) minutes.

ibDHCPv6DDNSTimeoutCount144 The number of timeouts for the DHCPv6 DDNS updates in the last 24 hours.
0
(Integer)

1440 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibDNSOne MIB
The ibDNSOne MIB provides DNS statistics about all zones in all views. Figure 39.15 illustrates the structure of the
ibDNSOne MIB. (Note that the OIDs shown in the illustration do not include the prefix 1.3.6.1.4.1.7779.) The
ibDNSOne MIB contains four subtrees: ibZoneStatisticsTable (Counter64), ibZonePlusViewStatisticsTable
(Counter64), ibDDNSUpdateStatistics (Counter64), and ibBindZoneTransferCount (Counter64).

Figure 39.15 ibDNSOne MIB

(3.1.1.3) ibDNSOne MIB

(3.1.1.3.1) ibDnsModule

(3.1.1.3.1.1) (3.1.1.3.1.2) (3.1.1.3.1.3) (3.1.1.3.1.4)

ibZoneStatisticsTable ibZonePlusViewStatisticsTable ibDDNSUpdateStatistics ibBindZoneTransferCount

(3.1.1.3.1.1.1) (3.1.1.3.1.2.1)
ibZoneStatisticsEntry ibZonePlusViewStatisticsEntry (3.1.1.3.1.3.1)
ibDDNSUpdateSuccess
(3.1.1.3.1.1.1.1) (3.1.1.3.1.2.1.1)
ibBindZoneName ibBindZonePlusViewNa (3.1.1.3.1.3.2)
me ibDDNSUpdateFailure

(3.1.1.3.1.1.1.2) (3.1.1.3.1.2.1.2)
ibBindZoneSuccess ibBindZonePlusViewSucces (3.1.1.3.1.3.3)
s ibDDNSUpdateReject

(3.1.1.3.1.1.1.3) (3.1.1.3.1.2.1.3)
ibBindZoneReferral ibBindZonePlusViewReferral (3.1.1.3.1.3.4)
ibDDNSUpdatePrerequisiteReject
(3.1.1.3.1.1.1.4) (3.1.1.3.1.2.1.4)
ibBindZoneNxRRset ibBindZonePlusViewNxRRset

(3.1.1.3.1.1.1.5) (3.1.1.3.1.2.1.5)
ibBindZoneNxDomain ibBindZonePlusViewNxDomain

(3.1.1.3.1.1.1.6) (3.1.1.3.1.2.1.6)
ibBindZoneRecursion ibBindZonePlusViewRecursion

(3.1.1.3.1.1.1.7) (3.1.1.3.1.2.1.7)
ibBindZoneFailure ibBindZonePlusViewFailure

(3.1.1.3.1.2.1.8)
ibBindViewName

Using the DNS Zone Statistics Tables

ibZoneStatistcisTable and ibZonePlusViewStatisticsTable provide DNS statistics for all zones in all DNS views,
including the default and all user-defined DNS views. You can use the information in these tables to calculate the
total number of recursive queries on the DNS server. Depending on whether your DNS server is an authoritative or a
caching-only server, you calculate the total number of recursive queries differently. For information, see Calculating
Recursive DNS Queries on page 1443.

ibZoneStatisticsTable
ibZoneStatisticsTable contains DNS statistics of all zones in the default DNS view. DNS statistics of user-defined DNS
views are captured in ibZonePlusViewStatisticsTable. For information, see ibZonePlusViewStatisticsTable on page
1443.
ibZoneStatisticsTable includes a “summary” zone that provides global statistics for the DNS server, including
statistics for all zones in the default and user-defined DNS views.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1441

Monitoring with SNMP

The syntax of the objects in ibZoneStatisticsTable uses a Counter64 format. In some cases, the counter format may
not be compatible with SNMP toolkits that use a 32-bit counter. Ensure that you reconfigure or update these tools to
use the Counter64 format. ibZoneStatisticsTable contains the following objects:

Table 39.23 ibZoneStatisticsTable

Object
Description
(Type)
ibBindZoneName DNS zone name. The index name for global statistics is “summary.”
(IbString)
ibBindZoneSuccess The number of successful responses since the DNS process started.
(Counter64)
ibBindZoneReferral The number of DNS referrals since the DNS process started.
(Counter64)
ibBindZoneNxRRset The number of DNS queries received for non-existent records.
(Counter64)
ibBindZoneNxDomain The number of DNS queries received for non-existent domains.
(Counter64)
ibBindZoneRecursion The number recursive queries received since the DNS process started.
(Counter64)
ibBindZoneFailure The number of failed queries since the DNS process started.
(Counter64)

Following is an example of the table as viewed through a MIB browser:

Figure 39.16 MIB Browser View

1442 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

ibZonePlusViewStatisticsTable
ibZonePlusViewStatisticsTable provides DNS statistics about all zones in user-defined DNS views. DNS statistics
about zones in the default view are captured in ibZoneStatisticsTable. Note that information in
ibZonePlusViewStatisticsTable is rolled up to the “summary” zone in ibZoneStatisticsTable. For information, see
ibZoneStatisticsTable on page 1441.
The syntax of the objects in ibZonePlusViewStatisticsTable uses a Counter64 format. In some cases, the counter
format may not be compatible with SNMP toolkits that use a 32-bit counter. Ensure that you reconfigure or update
these tools to use the Counter64 format. ibZonePlusViewStatisticsTable contains the following objects:

Table 39.24 ibZonePlusViewStatisticsTable

Object
Description
(Type)
ibBindZonePlusViewName The zone name.
(IbString)
ibBindZonePlusViewSuccess The number of successful responses since the DNS process started.
(Counter64)
ibBindZonePlusViewReferral The number of DNS referrals since the DNS process started.
(Counter64)
ibBindZonePlusViewNxRRset The number of DNS queries received for non-existent records.
(Counter64)
ibBindZonePlusViewNxDomain The number of DNS queries received for non-existent domains.
(Counter64)
ibBindZonePlusViewRecursion The number of queries that caused recursion since the DNS process started.
(Counter64)
ibBindZonePlusViewFailure The number of failed queries since the DNS process started.
(Counter64)
ibBindViewName The DNS view name.
(IbString)

Calculating Recursive DNS Queries

You can use the information in ibZoneStatisticsTable and ibZonePlusViewStatisticsTable to calculate the total
number of recursive queries.
Following is an example of ibZoneStatisticsTable indexed by zone names in the default view:

index ibBindZoneNameibBindZoneSuccessibBindZoneReferralibBindZoneNxRRset
ibBindZoneNxDomainibBindZoneRecursionibBindZoneFailure
=====================================================================================================
“abc.com”abc.com000
0 0 0
“summary”summary500
0 0 0
“internal.com”internal.com100
0 0 0

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1443

Monitoring with SNMP

Following is an example of ibZonePlusViewStatisticsTable indexed by zone names in all user-defined views:

index ibBindZonePlusViewNameibBindZonePlusViewSuccessibBindZonePlusViewReferralibBindZonePlusViewNxRRset
ibBindZonePlusViewNxDomainibBindZonePlusViewRecursionibBindZonePlusViewFailureibBindViewName
=====================================================================================================
“ext1.com”ext1.com100
0 00 DNS1
“ext2.com”ext2.com200
0 00 DNS1
“ext3.com”ext3.com000
0 00 DNS2

Use the ibBindZoneSuccess object in both tables to determine the total number of recursive queries. If your DNS
server is a caching-only server, the total number of recursive queries is the number indicated in the
ibBindZoneSuccess object of the “summary” zone. In this example, for a caching-only server, the total number of
recursive queries is 5.
If your DNS server is an authoritative server, add all the numbers in ibBindZoneSuccess for all zones in both tables,
excluding the “summary” zone. In this example, the total is 4. You then subtract this number from the number in
ibBindZoneSuccess of the “summary” zone. In this case, the total number of recursive queries is 1 for an
authoritative DNS server.

ibDDNSUpdateStatistics
ibDDNSUpdateStatistics provides statistical data about DDNS updates. The counters always start with zero when the
DNS service is restarted. They report the total numbers since the DNS service was last restarted.
ibDDNSUpdateStatistics contains the following objects:

Table 39.25 ibDDNSUpdateStatistics

Object
Description
(Type)
ibDDNSUpdateSuccess The number of successful dynamic DNS updates.
(Counter64)
ibDDNSUpdateFailure The number of all failed dynamic DNS updates, excluding those reported by
(Counter64) the ibDDNSUpdateReject object.

ibDDNSUpdateReject The number of dynamic DNS updates that failed because they were denied
(Counter64) by the DNS server.

ibDDNSUpdatePrerequisiteReject The number of dynamic DNS updates that failed because the prerequisites
(Counter64) were not satisfied. This is also included in the total number of failures
reported by the ibDDNSUpdateFailure object.

ibBindZoneTransferCount
ibBindZoneTransferCount (Counter64) provides the total number of successful zone transfers from an Infoblox
primary or secondary DNS server to a DNS client, since the DNS service was last restarted. Note that this counter
tracks the number of successful full zone transfers (AXFRs) and incremental zone transfers (IXFRs).

IB-DNSSERV-MIB
The IB-DNSSERV-MIB contains one object, ibDnsServConfig, which reports the DNS BIND version implemented by the
NIOS software.

1444 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox MIBs

IB-DNSHITRATIO-MIB
The IB-DNSHITRATIO-MIB contains one object, ibDnsHitRatio, which provides information about the DNS cache hit
ratio. Note that the MIB variable (ibDNSOne) for cache hit rate has an OID of 1.3.6.1.4.1.7779.3.1.1.3.1.5.0, where
1.3.6.1.4.1.7779 is the prefix.

IB-DNSQUERYRATE-MIB
The IB-DNSQUERYRATE-MIB contains one object, ibDnsQueryRate, which provides information about the DNS queries
per second. Note that the MIB variable (ibDNSOne) for DNS query rate has an OID of 1.3.6.1.4.1.7779.3.1.1.3.1.6.0,
where 1.3.6.1.4.1.7779 is the prefix.

IB-DHCPSERV-MIB
The IB-DHCPSERV-MIB contains one object, ibDhcpv4ServerSystemDescr, which provides the DHCP server name and
its DHCP version.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1445

Monitoring with SNMP

1446 NIOS Administrator Guide (Rev. A) NIOS 7.3

Chapter 40 Infoblox Reporting and Analytics
This chapter describes the Infoblox Reporting and Analytics solution and its features. It explains how to navigate
through the user interface, view predefined dashboards and create personal reports and searches. It also provides
best practices for customizing searches and setting permissions.
It contains the following sections:
• Infoblox Reporting and Analytics on page 1451
— Licensing Requirements on page 1452
— Administrative Permissions on page 1454
— Supported Reporting Appliances and Storage Space on page 1456
— Reporting Categories and Related Data Sources on page 1457
• Grid Reporting Properties on page 1462
— Configuring Grid Reporting Properties on page 1463
— Reporting (Index) Storage Space on page 1463
— Modifying Member Reporting Properties on page 1464
— Defining Interface for Reporting Traffic on page 1465
— Setting the Network Port for Reporting on page 1465
— Configuring Threat Protection Data on page 1465
— Monitoring Client Queries on page 1466
• About IP Blocks and IP Block Groups on page 1467
— Adding IP Block Groups on page 1468
— Modifying IP Block Groups on page 1468
— Deleting IP Block Groups and IP Blocks on page 1469
— Exporting IP Block Groups and IP Blocks on page 1469
— Printing IP Block Groups and IP Blocks on page 1469
• Reporting User Interface Overview on page 1470
— Home Dashboards on page 1471
• About Searches on page 1472
— Creating Reports from a Search on page 1473
— Saving a Search as a Dashboard Panel on page 1474
— Exporting Search Results on page 1474
— Saving Search as Alerts on page 1475
• About Alerts on page 1475
— Creating Scheduled Alerts on page 1475

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1447

Infoblox Reporting and Analytics

— Editing Alerts on page 1476

— Cloning Alerts on page 1476
— Configuring Email Notification Settings on page 1476
• About Reports on page 1477
— Reporting Indexes and Update Time Intervals on page 1477
— Cloning Reports on page 1483
— Scheduling Reports on page 1483
— Configuring Logo Image in PDF Reports on page 1484
• About Dashboards on page 1485
— About Dashboard Filters on page 1488
— Creating New Dashboards on page 1485
— Cloning Dashboards on page 1485
— Editing Dashboards on page 1486
— Editing the XML Source Code of a Dashboard on page 1486
— Generate Dashboard PDFs on page 1487
— Scheduling PDF Delivery for Dashboards on page 1487
• Predefined Dashboards on page 1490
— Audit Log Events on page 1492
— DHCPv4 Top Utilized Networks on page 1493
— DNS Statistics per DNS View on page 1493
— DNS Statistics per Zone on page 1494
— IPAMv4 Network Usage Statistics on page 1494
— IPAMv4 Network Usage Trend on page 1495
— IPAMv4 Top Utilized Networks on page 1495
— Inactive IP Addresses on page 1496
— Port Capacity Utilization by Device on page 1497
— Port Capacity Delta by Device on page 1496
— Port Capacity Trend on page 1497
— Device Class Trend on page 1498
— Device Fingerprint Change Detected on page 1498
— Device Trend on page 1498
— DHCP Lease History on page 1498
— DHCP Message Rate Trend on page 1499
— DHCP Top Lease Clients on page 1499
— DHCPv4 Range Utilization Trend on page 1500
— DHCPv4 Usage Statistics on page 1500
— DHCPv4 Usage Trend on page 1500
— Top Device Classes on page 1501
— Top Devices Denied an IP Address on page 1501
— Top Devices Identified on page 1502
— DDNS Update Rate Trend on page 1502
— DNS Cache Hit Rate Trend on page 1502
— DNS Daily Peak Hour Query Rate by Member on page 1503
— DNS Domain Query Trend on page 1503
— DNS Domain Queried by Client on page 1503

1448 NIOS Administrator Guide (Rev. A) NIOS 7.3

 — Top DNS Clients by Query Type on page 1503
— Top DNS Clients Querying MX Records on page 1503
— DNS Daily Query Rate by Member on page 1503
— DNS Query Rate by Query Type on page 1503
— DNS Query Trend per IP Block Group on page 1503
— DNS Replies Trend on page 1504
— DNS Response Latency Trend on page 1504
— DNS Scavenged Object Count Trend on page 1504
— DNS Query Rate by Member on page 1504
— DNS Top Clients on page 1504
— DNS Top Clients Per Domain on page 1504
— DNS Top NXDOMAIN / NOERROR (no data) on page 1504
— DNS Top Requested Domain Names on page 1505
— DNS Resource Records Last Queried on page 1505
— DNS Top SERVFAIL Errors Sent on page 1506
— DNS Top SERVFAIL Errors Received on page 1506
— DNS Top Timed-out Recursive Queries on page 1506
— DNS Traffic Control Resource Availability Status on page 1506
— DNS Traffic Control Resource Availability Trend on page 1507
— DNS Traffic Control Resource Pool Availability Trend on page 1507
— DNS Traffic Control Resource Pool Availability Status on page 1507
— DNS Traffic Control Response Distribution Trend on page 1507
— FireEye Alerts on page 1508
— DNS Top RPZ Hits on page 1508
— DNS Top RPZ Hits by Clients on page 1510
— Top DNS Firewall Hits on page 1510
— Malicious Activity by Client on page 1510
— DNS Firewall Executive Threat Report on page 1511
— Threat Protection Event Count By Severity Trend on page 1511
— Threat Protection Event Count By Member Trend on page 1511
— Threat Protection Event Count By Rule on page 1511
— Threat Protection Event Count By Time on page 1512
— Threat Protection Event Count By Category on page 1512
— Threat Protection Event Count By Member on page 1512
— Threat Protection Top Rules Logged on page 1513
— Threat Protection Top Rules Logged by Source on page 1513
— DNS Top Tunneling Activity on page 1514
— DNS Tunneling Traffic by Category on page 1514
— Top Malware and DNS Tunneling Events by Client on page 1515
— VM Address History on page 1515
— User Login History Report on page 1515
— Subscription Data on page 1516
— Publish Data on page 1516
— CPU Utilization Trend on page 1516
— Memory Utilization Trend on page 1517

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1449

Infoblox Reporting and Analytics

— Traffic Rate by Member on page 1517

— License Pool Utilization on page 1517
— Reporting Index Usage Statistics on page 1517
— Reporting Volume Usage Trend per Category on page 1518
— Reporting Volume Usage Trend per Member on page 1518
• Managing Reporting Data on page 1518
— Upgrade Implications on page 1453
— Upgrading Reporting and Analytics App on page 1518
— Backing Up Reporting Data on page 1519
— Scheduling the Backup of the Reporting Database on page 1519
— Restoring the Reporting Database on page 1520
• Infoblox-4030 Supported Dashboards on page 1521

1450 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox Reporting and Analytics

Infoblox Reporting and Analytics

The Infoblox Reporting and Analytics solution automates the collection, analysis, and presentation of core network
service data that assists you in planning and mitigating network outage risks so you can manage your networks more
efficiently. It provides predefined dashboards and reports that capture useful information about the activities and
performance of core network services. It also provides an enhanced reporting interface so you can create custom
dashboards, reports, and alerts. You can continue to use the Infoblox predefined reports from previous releases in
the new interface and customize them to meet your specific requirements, or you can create new custom reports from
the ground up using a powerful search pattern.
When you upgrade from a previous NIOS release, you will notice that some of the reporting features and
terminologies have changed. For example, searches and reports in previous NIOS releases are now reports and
dashboards respectively in the new reporting solution. In addition, your custom reports might be affected. Infoblox
recommends that you take some time to explore the new user interface and get familiar with the terminologies.

Note: Infoblox Reporting and Analytics integrates with Splunk to deliver an enhanced reporting interface so you can
create dashboards, reports, and alerts. This chapter attempts to explain all reporting functionality you can
perform through the enhanced interface. However, you may need to refer to the Splunk documentation for
certain functionality as indicated in specific sections of this chapter. In addition, some functions and
capabilities referenced in the Splunk documentation are not available or applicable to the Infoblox Reporting
and Analytics as some Splunk functionality in the Infoblox product may be limited or modified by Infoblox.
Infoblox does not represent or warrant that Infoblox Reporting and Analytics will function in accordance with
the Splunk documentation. Infoblox is also not responsible for the accuracy of the Splunk documentation. For
Infoblox Reporting and Analytics technical support, contact Infoblox Technical Support. DO NOT contact
Splunk.

When you set up a reporting appliance with valid licenses in the Grid, the reporting server acts as an indexer that
collects data from Grid members while the members are forwarders that transmit information to the reporting
appliance. The reporting appliance indexes all raw data and transforms it into searchable events. Depending on your
needs, you can enable certain Grid members as forwarders and disable others so the reporting server receives only
the information you need from specific members. The following diagram depicts the high-level configuration of the
NIOS reporting service:

Figure 40.1 Infoblox Reporting and Analytics Overview

You can set up an appliance solely for reporting purposes and install a valid reporting license on it. You cannot add
licenses to run other services, such as DNS and DHCP, on a reporting appliance. You can configure any of the
supported Trinzic Reporting platforms as a Grid member and configure it as a reporting appliance. For information
about Infoblox platforms that support reporting, see Supported Reporting Appliances and Storage Space on page
1456.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1451

Infoblox Reporting and Analytics

The Infoblox reporting solution supports both IPv4 and IPv6 networks and you can configure a reporting member in
IPv4, IPv6, or in dual mode (IPv4 and IPv6) network environment. An IPv4 reporting member uses IPv4 as the
communication protocol, so you can add an IPv4 reporting member to an IPv4 or dual mode Grid. An IPv6 reporting
member uses IPv6 as the Grid communication protocol, so you can add an IPv6 reporting member to an IPv6 or dual
mode Grid. But a dual mode reporting member can use either IPv4 or IPv6 as the communication protocol, so you can
add a dual mode reporting member to an IPv4, IPv6, or a dual mode Grid. For more information about how to set up
the communication protocol, see Changing the Communication Protocol for a Dual Mode Appliance on page 302.
To enable and configure the Infoblox reporting solution on supported reporting appliances, complete the following:
1. Install a valid Reporting license on the reporting appliance, as described in Licensing Requirements on page
1452.
2. Set administrative permissions, as described in Administrative Permissions on page 1454.
3. Configure reporting properties, as described in Grid Reporting Properties on page 1462.

Licensing Requirements
You must install a valid Reporting license on the reporting appliance to use the reporting feature. Infoblox offers
perpetual and subscription licensing models (programs) to meet your business needs. You can transfer a valid
license to any reporting member in the Grid. You must obtain a new replacement license from Infoblox if you want to
transfer an existing license to another member.
You can use one of the following reporting licensing program:
Perpetual Licensing: There is no expiration date for this licensing type and you can use the Infoblox reporting service
for the lifetime of an appliance.
Subscription Licensing: This model has an expiration date and the Infoblox GUI displays a 60-day warning prior to the
actual expiration date. During a license violation period, NIOS continues to index data but the search function will
cease to be operational. This means that the Reporting tab is available with the following warning message displayed:
"Reporting Service is unavailable." The effective start date for this license type starts on the day you generate a
subscription license.
Installing a Perpetual license on the appliance that already has the Subscription license installed removes the
Subscription license. You can install only one Perpetual license on the appliance.

Note: Contact your Infoblox representative for pricing and availability information. You cannot install a Perpetual or
Subscription license when you have already installed a valid DNS, DHCP, MS Management, Query Redirection,
and Multi-Grid Management license on an appliance.

About License Violations

Violations occur when the reporting appliance exceeds the maximum allowed daily volume and indexed data type
that is not allowed for the license. There might be an impact on the reporting service performance if violations occur.
You can apply a “Reset license” to remove the violations. Note the following behavior for such violations:
• NIOS continues to index data; however, you will not be able to use the Reporting service.
• You can use the reporting search when the number of violations in the previous 30 days is within the limit OR
you can generate a license using the CLI command generatelic. For more information, contact Infoblox
Technical Support to obtain valid licenses.
• If there are 5 consecutive violations in 5 consecutive days, then the reporting feature is disabled for the next 25
days until a Reset license is installed.
If necessary, contact Infoblox Technical Support to obtain a Reporting Reset license so you can reset the current
license violations.

1452 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox Reporting and Analytics

Upgrade Implications
When you upgrade from a previous NIOS release to NIOS 7.3.x and later, there are some significant changes to the
Reporting and Analytics feature.
Some of the important changes are as follows:
• Terminology: The following table lists the terminology differences when you upgrade:

Table 40.1 Reporting Terminology Changes

Pre-NIOS 7.3.0 Release NIOS 7.3.0 and later

Searches Reports
Reports Dashboards

• Object Management: NIOS no longer manages reporting objects such as searches, smart folders, alerts, and
reports. You will not be able to perform operations such as global search, quick filtering, bookmarking, and
others for these objects. You can now manage these objects through the new user interface.
• Permissions: Permissions for all reporting objects are migrated to the new Reporting and Analytics solution and
managed through the new user interface after an upgrade. You may see the new built-in role, Everyone, when
configuring Reporting permissions. For best practices, do not alter permissions for this new built-in role. Note
that the Reporting Dashboard and Reporting Search global permissions have been removed. If an admin group
or admin role was granted these permissions before an upgrade, the permissions will still be displayed after an
upgrade. However, they won’t take any effect. The Grid Reporting Properties permission is retained. In addition,
reporting object permissions for dashboards and searches (including global dashboards and searches) are
migrated. These object permissions are retained for applicable migrated users. If permissions were granted to a
specific admin group for a dashboard or search before an upgrade, only these admin users and superusers
have permissions to access the migrated dashboard and report after an upgrade. If a limited-access user group
is created through the new interface after the upgrade, users in this admin group will not be able to access the
dashboard and report even if they are granted access to the Infoblox Reporting and Analytics App. Superusers
must explicitly grant permissions to this limited-access admin group for users in this group to access the
dashboard and report. For more information, see Granting Permissions on page 1454.
• Navigation and Visualization: Navigations for some reporting functions, such as searches, alerts, email and
page settings, and email PDF delivery, have changed. You can navigate through the new user interface to get
familiar with the changes in this release. In addition, all predefined reports might look different than the
traditional ones depending on your filtering configuration. The Grid Reporting Properties editor and Groups tab
are moved under the Administration tab–> Reporting tab.
• Extensible Attributes: The reports that supported filtering and grouping by multiple extensible attributes are
migrated into new interface with filtering and grouping only by the extensible attribute Site. You must clone the
dashboard, add filter inputs and modify the view XML to support additional extensible attributes. For
information, see Editing the XML Source Code of a Dashboard on page 1486
• Searches and Reports: Only NIOS system and global reports and searches are migrated to NIOS 7.3.0 and later
version as dashboards and reports respectively. All user private reports and searches are dropped. In addition,
bookmarked reports and searches are not migrated to 7.3.x release. If you want to keep any customizations for
the user private dashboards and reports, do one of the following:
— Create global dashboards and reports with the same settings.
— After upgrade, you can clone the corresponding migrated system or global dashboards and reports, and
then reconfigure the original settings, such as filters and scheduling in the new user interface.
• Custom Search: You can create your own search pattern and save it as a dashboard or report. For information,
see About Searches on page 1472.
After completing the NIOS upgrade successfully, make sure that you configure the Grid Reporting properties and (FTP
or SCP or TFTP) server to export search results. For information, see Configuring Grid Reporting Properties on page
1463 and Configuring Server to Export Search Results on page 1455.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1453

Infoblox Reporting and Analytics

Administrative Permissions
You must have the appropriate permissions to access, view, edit, and clone the searches, dashboards, reports, and
alerts that are available in the Reporting tab. NIOS synchronizes all users and admin groups as users and roles on the
reporting server. In NIOS, admin groups may have the setting “superusers” enabled or disabled. NIOS groups that
have “superusers” enabled will correspond to role with administrative permissions on the reporting server. This
documentation will refer to this role as a superuser role and the associated users as superusers. NIOS groups that do
not have “superusers” enabled will not have administrative permissions on the reporting server. This role will be
referred to as a non-superuser role and the associated users are limited-access users. The default NIOS admin group
“admin-group” will have a superuser role on the reporting server called “infoblox-admin-role.” The default NIOS
admin named “admin” will have a user name on the reporting server called “infoblox-admin.”
By default, users with a superuser role will have access to the Reporting and Analytics App and users with a
non-superuser role will not. Superusers can grant access to the Reporting and Analytics App to non-superusers.
Non-superusers will not have access to the Reporting tab until superusers grant them this access. For information
about Splunk roles, refer to the Splunk documentation.
When configuring NIOS, only superuser and users with the Grid Reporting Properties permission can configure Grid
Reporting Properties. Limited-access users can view the Grid Reporting Properties. When superusers create or delete
any admin groups in NIOS, the corresponding roles are created or deleted on the reporting server. You cannot directly
create or delete roles on the reporting server. If superuser permission is granted or removed from a NIOS group, this
permission change will be reflected in the corresponding role on the reporting server. For information about granting
permissions, see Granting Permissions on page 1454.

Note: Limited-access users cannot create, modify, and delete any user role for the Splunk App.

Granting Permissions
Superusers can grant App permissions to limited-access users. Permissions for all reporting objects are migrated to
the new Reporting solution and managed through the new user interface after an upgrade. You may see some new
built-in roles, such as Everyone, when configuring Reporting permissions. For best practices, do not alter permissions
for these new built-in roles. In addition, Reporting Dashboard and Reporting Search global permissions have been
removed. If an admin group or admin role was granted these permissions before an upgrade, the permissions will still
be displayed after an upgrade. However, they won’t take any effect. The Grid Reporting Properties permission is
retained.
To set permissions:
1. From the Reporting tab -> select the Administration tab.
2. Click Permission to manage permissions.
3. In the App Permissions, set permissions to Read and/or Write for the roles listed. You must have at least one
permission (Read or Write) to execute a task on the Reporting tab.
4. Click Save.

1454 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox Reporting and Analytics

Figure 40.2 Setting Permissions for Reporting and Analytics App

Editing Permissions
Users can edit permissions for objects where they are the owner, such as dashboards, reports and alerts. When a
user creates a new report, dashboard or an alert, It is only available to that user. To make that object available to other
users, you can do the following (only if your permissions allow you to do so):
• Make an object available to all users.
• Restrict or expand access to all or specific objects by roles.
• Set Read or Write permissions at the Reporting level for roles. For information about users and roles, refer to the
Splunk documentation.
To modify permissions:
1. From the Reporting tab -> select Dashboards or Reports or Alerts.
2. From the Edit drop-down list, select Edit Permissions.
3. Specify the following:
— Display for Owner, App, or All Apps. For more information about All Apps permissions, refer to the Splunk
documentation.
— Read and write privileges for users. By default, the permissions are set on the object. You cannot remove
the Read and Write permissions completely. However, you can change this permissions from Read to Write
or vice versa, based on your permissions. For more information about permissions, refer to the Splunk
documentation.
4. Click Save.

Configuring Server to Export Search Results

You must first configure an FTP, SCP, or TFTP server to which you plan to schedule the export of search results before
using the reporting service. Only superusers can configure the remote server and limited-access users cannot do so.
When you upgrade to 7.3.x, make sure that you reconfigure an FTP, SCP, or TFTP server, even if you have already
scheduled the export of search results.
The Set up page to configure an FTP, SCP, or TFTP server is displayed for all new installations and upgrades if you have
not previously scheduled the export of search results. If you have configured any scheduled export of search results
in a previous NIOS release, NIOS migrates one of the server settings to the Reporting and Analytics App. In this case,
the Set up page is not displayed. However, you can still access the Set up page from the Administration tab >
Reporting tab, as illustrated in Figure 40.3 on page 1456.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1455

Infoblox Reporting and Analytics

To configure an FTP, SCP, or TFTP server:

1. From the Reporting tab -> select the Administration tab -> click Set up.
2. To configure a remote server, complete the following:
— Username: Enter the username of your server account.
— Password: Enter the password of your server account.
— Confirm Password: Enter the same password.
— Protocol: Select FTP or SCP or TFTP from the drop-down list.
— Host/IP Address: Enter the host IP address.
— Host Port: Enter the port number on the selected server.
— Destination Path: Enter the path and the file name of the export file. For example, you can enter
/export/Infoblox_2009_10_20_15_30 on a Linux server, or c:\export\Infoblox_2009_10_20_15_30 on a
Microsoft Windows server.
3. Click Save.

Figure 40.3 Setup Page to specify Server for Exporting Search Results

Supported Reporting Appliances and Storage Space

Infoblox provides several reporting appliances to address different reporting requirements. Table 40.3 lists the
supported Trinzic Reporting platforms based on IP capacities and average DHCP leases and DNS queries per second.
There will be an impact on the performance of your reporting server when you perform many searches, download PDF
reports, and send reports through emails and alerts. It is important to consider the reporting server configuration and
make sure that it can handle the overall workload. A reporting appliance uses up to 95% of the total reporting disk
space. The usable hard disk space on different appliance models is shown in Table 40.2.

1456 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox Reporting and Analytics

Table 40.2 Infoblox Reporting Appliances and their Usable Reporting Hard Disk Space

Supported Infoblox Reporting Usable

Model Daily Maximum
Enterprise Model Hard Disk Reporting Hard
Data Consumption*
Space (GB) Disk Space (GB)

Very Large enterprises IB-4000 (8x300GB HDD) 1555 1477 20 GB

Service providers - Trinzic
Reporting 4000 Appliance
Large enterprises IB-2200-R2 (1000GB 1745 1657 10 GB
Service providers - Trinzic HDD)
Reporting 2000 Appliance
IB-2200-R1 (600GB HDD) 924 877 10 GB

Mid-size Enterprises - Trinzic IB-1400-R2 (1000GB 833 791 5 GB

Reporting 1400 Appliance HDD)
IB-1400-R1 (600GB HDD) 468 444 5 GB

IB-VM-1400 500 475 5 GB

Mid-size Enterprises - Trinzic IB-800 378 359 2 GB

Reporting 800 Appliance
IB-800 378 359 1 GB

IB-VM-800 250 237 2 GB

IB-VM-800 250 237 1GB

Mid-size Enterprises - Trinzic IB-VM-800 Hyper-V** 250 237 2 GB

Reporting VM-800 (virtual
appliance) Hyper-V** IB-VM-800 Hyper-V** 250 237 1 GB

Note: The daily maximum data consumption includes all DNS, DDNS, IPAM, DHCP, Discovery, and system traffic or
events from all members with data transmission enabled within the Grid. When data traffic exceeds the daily
maximum, the reporting server sends an SNMP trap and email notification, if configured. After five (5) daily
maximum warnings in a rolling period of 30 days, you cannot view dashboards or perform any report related
functions. You must then contact Infoblox Technical Support to resolve the issue. Note that the reporting
server continues to process incoming data during the violation state. However, you cannot view any reports or
manage any reporting related functions until you fix the violation issue. 

** support for Reporting appliance models IB-VM-800, IB-VM-1400 starts from Microsoft Windows 2012 R2.
Appliance model IB-VM-800 and IB-VM-1400 (Reporting) is supported for Microsoft Windows 2012 R2.

For information about the Trinzic Reporting platforms, their specifications, and how to install them as reporting
appliances, refer to the respective installation guides, available on the Infoblox Support site.

Reporting Categories and Related Data Sources

The reporting member uses two types of data sources to generate reports: file based data sources, and script based
data sources. When the reporting member is down or unreachable, file based data sources are queued until the
reporting member is up and running. However, the script based data sources are lost if the size of the queued data
exceeds 500 KB.
The amount of data in the queue is managed as follows:
• Rotates the reporting syslog files (extracted from /var/log/messages) at 120 MB retaining one older file. The
data in the queue depends on the file size when the reporting member becomes unreachable.
• The CSV files overwrites the oldest data with the new data at regular intervals. So, the CSV file contains only the
latest events.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1457

Infoblox Reporting and Analytics

Table 40.3 lists the reports provided by the reporting server, report categories, and the source type, data source type
(file or script based), and queue data update frequencies for each report:

Table 40.3 Report Categories, Related Data Sources, and Update Frequencies

Data Source
Report Reports Source Type
(File Based
Update Frequency
Category or Script
Based)
Device Inactive IP Addresses ib:reserved2 File based Rotates at 120 MB;
(syslog) retains one older
copy; queued data is
between 120 MB
and 240 MB
Port Capacity Utilization by Device ib:reserved2 File based Overwritten every 6
Port Capacity Trend (csv) hours
Port Capacity Delta by Device
DHCP DHCP Message Rate Trend ib:dhcp:message File based Overwritten every 1
Performance (csv) minute
DHCPv4 Usage Trend ib:dhcp:range File based Overwritten every 1
DHCPv4 Range Utilization Trend (csv) hour

DHCP Lease DHCP Lease History ib:dhcp:lease_history File based Rotates at 120 MB;
History DHCP Top Lease Clients (syslog) retains one older
copy; queued data is
between 120 MB
and 240 MB
DHCP Top Devices Identified ib:dhcp:lease_history File based Based on summary
Fingerprint Device Trend (syslog) search report, which
is updated during
Device Class Trend
the 16th and 46th
Top Device Classes minutes of each hour
Top Devices Denied an IP Address ib:dhcp:lease_history File based Based on summary
(syslog) search report, which
is updated during
the 19th and 49th
minutes of each hour
Device Fingerprint Change ib:dhcp:lease_history File based Executed every 24
Detected (syslog) hours
DNS DNS Response Latency Trend ib:dns:perf Script based Executed every 1
Performance minute
DNS Record DNS Scavenged Object Count ib:dns:reserved File based
Scavenging Trend (csv)
DNS Query DNS Domain Query Trend ib:dns:capture File based Updated whenever
Capture DNS Domains Queried by Client (csv) the Data Collection
VM collects capture
Top DNS Clients by Query Type
query data from a
Top DNS Clients Querying MX Grid member
Records

1458 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox Reporting and Analytics

Data Source
Report (File Based
Category Reports Source Type or Script Update Frequency
Based)
DDNS DDNS Update Rate Trend ib:ddns File based Rotates at 120MB;
(syslog) retains one older
copy; queued data is
between 120MB and
240MB.
DNS Traffic DNS Traffic Control Resource ib:dns:reserved File based Based on summary
Control Availability Trend (csv) search report, which
is updated once per
six hour at 47th
minute of each hour.
With each execution,
it summarizes raw
events indexed from
370 minutes ago to
10 minutes ago.
DNS Traffic Control Resource ib:dns:reserved File based Based on summary
Availability Status (csv) search report, which
is updated once per
six hour at 47th
minute of each hour.
With each execution,
it summarizes raw
events indexed from
370 minutes ago to
10 minutes ago.
DNS Traffic Control Resource Pool ib:dns:reserved File based Based on summary
Availability Trend (csv) search report, which
is updated once per
six hour at 23rd
minute of each hour.
With each execution,
it summarizes raw
events indexed from
370 minutes ago to
10 minutes ago.
DNS Traffic Control Resource Pool ib:dns:reserved File based Based on summary
Availability Status (csv) search report, which
is updated once per
six hour at 23rd
minute of each hour.
With each execution,
it summarizes raw
events indexed from
370 minutes ago to
10 minutes ago.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1459

Infoblox Reporting and Analytics

Data Source
Report (File Based
Category Reports Source Type or Script Update Frequency
Based)
DNS Traffic Control Response ib:dns:reserved File based Based on summary
Distribution Trend (csv) search report, which
is updated once per
six hour at 37th
minute of each hour.
With each execution,
it summarizes raw
events indexed from
370 minutes ago to
10 minutes ago.
DDI DHCPv4 Usage Statistics ib:dhcp:network File based Overwritten every 1
Utilization DHCPv4 Top Utilized Networks (csv) hour

IPAM Network Usage ib:ipam:network File based Overwritten every 1

IPAM Top Networks (csv) hour

DNS Zone Statistics Per DNS View ib:dns:view File based Overwritten every 24
(csv) hours
DNS Statistics per Zone ib:dns:zone File based Overwritten every 24
(csv) hours
System CPU Utilization Trend ib:system Script based Executed every 1
Utilization Memory Utilization Trend minute
Traffic Rate by Member
License Pool Utilization ib:system File based Overwritten every 24
(csv) hours
DNS Query DNS Replies Trend ib:dns:stats Script based Executed every 1
minute
DNS Cache Hit Rate Trend ib:dns:query:cache_hi Script based Executed every 1
t_rate minutes
DNS Query Rate by Query Type ib:dns:query:qps Script based Executed every 1
minute
DNS Query Rate by Member ib:dns:query:by_mem Script based Executed every 1
DNS Daily Query Rate by Member ber minute
DNS Daily Peak Hour Query Rate
by Member
DNS Top Clients ib:dns:query:top_clien Script based Executed every 10
ts minutes
DNS Top Requested Domain ib:dns:query:top_requ Script based Executed every 10
Names ested_domain_names minutes

1460 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Infoblox Reporting and Analytics

Data Source
Report (File Based
Category Reports Source Type or Script Update Frequency
Based)
DNS Top Clients Per Domain ib:dns:reserved Script based Executed every 10
DNS Top NXDOMAIN / NOERROR minutes
(no data)
DNS Top SERVFAIL Errors Received
DNS Top SERVFAIL Errors Sent
DNS Top Timed-Out Recursive
Queries
DNS Query Trend per IP Block ib:dns:reserved Script based Executed every 5
Group minutes
Security DNS Top RPZ Hits ib:dns:reserved Script based Executed every 10
minutes
DNS Top RPZ Hits by Clients ib:dns:reserved Script based Executed every 10
minutes
Top DNS Firewall Hits ib:dns:reserved Script based Executed every 10
minutes
Malicious Activity by Client ib:dns:reserved Script based Executed every 10
minutes
DNS Firewall Executive Threat ib:dns:reserved Script based Executed every 10
Report minutes
FireEye Alerts ib:syslog Script based Updated
immediately when
alerts are logged in
the syslog.
Threat Protection Event Count By ib:reserved1 File based Overwritten every 5
Severity Trend (csv) minutes.
Threat Protection Event Count By
Member Trend
Threat Protection Event Count By
Rule
Threat Protection Event Count By
Time
Threat Protection Event Count By
Category
Threat Protection Event Count By
Member
DNS Top Tunneling Activity ib:reserved1 File based Overwritten every 5
DNS Tunneling Traffic by Category (csv) minutes.
Top Malware and DNS Tunneling
Events by Client
Ecosystem User Login History ib:reserved1 File based
Subscription Data (csv)
Publish Data

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1461

Infoblox Reporting and Analytics

Data Source
Report (File Based
Category Reports Source Type or Script Update Frequency
Based)
Cloud VM Address History ib:reserved2 File based Updated
(csv) immediately when
there is a change
related to the VM IP
address. Rotates at
300MB and retains
one older copy.
Audit Log Audit Log Events ib:audit File based Updated
(audit log) immediately when
the audit log is
updated.

Grid Reporting Properties

After you set up a dedicated reporting appliance in your Grid, you must configure the Grid reporting properties so you
can communicate with the reporting appliance and retrieve report data through the Grid Master. By default, only
superusers can configure the Grid reporting properties. When you enable the Grid reporting service, all members
transmit data to the reporting server. You can disable data transmission from specific members to the reporting
server. Before using the reporting service, you must configure the remote server to export the search results, as
described in Reporting (Index) Storage Space on page 1463. Once you configure the reporting server and enable the
reporting service on Grid members, you can view and manage reports through the Reporting tab of Grid Manager.

Note: When you reset the appliance using the CLI command reset all or reset the database using the CLI
command reset database, the reporting configurations are not preserved. If you reset the appliance, you
must configure Grid reporting properties and remote server settings to use the reporting service.

Complete the following to set up your reporting solution:

• Configure general reporting properties, including the selection of report categories, as described in Configuring
Grid Reporting Properties on page 1463.
• Specify the network port for reporting, as described in Setting the Network Port for Reporting on page 1465.
• Specify email properties, as described in Configuring Email Notification Settings on page 1476.
• Configure logo image for PDF delivery, as described in Configuring Logo Image in PDF Reports on page 1484.
The properties you define in the Grid Reporting Properties editor apply to all the reporting members, unless you
override them at specific member level. To override at the member level, see Modifying Member Reporting Properties
on page 1464.

1462 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Grid Reporting Properties

Configuring Grid Reporting Properties

Complete the following to configure the Grid reporting properties:
1. From the Administration tab, select the Reporting tab -> expand the Toolbar and click Grid Reporting Properties.
or
From the Grid tab, select the Grid Manager tab and click the Services tab. In the Services tab, select the
Reporting tab and click Edit -> Grid Reporting Properties from the Toolbar.
2. In the Grid Reporting Properties editor, select the General -> Basic tab
3. Complete the following:
— Reporting Server: Grid Manager displays the name of the reporting server.
— Enable Data Indexing: Data transmission is disabled by default. When you select this check box, all Grid
members transmit data to the reporting appliance. Enabling data transmissions for all members can affect
the overall data consumption on the reporting server. For information about the daily maximum data
consumption per day for your reporting appliance, see Table 40.4.
— Report Category: Select the reports you want the reporting server to generate. The reporting server
automatically configures data sources and configurations required to generate the reports you select here.
The required data is stored in the reporting server database. By default, no report categories are selected.
For a list of report categories, see Predefined Dashboards on page 1490.
— Index%: Displays the actual storage space allocated for a reporting index. You can modify this value
between 0 and 100. When you enable an index category and leave it at 0%, the appliance displays an
error message. Make sure that the total percentage of the index storage space for all report categories
equals 100% or less than 100%. The appliance displays a warning message when the total percentage
of the index storage space is less than 100%.
— Used%: Displays the index storage space used by a reporting index.
— Index Name: Displays the reporting index name, which are displayed on the Reporting Index Usage
Statistics report.
4. Save the configuration and click Restart if it appears at the top of the screen.

Reporting (Index) Storage Space

One key configuration aspect of the reporting appliance is index space. By default, some percentage of index space
is allocated on the reporting server for each report category listed in Table 40.3. For information about how to
configure index space, see Configuring Grid Reporting Properties on page 1463. Each report category uses up to a
certain percentage of the usable reporting hard disk space for index storage. For example, of the total 237 GB usable
hard disk space of an IB-VM-800 appliance, the reporting category, Device uses 47.47%. For the list of default index
space configured for each report category, see Table 40.4. You can modify the index percentage value between 0 and
100. When you modify this value, make sure that the total percentage for the index storage space for all categories
equals exactly 100%. You can set the index percentage to a value less than 100% to reserve certain percentage for
future use. If the total percentage of the index space usage exceeds 100%, the appliance displays an error message.
Note that the reporting appliance removes the oldest data when you reduce the index space percentage for a category
to a value that is lower than the used percentage by the existing data. For information about the maximum index size
and number of days the reporting data is retained, see Table 40.6. Also, ensure that its host name has only
alphanumeric characters, underscores, dots, and dashes.

Note: For usable reporting hard disk space for each appliance model, see Table 40.2.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1463

Infoblox Reporting and Analytics

Table 40.4 Default Index Space Configured for Each Report Category

Default Index Space (%) Total Reporting Disk Space Used for
Report Category
Adjustable by User Index Storage (GB)
Audit Log 0%
DNS Query 20% Usable reporting hard disk space x 20%
DNS Performance
DDNS
DNS Record Scavenging

DNS Query Capture 0%

DHCP Performance 20% Usable reporting hard disk space x 20%

DHCP Fingerprint 39% Usable reporting hard disk space x 39%

DHCP Lease History

DDI Utilization 5% Usable reporting hard disk space x 5%

Security 1% Usable reporting hard disk space x 1%

Network User

DNS Traffic Control 0% Usable reporting hard disk space is

broken down between ib_dtc and
ib_dtc_summary internally.

Cloud 0%

System Utilization 15% Usable reporting hard disk space x 15%

Device 0%

Ecosystem Subscription 0%
Ecosystem Publication

License 0%

Modifying Member Reporting Properties

To modify reporting properties for a reporting member:
1. From the Administration tab, select the Reporting tab -> Grid_member check box -> Edit icon.
2. In the Grid Member Properties editor, select the General tab and click Override.
3. Under Reporting Settings, complete the following:
— Enable data forwarding to the indexer on this member: Select this check box to enable data transmissions
to the reporting server. If you do not select this check box, a member will not forward data to the indexer
and reporting service is disabled on that member.
— Select the data categories to forward: Select the report categories for which you want this member to
forward data to the reporting server. Clear the report categories for which you do not want this member to
forward data to the reporting server.

Note: The member configured as an indexer displays only the Audit Log category.

4. Save the configuration.

1464 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Grid Reporting Properties

Defining Interface for Reporting Traffic

On a Grid member, you can define the network interface you want the member to use for sending reporting data to
the reporting server.
To define network interface on the Grid member for reporting traffic, complete the following:
1. From the Reporting tab, click Edit -> Member Reporting Properties from the Toolbar.
2. In the Reporting Member Properties editor, select the General -> Advanced tab, and then complete the following:
— Forwarding interface used for reporting traffic: From the drop-down list, select the interface that you want
this member to use to send reporting data. Note that you must properly configure the interfaces on the
member for them to appear in the drop-down list.
3. Save the configuration

Setting the Network Port for Reporting

All Grid members use port 9997 for reporting service by default. This port is used for data transmissions between the
reporting member and other members. Ensure that you configure your firewall rules to allow traffic on this port. You
can designate another network port for reporting purposes.
To set the network port for reporting:
1. From the Administration tab, select the Reporting tab -> expand the Toolbar and click Grid Reporting Properties.
or
2. From the Grid tab, select the Grid Manager tab and click the Services tab. In the Services tab, select the Reporting
tab and click Edit -> Grid Reporting Properties from the Toolbar.
3. In the Grid Reporting Properties editor, select the General -> Advanced tab and complete the following:
— Port: Enter the port number you want to use for reporting purposes. The default port is 9997.
4. Save the configuration.

Configuring Threat Protection Data

You can use this feature only if the Threat Protection and Threat Protection Update licenses are installed on the
Infoblox Advanced Appliance. When you configure this feature, you receive threat protection events in the syslog. The
events logged include threat protection rules and the source IPs that triggered the rules. For information about how
to monitor these events using the syslog, see Monitoring through Syslog on page 1585.
For certain threat protection reports, accumulated statistics for each unique IP/rule pair are collected. You can control
the volume of data collected per member using the following options:
• Top IP/Rule Statistics Collection Limit: This option limits the collection of accumulated statistics to the top N
unique IP/rule pairs.
• IP/Rule Statistics Collection Interval (minutes): The interval at which the accumulated statistics for the top N
unique IP/rule pairs are collected. The smaller the interval, the finer the granularity of the accumulated statistics
in terms of time, but the data volume will be higher.
Based on your configuration, the reporting appliance displays data in the following threat protection reports:
• Threat Protection Top Rules Logged on page 1513
• Threat Protection Top Rules Logged by Source on page 1513

Note: To enable threat protection reports, you must select the Security report category in the Grid Reporting
Properties editor. To select the Security check box, go to the Reporting tab -> Grid Reporting Properties ->
General tab -> Basic tab -> select the Security check box under Report Category. Ensure that you set the Security
Index% to an optimal level so the reporting database has enough storage space to accommodate all reporting
data. For information about how to configure the index %, see Configuring Grid Reporting Properties on page
1463.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1465

Infoblox Reporting and Analytics

To configure the data collection limit:

1. From the Administration tab, select the Reporting tab -> expand the Toolbar and click Grid Reporting Properties.
or
From the Grid tab, select the Grid Manager tab and click the Services tab. In the Services tab, select the
Reporting tab and click Edit -> Grid Reporting Properties from the Toolbar.
2. In the Grid Reporting Properties editor, select the Threat Protection tab and complete the following:
— Top IP/Rule Statistics Collection Limit: Enter the maximum number of the top N unique source IP/rule pairs
for data collection. For example, if you specify 20, the appliance collects data for the top 20 unique source
IP/rule pairs.
— IP/Rule Statistics Collection Interval (minutes): Enter the time interval at which the reporting appliance
updates data. For example, if you specify the interval as 60 minutes, the appliance updates data at a 60
minute interval.
3. Click Save & Close.

Monitoring Client Queries

You can view the presence of clients in the network that are sending large numbers of queries to DNS zones or DNS
domains. To monitor the top clients querying DNS zones, do the following:
1. From the Administration tab, select the Reporting tab -> expand the Toolbar and click Grid Reporting Properties.
or
From the Grid tab, select the Grid Manager tab and click the Services tab. In the Services tab, select the
Reporting tab and click Edit -> Grid Reporting Properties from the Toolbar.
2. In the Grid Reporting Properties editor, select the Basic tab -> DNS.
3. Under DNS Top Clients Per Domain, select the Monitor Queries made to the following zones check box. Only
authoritative zones are supported, to a limit of 1000 zones.
— To select zones one at a time, choose individual check boxes. Click the Add icon and select Add Domain or
Bulk Add Domains to add new zone information for excluding.
— To specify the number of clients to be listed, choose the Top N Limit value. The default value is 10.

Monitoring IP Block Group Queries

You can view the user defined IP block groups that are querying DNS domains. To monitor the IP Block Groups, do the
following:
1. From the Administration tab, select the Reporting tab -> expand the Toolbar and click Grid Reporting Properties.
or
From the Grid tab, select the Grid Manager tab and click the Services tab. In the Services tab, select the
Reporting tab and click Edit -> Grid Reporting Properties from the Toolbar.
2. In the Grid Reporting Properties editor, select the Basic tab -> DNS.
3. Under DNS Query trend per IP Block, select the Monitor Queries made from the following groups check box.
— Click the Add icon to add a group to the group table. From the drop-down list, click Select Group to select
groups in the Group Selector dialog box, or click Bulk Add Groups to add multiple groups.
— To select all groups, select the Group check box. Or, select individual check box to select the group one at a
time.
— To delete a group, select the group and click the Delete icon.

1466 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IP Blocks and IP Block Groups

Configuring DNS RPZ Rule Hits

You can specify a limit to display the number of top clients, who receive re-written responses through the RPZ, in DNS
Top RPZ Hits. You can also specify the total number of RPZ entries for each client.
1. From the Administration tab, select the Reporting tab -> expand the Toolbar and click Grid Reporting Properties.
or
From the Grid tab, select the Grid Manager tab and click the Services tab. In the Services tab, select the
Reporting tab and click Edit -> Grid Reporting Properties from the Toolbar.
2. In the Grid Reporting Properties editor, select the Basic tab -> DNS.
3. Under DNS RPZ Rule Hit Configuration, complete the following:
— Enter a value for Top N Limit to specify the maximum number of top clients that can be listed in the report.
— Specify the Total RPZ Entries per Client. This indicates the number of entries for each client in RPZ.

Note: You have to select the Security check box before you define values here. To select the check box, Reporting tab
-> Grid Reporting Properties -> General tab -> Basic tab -> select the check box Security under Report Category.

About IP Blocks and IP Block Groups

You can configure IP addresses, subnets, or a mix of multiple IP addresses and subnets into IP blocks, and then
assign them to IP block groups for monitoring and tracking queries made to specific IP blocks. For information about
adding IP addresses, see Adding IP Blocks on page 1468. You can also configure as many groups as necessary and
assign them to specific clients. Note that assigning more IP block groups results in monitoring more queries, which
may affect the performance of the reporting server. You can generate a report to monitor queries made to these
user-defined IP block groups or IP blocks. For information, see DNS Query Trend per IP Block Group on page 1503.
Guidelines while configuring IP blocks:
• You cannot configure arbitrary IP address ranges, such as 192.168.0.1 to 192.168.0.100 as an IP block.
• You cannot add or modify an IP block that overlaps with another IP block in a different group. However, you can
add an IP block that overlaps with another IP block in the same IP block group.

Note: The appliance restarts the DNS service after you assign or unassign an IP block group at the Grid or member
level. Also, the appliance restarts the DNS service when you modify or delete an IP address or IP block group
assigned to the Grid or member or when you add, modify, or delete an IP block in such IP block groups.

You can do the following in the Groups panel:

• Add IP block groups, as described in Adding IP Block Groups on page 1468.
• Modify IP block groups, as described in Modifying IP Block Groups on page 1468.
• Add IP block, as described in Adding IP Blocks on page 1468.
• Modify IP blocks, as described in Modifying IP Blocks on page 1469.
• Delete IP block groups and IP blocks, as described in Deleting IP Block Groups and IP Blocks on page 1469.
• Print IP block groups and IP blocks, as described in Printing IP Block Groups and IP Blocks on page 1469.
• Export IP block groups and IP blocks, as described in Exporting IP Block Groups and IP Blocks on page 1469.
In addition, you can also do the following:
• Use filters or the Go to function to navigate to a specific group. You can also create quick filters to save
frequently used filter criteria. For information about how to use quick filters, see Using Quick Filters on page 77.
• Use Global Search to search for IP block groups and IP blocks. For information, see Global Search on page 68.
• Use Smart Folders to organize IP block groups and IP blocks. For information, see About Smart Folders on page
174.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1467

Infoblox Reporting and Analytics

• Import and export groups in CSV format. For more information about CSV import feature, see About CSV Import
on page 101.

Adding IP Block Groups

To add a new group:
1. From the Administration tab, select the Reporting tab -> Group -> Add.
or
From the Administration tab, select the Reporting tab, expand the Toolbar and click Add -> IP Block Group.
2. In the Add IP Block Group wizard, complete the following:
— Name: Enter the name of the group.
— Comment: Enter useful information about the group.
3. Do one of the following:
— Click Save & Close to add the IP block group and close the wizard.
— Click Save & Edit to add the IP block group and launch the editor. You can edit the details.
— Click Save & New to add the IP block group and launch the wizard again to add another group.
— Click Save & Open to add the IP block group and open the IP block group.

Modifying IP Block Groups

1. From the Administration tab, select the Reporting tab -> Group -> Edit.
2. In the General tab of the IP Block Group editor, you can modify the group name and comment.
3. Click Save & Close to save the configuration.

Note: You can perform inline editing by double-clicking the row of data that you want to modify. The appliance
displays the inline editing editor in the selected row. Click Save after modifying the data.

Adding IP Blocks
In a group, you can add as many subnets/IP addresses as necessary. Note that adding more IP addresses results in
monitoring more queries, which may affect the performance of the reporting server.
1. From the Administration tab, select the Reporting tab -> Group -> Add.
or
From the Administration tab, select the Reporting tab, expand the Toolbar and click Add -> IP Block.
2. In the Add IP Block wizard, complete the following:
— Group: Click Select to select a group. When there are multiple groups, Grid Manager displays the Group
Selector dialog box to select a group. Click a group name in the dialog box. You can use filters or the Go to
function to narrow down the list.
— Address: Enter the source IPv4/IPv6 addresses or the IPv4/IPv6 subnets.
— Comment: Enter useful information about the IP block.
3. Do one of the following:
— Click Save & Edit to add an IP address or IP block and launch the editor. You can edit the details.
— Click Save & New to add an IP address or IP block and launch the wizard again to add another IP block.
— Click Save & Close to add an IP address or IP block and close the wizard.

1468 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About IP Blocks and IP Block Groups

Modifying IP Blocks
1. From the Administration tab, select the Reporting tab -> Group.
2. Select an IP address or IP block you want to modify and click the Edit icon.
3. In the General tab of the IP Block editor, modify the IP address or comment.
4. Click Save to save the configuration.

Note: You can modify description by using inline editing. Double-click the row that you want to modify, the appliance
displays the inline editing editor in the selected row. Click Save after modifying comment. You cannot modify
IP address using inline editing editor.

Deleting IP Block Groups and IP Blocks

1. For IP block groups: From the Administration tab, select the Reporting tab -> Group.
2. For IP blocks: From the Administration tab, select the Reporting tab -> Group -> IP block.
3. Click the Delete icon.
4. In the Delete Confirmation dialog box, click Yes.

Exporting IP Block Groups and IP Blocks

You can export displayed data or you can export the group list in CSV (comma separated value) format. Exporting
group lists or group data may take a few moments based on the amount of exported data.
To export displayed data:
1. For IP block groups: From the Administration tab, select the Reporting tab -> Group.
2. For IP blocks: From the Administration tab, select the Reporting tab -> Group -> IP block.
3. From the Export drop-down menu, select Export visible data. For more information on how to export, see
Exporting Displayed Data on page 111.
To export all data to a CSV file:
1. For IP block groups: From the Administration tab, select the Reporting tab -> Group.
For IP blocks: From the Administration tab, select the Reporting tab -> Group -> IP block.
2. From the Export drop-down menu, select Export data in Infoblox CSV Import format. For more information on how
to export, see Exporting Data to Files on page 108.

Printing IP Block Groups and IP Blocks

1. For IP block groups: From the Administration tab, select the Reporting tab -> Group.
For IP blocks: From the Administration tab, select the Reporting tab -> Group -> IP block.
2. Click the Print icon. For more information on how to print, see Printing from Grid Manager on page 111

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1469

Infoblox Reporting and Analytics

Reporting User Interface Overview

When you access the Reporting tab in Grid Manager, you can do the following:
• View and analyze all of your DNS, DHCP, and IPAM data.
• View the reporting data in the form of charts and tables.
• Use the Search tab to create or edit searches.
The key options in the Reporting tab are: Home Dashboards, Dashboards, Reports, Alerts, Search, Pivot,
Administration, and Reporting Help. For more information about these options, see Table 40.5 on page 1471.

Figure 40.4 Reporting Tab Overview

Various tabs to navigate to Dashboards, Reports, Email and PDF Access Splunk
Searches, Alerts, Administration, and Reporting Help Page Settings Online Documents

View Search Job and

Triggered Alert History

1470 NIOS Administrator Guide (Rev. A) NIOS 7.3

 Home Dashboards

The following table summarizes the different tabs and key options that are available in the Reporting tab:

Table 40.5 Reporting Tab Overview

Tab Name Purpose Description

Settings Email notification settings For information, see Configuring Email Notification
Server Logging Settings on page 1476

Home Dashboard Overall summary view for the reporting data in For information, see Home Dashboards on page
your Grid 1471.

Dashboard Provide table and graph views for the reporting For information, see Home Dashboards on page
data in your Grid. 1471

Reports Saved searches that retrieve specific type of For information, see About Reports on page 1477
reporting data

Alerts Set alerts to trigger actions when certain events For information, see About Alerts on page 1475
occur

Search Create a search interactively from scratch and For information, see About Searches on page 1472.
save it as a dashboard panel, alert and report.

Pivot Refer to Splunk documentation for more information.

Administration • Set up For information, see Reporting (Index) Storage Space

• Permissions on page 1463
For information, see Administrative Permissions on
page 1454

Reporting Help Quick help on some of the reporting topics.

Hierarchy settings for all the navigation menu options (listed in the Table 40.5) are available in the default.xml file.

WARNING: Infoblox recommends that you do not modify the default.xml file. The navigation menu is built on
a custom XML structure that is stored as default.xml in the navigation directory (from the
Reporting tab, select the Settings tab -> User Interface -> Navigation Menus -> default). Editing this
file changes the specific default settings for the reporting features and your changes become
permanent. In addition, you might not be able to see the latest changes made by Infoblox. To
restore the default settings, you must reset the NIOS appliance to its original factory settings.
For information, see Resetting a NIOS Appliance to Factory Settings on page 491.

Home Dashboards
You can view the overall summary of DNS, DHCP, and IPAM activities in the Home Dashboard page. This page presents
a summary view of the following:
• DDI Summary: Presents statistical information about the DNS, DHCP, and IPAM activities of all Grid members.
• DNS: Displays the statistical summary of DNS activities. You can export the search results, open in search, and
refresh.
• DHCP: Displays the statistical summary of DHCP activities. You can export the search results, open in search,
and refresh.
• IPAM: Displays the summary of the Top 10 IPAMv4 Utilized Networks dashboard.
• Reporting Health: You can view the license usage by the reporting server:
— Today’s License Usage: Current license usage by the indexer.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1471

Infoblox Reporting and Analytics

— License Usage Trend per Member: License usage by the indexer per member.

Figure 40.5 Reporting Home Dashboard

About Searches
Searches are criteria that the reporting server uses to save reports and dashboard panels. Each predefined report has
an associated search.

Note: For more information, refer to the official Splunk documentation: http://docs.splunk.com/Documentation.

To run a search:
1. From the Reporting tab, select the Search tab.
2. Enter the search criteria and then click the Search icon.
The search results are displayed in the New Search panel, as illustrated in the New Search View.
In the New Search panel, you can save search results as Reports, Dashboard Panel, and Alerts.

1472 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Searches

Figure 40.6 Sample Search Summary View

Click Documentation to open Splunk Documentation

Enter Search criteria

Click Tutorial to open Splunk Tutorial

Figure 40.7 New Search View

You can save search results as
Reports, Dashboard panel, or alert.

New Search panel

Search criteria

Creating Reports from a Search

You can create reports by saving a search as a report.
To save a search as a report:
1. From the Reporting tab, select the Search tab.
2. Enter the search criteria and then click the Search icon.
The search results are displayed in the New Search panel.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1473

Infoblox Reporting and Analytics

3. From the Save As drop-down list, click Report to generate a report.

4. Enter title and description.
5. Click Save.
6. Do one of the following in the Your report has been created dialog box:
— Click View to view your report on the Report page.
— Click Continue Editing to edit.
— Click Add to Dashboard to add new report to the dashboard panel.
You can also complete the following settings in the Your report has been created dialog box:
• Permissions: Click this to edit permissions for your report, as described in Editing Permissions on page 1455.
• Schedule: Click this to schedule a report. For information about scheduling reports, see Scheduling Reports on
page 1483.
• Acceleration: For more information, refer to the Splunk documentation.

Saving a Search as a Dashboard Panel

You can save a search as a dashboard panel.
Do the following to save a search as a dashboard panel:
1. From the Reporting tab, select the Search tab.
2. Enter the search criteria and then click the Search icon.
The search results are displayed in the New Search panel.
3. From the Save As drop-down list, click Dashboard Panel to create a dashboard panel.
4. Click View Dashboard to view dashboard in the Dashboard panel. For information, see Home Dashboards on
page 1471.

Exporting Search Results

You can export the data in the selected search in CSV (comma separated value) or XML format. Note that this may
take a long time depending on the amount of data you want to export. To schedule the export of search results to an
FTP or SCP or TFTP server configured in the Set up page, select File Transfer Action when creating a scheduled alert,
as described in Creating Scheduled Alerts on page 1475.
To export data in a selected search:
1. From the Reporting tab, select the Search tab.
2. Enter the search criteria and then click the Search icon.
The search results are displayed in the New Search panel.
3. Click the Export icon to export search results.
4. In the Export Results dialog box, complete the following:
— Format: Select CSV or XML from the Format drop-down list.
— File Name: Specify a file name for the export file. This is optional.
— Number of Results:(Limited or Unlimited). If you select Limited, enter the number of results to be exported
in the Max Results field.
5. Click Export.

1474 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Alerts

Saving Search as Alerts

To save a search as an alert:
1. From the Reporting tab, select the Search tab.
2. Enter the search criteria and then click the Search icon.
3. From the Save As drop-down list, click Alert.
4. In the Save As Alert dialog box, specify all alert settings. For information about scheduling alerts, see Creating
Scheduled Alerts on page 1475.
5. Click Save.

About Alerts
You can configure alerts to trigger actions when certain events occur. When you set up an alert, search results trigger
an alert action if they match the alert conditions. You can configure an alert to send an email notification, SNMP trap,
and log a message in the syslog. Note that alerts are executed based on update frequencies for each corresponding
search. For example, DHCP Lease History alerts are executed every 10 minutes, and Device Trend alerts are executed
every 30 minutes at the 17th and 47th minutes of each hour (one minute after the search updates). For information
about search indexes and update time intervals, see Reporting Indexes and Update Time Intervals on page 1477.
You can also throttle an alert if you want to change its frequency. For more information, refer to the Splunk
documentation.
You can do the following in the Alerts page:
• Create scheduled alerts, as described in Creating Scheduled Alerts on page 1475.
• Edit permissions, as described in Editing Permissions on page 1455.
• Edit alert type, trigger condition, and alert actions, as described in Editing Alerts on page 1476.
• Clone an alert, as described inCloning Alerts on page 1476.

Creating Scheduled Alerts

You can schedule an alert to notify when a scheduled report returns results that meet a specific condition. The
appliances sends an alert when it encounters the trigger condition.
1. From the Reporting tab, select the Alerts tab -> select an alert and click Open in Search.
2. From the Save As drop-down list, click Alert.
3. In the Save As Alert dialog box, complete the following:
— Specify the title and description.
— Alert Type: Select Scheduled
— Time Range: Specify the time range. For example you can select Run Every Day.
— Schedule At: Specify the time.
— Trigger Condition: Specify trigger conditions. For more information, refer to the Splunk documentation.
— Trigger Actions: Click this to configure alert actions. You can select the following:
— Send SNMP Trap: Select this to enable SNMP traps. For information about how to trigger SNMP traps for
reporting event types, see Defining Thresholds for Traps on page 1369.
— Send email: Select this to send alert notification through email. You can specify email address in the To
text box.
— Send to Syslog. Select this to log a message in the syslog. If you configure this option with an alert, the
message goes to the syslog on the reporting member or indexer.
— File Transfer Action: Select this to upload the search results to an FTP or SCP or TFTP server configured
in the Set up page. For information, see Reporting (Index) Storage Space on page 1463.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1475

Infoblox Reporting and Analytics

4. Click Save.

Editing Alerts
You can edit alert type, trigger condition, and alert actions, as follows:
1. From the Reporting tab, select the Alerts tab -> select an alert.
2. From the Edit drop-down list, select Edit Alert Type and Trigger Condition to edit alert settings. In the Edit Alert
Type and Trigger Condition dialog box, make the required changes. For information, see Creating Scheduled
Alerts on page 1475.
or
From the Edit drop-down list, select Edit Actions to edit alert actions. In the Edit Actions dialog box, make the
required changes. For information, see Creating Scheduled Alerts on page 1475.
3. Click Save.

Cloning Alerts
1. From the Reporting tab, select the Alerts tab.
2. Select an alert you want to clone, click Edit -> Clone.
3. Enter a new title, ID, and description. Click Clone Alert.
4. Optionally, you can click Open in Search to open the cloned alert in the Search page.
5. Click View, and do one of the following in the Your report has been created dialog box:
— Click View to view your report on the Report page.
— Click Continue Editing to edit.
— Click Add to Dashboard to add new report to the dashboard panel.
You can also complete the following settings in the Your report has been created dialog box:
• Permissions: Click this to edit permissions for your report, as described in Editing Permissions on page 1455.
• Schedule: Click this to schedule a report, as described in Scheduling Reports on page 1483.
• Acceleration: For information, refer to the Splunk documentation.

Configuring Email Notification Settings

You can enable the appliance to send email messages to specified recipients when the alert is triggered. You can
configure email settings for alerts, scheduled reports, and scheduled PDF delivery.
To configure email properties for alerts and PDF delivery:
1. From the Reporting tab -> Settings tab -> click Server settings.
2. Click Email settings.
3. Specify the mail host. The default is local host.
4. Optionally, you can specify user name and password.
5. Specify Email Format.
6. In the Specify PDF Report Settings, specify the paper size, paper orientation, and also the path to logo image.
7. Click Save.

Note: You can configure email addresses when scheduling dashboard PDFs, scheduling reports, and creating alerts.

1476 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Reports

About Reports
Infoblox provides reports that are named by core network service functions, such as DNS query and system
utilization. Reports contain predefined search criteria that retrieve specific data from the reporting database. Each
report is associated with a search. It is not recommended to modify predefined reports. However, when you run a
search, you can save it as reports and share it with other users. You can also create a new report by cloning an existing
report, and then modify the search criteria.
You can also create a personal report in two different ways:
• Clone a report, as described in Cloning Reports on page 1483.
• Saving a search as a report, as described in Creating Reports from a Search on page 1473.

Note: IDNs are not supported on the reporting server. The reporting server manages IDNs in punycode. The reports
generated by collecting reporting data from the DNS server displays all the data in punycode only. However,
the DNS Zones Last Queried report and DNS Resource Records Last Queried report support IDNs because these
reports collect data from the NIOS database.

When you upgrade to 7.3.x, all NIOS Global reports are migrated to the Dashboards panel without filters. However,
the filter conditions configured in NIOS are reflected in the Dashboards panel. All NIOS System and Global searches
are migrated to the Reports panel.
You can do the following in the Reports tab:
1. From the Reporting tab, select the Reports tab -> select a report.
2. In the Reports panel, you can do the following:
— Open a report in the Search page and edit the report using the Save As menu. For information, see About
Searches on page 1472.
— You can do the following using the Edit drop-down list:
— Edit Description
— Edit Permissions, as described in Editing Permissions on page 1455.
— Edit Schedule, as described in Scheduling Reports on page 1483.
— Clone a report, as described in Cloning Reports on page 1483.

Reporting Indexes and Update Time Intervals

Table 40.6 lists the search indexes that the reporting server uses to generate reports. It contains information about
the frequency of summary report updates for each report, percentage of the total index space allocated for each
report category, and the maximum number of days that the reporting data remains in the database before it is
automatically deleted. Use this information to plan your reporting strategy for the Grid so you can optimize the
performance of the reporting server.
Each summary report or search has its own update frequency. For example, the DNS Top Requested Domain report
updates its data every 30 minutes, starting at the 4th minute of each half hour. It collects report data during the first
30 minutes of the previous 60 minutes. For example, if the report starts an update at 6:04 a.m., the data it collects
is from 5:04 a.m. to 5:34 a.m.
The reporting server also uses this information to generate alerts. For example, once configured, Top Devices
Identified alerts are executed at the 17th and 47th minutes of each hour (one minute after each update), regardless of
whether DHCP fingerprint detection is enabled or disabled. For information about alerts, see About Alerts on page
1475.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1477

Infoblox Reporting and Analytics

Table 40.6 Reporting Indexes

Default
Summary Report Data Maximum Index Maximum
Indexes Reports/ Searches Updates Size (% of Total Retention
Index Storage)

Device (Discovery) 0% 12 Months

Inactive IP Addresses N/A

Port Capacity Utilization by N/A

Device

Port Capacity Trend N/A

Port Capacity Delta by Device N/A

IPAMv4 5% 2 Months

IPAMv4 Network Usage Statistics N/A

(Detailed)

DNS Statistics per DNS View N/A

(Detailed)

DNS Statistics per Zone N/A

(Detailed)
IPAMv4 Top Utilized Networks N/A
(Detailed)

DNS 10% 2 Months

DDNS Update Rate Trend N/A

DNS Response Latency Trend N/A

(Summary)

DNS Cache Hit Rate Trend N/A

DNS Query Rate by Query Type N/A

DNS Query Rate by Server N/A

(Detailed)
DNS Replies Trend N/A
DNS Query Trend Per IP Block N/A
Group

FireEye Alerts N/A

DNS Summary 10% 24 Months

DDNS Update Rate Trend Every 30 minutes, starting at

(Summary) the 6th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.

DNS Response Latency Trend Every 30 minutes, starting at

(Summary) the 20th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.

1478 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Reports

Default
Summary Report Data Maximum Index Maximum
Indexes Reports/ Searches Updates Size (% of Total Retention
Index Storage)

DNS Top Requested Domain Every 30 minutes, starting at

Names (Summary) the 4th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Cache Hit Rate Trend Every 30 minutes, starting at
(Summary) the 8th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Top Clients (Summary) Every 30 minutes, starting at
the 2nd minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Query Rate by Query Type Every 30 minutes, starting at
(Summary) the 10th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Query Rate by Member Every 30 minutes, starting at
(Summary) the 12th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Daily Query Rate by Member Every day, starting at 00:32
(Summary) each day. Data covers from
00:00 of yesterday to 00:00 of
today.
DNS Daily Peak Hour Query Rate Every 60 minutes, starting at
by Member (Summary) the 34th minute of each hour.
Data covers from the top of last
hour to the top of current hour.
DNS Replies Trend (Summary) Every 30 minutes, starting at
the 18th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Top Clients Per Domain Every 30 minutes, starting at
(Summary) the 3rd minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Top NXDOMAIN / NOERROR Every 30 minutes, starting at
(no data) (Summary) the 5th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1479

Infoblox Reporting and Analytics

Default
Summary Report Data Maximum Index Maximum
Indexes Reports/ Searches Updates Size (% of Total Retention
Index Storage)

DNS Top SERVFAIL Errors Sent Every 30 minutes, starting at

(Summary) the 6th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Top SERVFAIL Errors Every 30 minutes, starting at
Received (Summary) the 7th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Top Timed-Out Recursive Every 30 minutes, starting at
Queries (Summary) the 8th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DNS Top RPZ Hits (Summary) Every 10 minutes, starting at
the 2nd minute of each 10
minute. Data covers from 20
minute ago to 10 minute ago.
DNS Top RPZ Hits by Clients Every 10 minutes, starting at
(Summary) the 2nd minute of each 10
minute. Data covers from 20
minute ago to 10 minute ago.
DHCP 10% 2 Months

DHCPv4 Usage Statistics N/A

(Detailed)

DHCPv4 Range Utilization Trend N/A

(Summary)

DHCP Message Rate Trend N/A

(Detailed)
DHCP Summary 10% 24 Months
Device Trend (Summary) Every 30 minutes, starting at
every 16th and 46th minutes of
each hour. Data covers the first
30 minutes of the previous 60
minutes.
Device Class Trend (Summary) Every 30 minutes, starting at
every 16th and 46th minutes of
each hour. Data covers the first
30 minutes of the previous 60
minutes.
Top Devices Identified Every 30 minutes, starting at
(Summary) every 16th and 46th minutes of
each hour. Data covers the first
30 minutes of the previous 60
minutes.

1480 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Reports

Default
Summary Report Data Maximum Index Maximum
Indexes Reports/ Searches Updates Size (% of Total Retention
Index Storage)

Top Devices Denied an IP Every 30 minutes, starting at

Address (Summary) every 19th and 49th minutes of
each hour. Data covers the first
30 minutes of the previous 60
minutes.
Top Device Classes (Summary) Every 30 minutes, starting at
every 16th and 46th minutes of
each hour. Data covers the first
30 minutes of the previous 60
minutes.
DHCP Top Lease Clients Every 30 minutes, starting at
(Summary) the 16th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DHCPv4 Range Utilization Trend Every 8 hours, starting at the
(Summary) 24th minute of each half hour.
Data covers the first 8 hours of
the previous 8.25 hours.
DHCPv4 Usage Trend (Summary) Every 8 hours, starting at the
22th minute of each half hour.
Data covers the first 8 hours of
the previous 8.25 hours.
DHCP Message Rate Trend Every 30 minutes, starting at
(Summary) the 14th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
DHCP Lease History 39% 24 Months

DHCP Lease History (Detailed) N/A

Device Fingerprint Change N/A

Detected (Detailed)
Security 1% 24 Months

Threat Protection Event Count N/A

By Severity Trend (Summary)

Threat Protection Event Count N/A

By Member Trend (Summary)

Threat Protection Event Count N/A

By Rule (Summary)

Threat Protection Event Count N/A

By Category (Summary)

Threat Protection Event Count N/A

By Time (Summary)

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1481

Infoblox Reporting and Analytics

Default
Summary Report Data Maximum Index Maximum
Indexes Reports/ Searches Updates Size (% of Total Retention
Index Storage)

Threat Protection Event Count By N/A

Member (Summary)
Threat Protection Top Rules N/A
Logged (Summary)

Threat Protection Top Rules N/A

Logged by IP (Summary)
DNS Top Tunneling Activity Every 30 minutes, starting at
(Summary) every 11th and 41st minute of
each hour.

DNS Tunneling Traffic by Category Every 30 minutes, starting at

(Summary) every 11th and 41st minute of
each hour.

Top Malware and DNS Tunneling Every 30 minutes, starting at

Events by Client (Summary) every 11th and 41st minute of
each hour.

Cloud VM Address History (Detailed) N/A 0% 24 Months

Audit Log Audit Log Events (Detailed) N/A 0% 24 Months

Ecosystem Ecosystem Subscription N/A

Ecosystem Publication

License License Pool Utilization N/A 1%

System Utilization 15% 24 Months

Memory Utilization Trend Every 30 minutes, starting at

(Summary) the 26th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes
Memory Utilization Trend N/A
(Detailed)
Traffic Rate (Detailed) N/A

Traffic Rate by Member Every 30 minutes, starting at

(Summary) the 28th minute of each half
hour. Data covers the first 30
minutes of the previous 60
minutes.
CPU Utilization Trend (Summary) Every 30 minutes, starting at
the top of each half hour. Data
covers the first 30 minutes of
the previous 60 minutes.

Note: When you filter a dashboard by a time frame that is larger than the maximum retention period, the reporting
server returns data within the maximum retention period. For example, when you try to view data of the CPU
Utilization Trend report for the past six months, the server only returns data up to the last two months.

1482 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Reports

Cloning Reports
1. From the Reporting tab, select the Reports tab.
2. Select the report you want to modify, click Edit -> Clone.
3. Enter a new title, ID, and description.
4. Set its permissions. Select Private if you do not want to share the cloned report with other users. Select Clone if
you want the cloned report to have the same permissions as the original report.
5. Click Clone Report.
6. Optionally, you can do the following:
— You can edit permissions, as described in Editing Permissions on page 1455.
— Click View to view the cloned report.
— Click Add to Dashboard to add the cloned report to the dashboard.
Click Open in Search to open the cloned report in the Search page.

Scheduling Reports
You can schedule a report to run on a scheduled interval and trigger an action each time it runs. When scheduling a
report, you can set up an action to send an email to receive report results. In addition, you can export results in CSV
(comma separated value) or XML format.
To schedule a report:
1. From the Reporting tab, select the Reports tab.
2. Select the report you want to schedule, click Edit -> Edit Schedule.

Note: You can schedule a report when you save search results as reports. When you set the paper size to A5, the logo
image and report name may overlap in the footer of the downloaded reports or reports sent through email.

3. In the Edit Schedule dialog box, select the Schedule Report check box.
4. Enter the Schedule and Time range. For more information about how to use the Schedule and Time range options,
refer to the Splunk documentation.
5. Click Next and do the following to set an action for the scheduled reports:
— Send Email: Select this to send an email to a set of recipients to receive report results in text format, or as
CSV or PDF attachments.
— Enter the email address in the To text box. To send the email message to multiple recipients, type a
comma between email addresses.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1483

Infoblox Reporting and Analytics

Figure 40.8 Edit Schedule

— In the Include section, select one of the following: Inline Table, Attach CSV, Attach PDF. Selecting Attach
PDF or Attach CSV attaches the results of the report in the form of a CSV file or a PDF. Make sure that you
specify this information.

Note: Infoblox recommends not to select Link to Report, Link to Results, Search String in the Include section.
These links might not work in our environment. Do not select the Run a Script option because there is no
script to run.

6. Click Save.

Configuring Logo Image in PDF Reports

All reports display the Infoblox logo by default. You can customize reports by removing the Infoblox logo, or by
replacing it with your own company logo. The reporting server uses the latest image file that you have uploaded. Make
sure that you upload a logo file that is in PNG format and has a file size that is smaller than 500 KB. Note that the
image file name must be pdf_logo_image.png. Do not change the logo image file name. You can configure your PDF
reports and schedule to send them through emails. For information about scheduling the delivery of reports, see
Scheduling Reports on page 1483.

Note: In the footer of the report, you can view the logo image (if uploaded), panel name, and the timestamp when
the report was downloaded. When there is no data in a single panel report, the downloaded PDF displays “No
Results Found” along with “Last Updated” information. However, a report with multiple panels displays only
the panel name for the panel that does not have any data.

To upload logo image:

1. From the Administration tab, select the Reporting tab -> expand the Toolbar and click Grid Reporting Properties.
or
From the Grid tab, select the Grid Manager tab and click the Services tab. In the Services tab, select the
Reporting tab and click Edit -> Grid Reporting Properties from the Toolbar.
2. and complete the following:
— Logo Image: Click Upload to open the Upload dialog box. Click Select to navigate to where the image file is
located and click Open. Click Upload to upload the file. The appliance displays a preview of how it will
appear on reports after you successfully upload the logo file. You can click Clear to remove the logo and
upload a new one. Make sure that the file format and size meet the requirements; otherwise, the appliance
displays an error message. You can click Clear to remove the uploaded image file.
3. Click Save & Close.

1484 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Dashboards

About Dashboards
Dashboards provide summary views for most of the data and trends in your Grid. Infoblox recommends not to modify
default dashboards. To modify settings of a default dashboard, you can either clone a default dashboard, or create
a new dashboard from scratch and then add panels and reports. For example, you can create a new dashboard called
“DNS and DHCP Activities,” and then add DNS report, add DHCP related reports, such as DHCP Top Lease Clients and
DHCP Lease History, to the new dashboard. When you save the “DNS and DHCP Activities” dashboard, the reporting
server saves all the reports added to the dashboard and displays dashboard with updated data. By doing this,
user-defined dashboards can provide single point of access to review multiple reports that are relevant to the
activities you want to monitor. Each dashboard comes with a set of filters to further refine report data, as described
in About Dashboard Filters on page 1488.
When you upgrade to 7.3.0 or later, all your system reports are migrated to Reporting tab > Dashboards.

WARNING: Infoblox recommends that you do not modify the predefined dashboards even if you have
appropriate permissions. Editing the default dashboards changes the default settings and your
changes become permanent. In addition, you might not be able to see the latest changes made by
Infoblox. You can select a default dashboard and clone it to modify any of the settings, such as
permissions, panels, and so on. For information, see Cloning Dashboards on page 1485.

In the Dashboard panel, you can do the following using the Edit drop-down list:
• Edit panels as described in Editing Dashboards on page 1486.
• Edit source, title, and description.
• Edit permissions as described in Editing Permissions on page 1455.
• Clone a dashboard as described in Cloning Dashboards on page 1485.

Creating New Dashboards

When you add a new dashboard, Grid Manager displays it in the Reporting -> Dashboards tab. You can add multiple
panels and reports to the new dashboard. For information, see Editing Dashboards on page 1486.
To create a new dashboard:
1. From the Reporting tab -> select the Dashboards tab.
2. Click Create New Dashboard.
3. Complete the following:
— Title: Enter the dashboard title.
— Description: Dashboard description.
— Permissions: Click Shared in App to share a dashboard to other users. Depending on their permissions,
other users can edit the dashboard. When Private is selected, the dashboard is available only to the user
who creates it. You can change permissions later while editing a dashboard.
4. Click Create Dashboard.

Cloning Dashboards
It is not recommended to modify default dashboards. You can select a default dashboard and clone it to modify any
of the settings, such as permissions, panels, and so on.

Note: You do not need any permission to create, modify, and delete your own personal dashboard. However,
limited-access users need Read and Write permissions to modify cloned dashboards. For information about
administrative permissions, see Administrative Permissions on page 1454.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1485

Infoblox Reporting and Analytics

When you clone a dashboard, you can do the following:

• View and set permissions, as described inEditing Permissions on page 1455.
• Schedule PDF delivery, as described in Scheduling PDF Delivery for Dashboards on page 1487.
• Edit panels, as described in Editing Dashboards on page 1486.
To create a personal dashboard:
1. From the Reporting tab, select the Dashboards tab.
2. Select the dashboard you want to modify, click Edit -> Clone.
3. Enter a new title, ID, and description.
4. Set its permissions. Select Private if you do not want to share the cloned dashboard with other users. Select
Clone if you want the cloned dashboard to have the same permissions as the original dashboard.
5. Click Clone Dashboard.
6. Optionally, you can edit permissions, as described in Editing Permissions on page 1455or click View to view the
cloned dashboard.

Editing Dashboards
To edit the panels and filters of a dashboard, it is recommended to clone the default dashboard, and then add panels,
filters and reports to the cloned dashboard. When you add a report to the panel, Grid Manager generates the
corresponding dashboard in the panel. When you save the dashboard, Grid Manager updates reports in each panel.
Alternatively, you can edit the XML source code to add filters and panels to a cloned dashboard, as described in
Editing the XML Source Code of a Dashboard on page 1486.
To add panels and filters to a dashboard:
1. From the Reporting tab -> select the Dashboards tab-> select a dashboard.
2. From the Edit drop-down list, select Edit Panels.
3. In the Edit: <Dashboard> pane, you can click Add Panel or Add Input or Edit Source.

Note: You cannot modify or delete the default values set for the dashboard filters. For example, you cannot
delete or modify the filter All set for Members. When you add a new input using the editor, make sure that
you edit the source and refer to the token for the input in the search string. By doing so, the search is
updated when you change the input value. For information editing source, refer to Splunk documentation.

4. Optionally, you can click to delete a filter. When you delete a filter, make sure that you delete the filter
information from the XML source code as well. For information, see Editing the XML Source Code of a Dashboard
on page 1486.
5. Expand the panel categories and select the panel you want to add. For detailed information about how to add
panel categories, refer to the Splunk documentation.
6. Click Add to Dashboard.

Editing the XML Source Code of a Dashboard

Note: Before editing dashboards, forms, and panel files in simple XML source code, you should be familiar with the
basic layout of dashboards and the XML elements that define them. Make sure that

To edit the XML source code for a dashboard:

1. From the Reporting tab, select the Dashboards tab.
2. Select a dashboard you want to edit the XML source code, click Edit -> Edit Source.
You can add filters, such as check box, drop-down list, radio button, and text box. For information about how to
edit the XML source code, refer to the Splunk documentation.

1486 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Dashboards

Generate Dashboard PDFs

You can do the following:
• Generate and print a dashboard PDF.
• Schedule PDF email delivery.
To generate a dashboard PDF:
1. From the Reporting tab, select the Dashboards tab -> select a dashboard.
2. Click the Export PDF icon to generate a dashboard PDF.
The generated PDF appears in a browser window. You can view, download, or print the PDF from the browser
window. A single dashboard PDF includes up to 1,000 rows of table data.
Do the following to print a dashboard:
1. From the Reporting tab, select the Dashboards tab -> select a dashboard.
2. Click Print. The default print driver for your browser opens with print settings.

Scheduling PDF Delivery for Dashboards

To schedule PDF delivery for dashboards, you must first create a new dashboard. Ensure that email notification
settings are configured prior to scheduling PDF delivery. For information, see Configuring Email Notification Settings
on page 1476. To schedule PDF delivery, you can use the dashboard Edit drop-down list. You can access the Edit
drop-down list directly from a dashboard or from the Dashboards page.

Note: Scheduled PDF delivery is not available for dashboards that include forms.

Do the following if the Schedule PDF Delivery option is disabled:

1. Open the dashboard for which you want to schedule PDF delivery.
2. Click Open in Search icon available at the bottom of the dashboard panel.
3. From the Save As menu, click Dashboard Panel.

To set up PDF delivery for the dashboard with a single panel:

1. From the Reporting tab, select the Dashboards tab.
2. Do one of the following:
— Select the dashboard you want to schedule, click Edit -> Schedule PDF Delivery. If the Schedule PDF Delivery
option is disabled, follow the steps as described above.
— Open the dashboard in the Dashboards page and click Schedule PDF Delivery from the Edit drop-down list.
3. In the Edit PDF Schedule dialog box, do the following:
— Select the Schedule PDF Delivery check box to enable PDF delivery.
— Select a schedule. For more information, refer to the Splunk documentation.
— In the Email To text box, specify email address.
— Select paper size and paper layout. You can change the paper size and paper layout, if data is not displayed
properly in the PDF delivery.
— To receive dashboard PDFs immediately, click Send Test Email.
4. Click Save.

Note: To set up PDF delivery for the dashboard with multiple panels, repeat the above steps from step 1 to step 4
and add other panels to the dashboard created for the first panel.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1487

Infoblox Reporting and Analytics

Figure 40.9 Edit PDF Schedule dialog box

Click Send Test Mail to receive Dashboard PDFs Immediately

About Dashboard Filters

You can apply different filters to control the data displayed in the dashboards. The data on the dashboard is displayed
based on the various filter criteria you select.
To apply a filter:
1. From the Reporting tab, select the Dashboards tab -> select a dashboard.
2. Apply filter criteria appropriately and click Submit.
The dashboards display results based on the filters that you apply.
The most common filters are as follows:
• Time
• Top N: Top most filter options. The default is 10. You can select from a set of fixed values for the TopN filter
setting: 5, 10, 20, 50, 100, 200, 250, or 500.
• Members: Grid members configured on the appliance.
• Network
• Member Site, as described in Applying Extensible Attribute Filters on page 1489.

Applying Time Filters

You can generate a dashboard for a specific time interval by applying time filters. You can filter results by preset time
ranges, create custom time ranges, specify time ranges based on dates or date and time, or work with advanced
features in the time range picker. For information about Time range picker, refer to the Splunk documentation.
The date and time displayed in the Time filters are based on the time zone set in your user profile by default. For more
information about how to configure a time zone, see Setting the Browser Time Zone on page 61. However, the
timestamp displayed in the results for a dashboard is based on the time zone configured on the reporting server.

1488 NIOS Administrator Guide (Rev. A) NIOS 7.3

 About Dashboards

Note: The NIOS reporting data is updated at a certain time interval, rather than updating continuously. Therefore, the
Real-time option in the Time filter might not work for most of the dashboards. For information about update
time intervals, see Reporting Indexes and Update Time Intervals on page 1477.

Applying Extensible Attribute Filters

You can use extensible attribute filters to narrow down the search by including only members that contain certain
extensible attribute values. An extensible attribute added to a member is displayed in the Extensible Attribute filter.
For information about managing extensible attributes, see About Extensible Attributes on page 417. When you
configure group-by-extensible-attribute search and apply the Extensible Attribute filter, the dashboard displays
results for grouped members that have the same extensible attribute value for the Site extensible attribute. If you
have configured multiple attribute values for a member, then applying the Extensible Attribute filter displays all the
attribute values associated with that member. For example, if member 1 has predefined attribute Site with attribute
values member a and member b and member 2 has predefined attribute Site with attributes values member c and
member d, then the dashboard displays member a and member b when you apply the Member Site <member 1>
filter.
In addition, you can apply Group By EA Tag filter and group members with the same extensible attribute value so that
instead of displaying data per member, the reports display data per group of members with the same value for the
Site extensible attribute. When you apply Group By EA Tag filter, you can set the data calculation method to decide
which statistic value [Aggregate, Average, or Maximum] you want to be displayed for grouped members. You can
group by Active Directory Sites for the IPAMv4 Network Usage Statistics report, IPAMv4 Top Utilized Networks report,
and DHCPv4 Network Usage Statistics report.
To apply an extensible attribute and group by EA tag/field filters:
1. From the Reporting tab, select the Dashboards tab -> select a dashboard.
2. In the filter section, complete the following:
— Member <Extensible Attribute>: Select an extensible attribute configured for a member. If you need an
additional extensible attribute filter, you must first clone the default dashboard, and then add an extensible
attribute filter by editing the XML source code. For information, see Editing the XML Source Code of a
Dashboard on page 1486.
— Group By EA Tag/Field: Select an extensible attribute to enable the reporting server to group networks by
members that have certain extensible attribute tags or fields. Note that this option is available for specific
dashboards only.
— Calculation Methods: This field is enabled only when you select the Group by EA Tag/Field check box. The
displayed result varies based on your search definitions. The result values can contain information such as
event counts, DNS queries, traffic rate, and usage trends. For example, when you select Maximum, the DNS
Query Rate by Member dashboard shows all the members that have the same extensible attributes and
members with the maximum DNS queries, and the Threat Protection Event Count By Member dashboard
shows the members that have the same extensible attributes and maximum event counts. Select one of the
following methods:
— Aggregate: Displays the sum of values for individual members in a group.
— Average: Displays the mathematical average of a group. This value is obtained by adding values for all
members in a group and then dividing the total by the number of members.
— Maximum: Displays the maximum value among the members in a group.

Note: When you apply Group By EA Tag/Field in Active Directory Sites supported reports, the values displayed
in these reports are aggregated sum of absolute values (sum of values of individual networks in a group)
and utilization% is the mathematical average of the group.

NIOS 7.3 NIOS Administrator Guide (Rev. A) 1489

Infoblox Reporting and Analytics

You can configure the group-by-extensible-attribute filter and data calculation methods for the following dashboards
only:
• CPU Utilization Trend (Detailed)
• IPAMv4 Network Usage Statistics on page 1494
• IPAMv4 Top Utilized Networks on page 1495
• IPAMv4 Network Usage Trend on page 1495
• DDNS Update Rate Trend on page 1502
• DHCPv4 Usage Statistics on page 1500
• DNS Daily Query Rate by Member on page 1503
• DNS Query Rate by Member on page 1504
• DNS Daily Peak Hour Query Rate by Member on page 1503
• DNS Response Latency Trend on page 1504
• DNS Cache Hit Rate Trend on page 1502
• DNS Traffic Control Resource Availability Trend on page 1507
• DNS Traffic Control Resource Pool Availability Trend on page 1507
• DNS Traffic Control Response Distribution Trend on page 1507
• Memory Utilization Trend on page 1517
• Traffic Rate by Member on page 1517
• Threat Protection Event Count By Member on page 1512
• Threat Protection Event Count By Member Trend on page 1511

Predefined Dashboards
Table 40.7 lists the dashboard categories and their corresponding dashboard. You can apply filters and view the
dashboards in table, stacked area, or in both the view.

Note: The DNS Zones Last Queried report and DNS Resource Records Last Queried report support IDNs.

Table 40.7 Report Categories

Dashboard Category Corresponding Dashboard Displays IDNs in

Punycode (Yes/No)
Audit Log Events Audit Log Events Yes
IPAMv4 Utilization DHCPv4 Top Utilized Networks Yes
DNS Statistics per DNS View Yes
DNS Statistics per Zone Yes
IPAMv4 Network Usage Statistics Yes
IPAMv4 Network Usage Trend Yes
IPAMv4 Top Utilized Networks Yes
Devices (Discovery) Inactive IP Addresses Yes
Port Capacity Utilization by Device Yes
Port Capacity Trend Yes
Port Capacity Delta by Device Yes

1490 NIOS Administrator Guide (Rev. A)