MarketScope for DNS, DHCP and IP Address Management

Transcription

1 MarketScope for DNS, DHCP and IP Address Management Gartner RAS Core Research Note G , Lawrence Orans, 12 November 2009, R The emergence of new vendors, appliance-based offerings and new pricing models has established a true market for DNS, DHCP and IP address management products (DDI). Midsize organizations can now benefit from DDI solutions, and large enterprises should re-evaluate their implementations. WHAT YOU NEED TO KNOW Enterprises must evaluate the level of operational discipline and control they need for their Domain Name System (DNS)/DHCP infrastructure. Before moving to the vendor evaluation phase, first select the appropriate deployment model for your environment. Overlay management and bundled DNS/DHCP solutions with IP address management (IPAM) are the most common, although some organizations may opt for managed services. A good understanding of your DDI requirements and implementation goals (for eample, use eisting DNS/DHCP servers or add new ones) will make for a more-efficient and successful vendor selection process. MARKETSCOPE An eplosion in IP addresses (from IP telephony, mobile devices, virtualized services and other networkable endpoints) and an increased awareness of the mission-critical nature of DNS and DHCP services have been the primary drivers for the emergence of the DDI market. Previously, enterprises had few reasonable product choices for managing DNS and DHCP, and many network managers chose to write scripts or use spreadsheets to manage their IP address spaces. Now, a market for DDI products and services has materialized, and this MarketScope is Gartner s first analysis of the vendors in the market. The vendor landscape has shifted in recent years due to neglect, slow revenue and customer preferences for appliance-based offerings. Nortel, once a prominent DDI vendor, discontinued its IP Address Domain Manager (formerly Optivity NetID) as of 1 January Cisco, another once-prominent DDI vendor with its Cisco Network Registrar product (which is still available), declined to participate in our MarketScope process and no longer actively promotes the product. The success of integrated DNS/DHCP appliance-based offerings from Infoblo and BlueCat has forced other vendors to adapt and deliver their own appliances. The market continues to evolve as more vendors deliver DDI solution components in virtualized images. DNS and DHCP services are available free of charge from several sources. The Internet Systems Consortium (ISC) provides the open-source BIND DNS and an open-source DHCP solution. DNS and DHCP services are embedded in Windows Server 2003 and 2008, and some organizations use DHCP services included with Cisco routers. Despite these no-cost or low-cost options, the market for commercial DDI solutions continues to grow. Gartner estimates that the DDI market will reach $176 million in 2009, reflecting a growth of approimately 10% from Below are the primary reasons why organizations choose to invest in commercial DDI solutions:

2 2 Centralized control: Many organizations distribute DNS responsibility across two or more teams because they have implemented DNS on multiple platforms. For eample, it is common for the Active Directory team to manage the DNS services embedded in Windows Server, and for the network team to manage a separate DNS service (typically BIND) for non-windows servers and endpoints. Organizations that have evolved through mergers and acquisitions often maintain DNS/ DHCP services on other platforms, further complicating an already heterogeneous environment. Commercial DDI solutions not only offer improved management and administrative capabilities, but also give an organization the ability to centralize control of its DNS and DHCP services. Stability: Poor DNS infrastructure design and the lack of centralized control contribute to DNS instability in many environments. Commercial DDI solutions help stabilize DNS and DHCP infrastructure with improved reliability and availability features (e.g., failover capabilities). Also, migrating from one DNS platform to another typically triggers a re-evaluation of the DNS design (often through a professional service engagement), which can improve stability. Operational/political issues: With software-based DNS/ DHCP solutions, tensions often develop between the team that is responsible for these services and the team that owns the underlying platform (e.g., Windows Server and/or Uni/ Linu servers). IT professionals (typically the network team) who manage DNS/DHCP increasingly prefer migrating to an appliance form factor because it gives them complete control over these services, without having to worry about maintaining the underlying operating system (OS) and server platform. IPAM: A significant shortcoming to the commonly used DNS and DHCP services from Microsoft is the lack of IPAM capabilities (the ISC s open-source BIND DNS and DHCP also lack IPAM). IPAM provides a range of capabilities for controlling, automating and managing the domain name and address space, and offers a significant improvement over spreadsheets and most homegrown address management applications. Market/Market Segment Description This MarketScope analyzes the market for DDI solutions that complement internal DNS and DHCP implementations. The market for eternal DNS services consists primarily of Internet service providers (ISPs), Web hosting providers, and DNS managed service vendors (e.g., Akamai, Neustar and others) that provide primary and/or secondary authoritative DNS name servers with varying degrees of reliability and security. While many DNS servers can be used for internal or eternal DNS, the administrative and operational requirements for internal and eternal DNS are quite different. The internal DDI market is primarily product-focused, and the eternal DNS market is primarily service-focused. The two largest categories of DDI solutions are as follows (see DNS DHCP and IPAM Market Overview for more information). Bundled Offerings Bundled offerings, in which DNS and DHCP services share an integrated database, represent the fastest-growing segment of the DDI market. Bundled offerings are available as appliances or software. Over the past three to four years, momentum has shifted toward the appliance form factor. Most organizations choose to integrate the DNS component with the embedded DNS services used by Microsoft s Active Directory, although some organizations choose to implement the new DNS service as a complete replacement for Microsoft DNS. Bundled solution vendors provide IPAM via two models: as an embedded function or an optional component. Integrating DNS, DHCP and IPAM functions improves workflow tasks and the manageability of the IP address space, and reduces the risk of human error in today s largely manual and uncontrolled process. Overlay Management Solutions Overlay management solutions are meant to complement, not replace, free DNS and DHCP services. They are simpler to deploy than bundled solutions, which require the replacement of the DNS/ DHCP infrastructure or integrating with eisting DNS servers. Overlay solutions provide help in two areas: adding enterprise management capabilities to DNS and DHCP, and adding IPAM functions. The solutions are modular in nature, so enterprises can choose to deploy just IPAM, just DNS/DHCP management or an integrated DDI solution. A key benefit of most DNS modules is that they can manage heterogeneous (ISC BIND and Microsoft DNS) environments. There is a small market for managed DDI services, although Gartner estimates that it represents less than 5% of the total spending on DDI solutions. Managed service vendors deploy DDI solutions on their customers premises and then manage DNS and DHCP services remotely. Only a few providers offer managed DDI services, including HP/EDS, Neustar (a major player for eternal DNS services) and Tuscany Networks (European focus). BT Diamond entered the DDI managed service market in Inclusion and Eclusion Criteria To be included in this MarketScope, a vendor s solution must match Gartner s description of an overlay management solution or a bundled offering, as noted above. Additional criteria include: The products with the required features and functions must have been shipping as of 1 November The vendor must have generated at least $5 million in sales during the 12 months leading up to 1 November Gartner, Inc. and/or its Affiliates. All Rights Reserved. Reproduction and distribution of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner s research may discuss legal issues related to the information technology business, Gartner does not provide legal advice or services and its research should not be construed or used as such. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The opinions epressed herein are subject to change without notice.

3 The following solutions have been ecluded from this analysis: Load balancers and application delivery controllers from F5, Cisco and others that include DNS functionality that s primarily used for traffic redirection (for disaster recovery or global server load balancing). These are specialized solutions that do not offer the broader DDI feature set. DNS-only offerings that are targeted at service providers (for eample, Nominum and Secure64). Managed eternal DNS services from ISPs, Web hosters or managed DNS. Microsoft s DNS and DHCP services (included with Windows Server 2003 and 2008) have been ecluded because they have limited administration and management capabilities, and do not include an IPAM solution. Some IPAM-only solutions do not offer integrated DNS/DHCP solutions, nor do they provide DNS administration capabilities. These solutions were not included in this analysis because they do not match Gartner s definition of overlay management or bundled solutions. Eamples of IPAM-only solutions are Easy-IP from Crypton Computers and Orion IPAM from SolarWinds. These tools offer basic IPAM functionality that can help enterprises plan and manage an IP address space, although most Gartner clients require a more-advanced feature set. However, Gartner will re-evaluate these solutions for its 2010 DDI market analysis. Rating for Overall Market/Market Segment Overall Market Rating: Promising DDI products have been around since the mid-1990s, yet the market is still below $200 million. DDI offerings are largely independent of other IT solutions and haven t benefited from synergy with other technologies. None of the vendors analyzed in this MarketScope supply technology via an OEM agreement to another technology vendor. Efforts to link DDI to network access control have not been successful, and efforts from Riverbed Technology and Cisco to embed DNS/DHCP services in WAN optimization controllers have been met with weak demand. The rise of the appliance-based offerings has transformed the market and given enterprises another reason to consider DDI solutions. New pricing models have made DDI solutions attractive to a broader set of enterprises (10,000 to 100,000 IP addresses). Organizations that manage 5,000 or fewer IP addresses are unlikely to adopt commercial DDI offerings. These organizations will continue to use the no cost approach of spreadsheets and the embedded DNS/DHCP services within Windows Server. Mandates from governments worldwide to adopt DNS Security Etensions (DNSSEC), and commitments from VeriSign and other major domain name registries to sign zones via DNSSEC, will also help the DDI market. Overall, Gartner epects DNSSEC adoption to be slow. By 2014, only 30% of all DNS look-ups will be signed with DNSSEC. Nonetheless, as more enterprises sign their zones, they will move away from BIND and adopt commercial DNS solutions that offer tools to ease the key management and zone signing processes. 3 Evaluation Criteria Table 1. Ability to Eecute Evaluation Criteria Evaluation Criteria Market Understanding Offering (Product) Strategy Innovation Geographic Strategy Overall Viability (Business Unit, Financial, Strategy, Organization) Marketing Eecution Customer Eperience Comment Ability of the vendor to understand buyers needs and translate those needs into products. The ability to provide an evolutionary approach to upgrading DNS/DHCP infrastructure, and to add management to these services. A proven track record of delivering new products and services that complement basic DNS and DHCP services. An evaluation of the vendor s strategic product direction, including an analysis of its road map. IPAM features and product direction are heavy components of this criterion. Advanced features like automatic discovery and reconciliation, audit trails and back-out capabilities are eamples of more-sophisticated solutions. Where applicable, integrated DNS/DHCP solutions will be evaluated for differentiating factors (including API, database features and high-availability features). This criterion includes product leadership and the ability to deliver features and functions that distinguish the vendor from its competitors. Beyond the basic repackaging of open-source DNS and DHCP, features that enhance the manageability and reliability of these services will be evaluated. Internally developed DNS and DHCP services will be analyzed for differentiating features beyond those available in open-source solutions. The vendor s strategy for targeting prospects and providing support beyond its home market. Viability includes an assessment of the vendor s overall financial health, the financial and practical success of the business unit, and the likelihood of the individual business unit continuing to invest in a DDI solution. This criterion assesses the effectiveness of the vendor s marketing programs, and its ability to create awareness and mind share. Quality of the customer eperience based on reference calls and Gartner client teleconferences. Weighting High High Standard Low High Standard Standard Source: Gartner (November 2009)

4 4 Figure 1. MarketScope for DNS, DHCP and IP Address Management RATING Strong Negative Caution Promising Positive Strong Positive Alcatel-Lucent BlueCat Networks BT Diamond EfficientIP Infoblo Men & Mice As of 11 November 2009 Source: Gartner (November 2009) Vendor Product/Service Analysis Alcatel-Lucent The VitalQIP product was part of Lucent (via the Quadritek Systems acquisition) before its merger with Alcatel. Quadritek s VitalQIP is widely regarded as the original IPAM solution (circa 1995), and it garnered a large market share in service provider and large enterprise accounts. Its DNS service is based on BIND, and its DHCP service has been internally developed. IPAM capabilities are embedded in the VitalQIP offering at no etra charge. VitalQIP is available as a software offering, as an appliance and in a virtual environment on the VMware platform. VitalQIP has proven scalability. Several service providers and large enterprises are using it to manage environments with more than 1 million IP addresses. Several partners offer managed DDI services based on VitalQIP. VitalQIP provides management support from a single console for a heterogeneous DNS/DHCP environment. As an overlay solution, it can manage BIND and Microsoft DNS, and it can also manage Microsoft DHCP, as well as managing its own DDI solution. VitalQIP includes an etensive list of standard reports. Good audit trail capabilities are provided via the VitalQIP Audit Manager (a separate product; some features will be bundled with the standard solution in 2010). During the past three to four years, many VitalQIP customers defected to other solutions due to pricing and product deficiencies. Alcatel-Lucent was late to market (2007) in developing its own appliance (appliances had been available through third parties). For several years, VitalQIP s Web interface compared unfavorably with some of its competitors (Alcatel-Lucent updated the VitalQIP Web interface in 2008). Now that many product-related issues have been addressed in 2008 and 2009, Alcatel-Lucent must prove that it can eecute by growing its market share. Feedback on Alcatel-Lucent s service and support remains mied. Slow response to customer needs remains a common concern. Alcatel-Lucent s sales and distribution channel cannot adequately address the midsize market. The Web interface lacks key features and is still maturing. For eample, DHCP lease history requires a separate application, and log file information is not easily searchable (it must first be eported to a tet editor, such as WordPad). Rating: Promising BlueCat Networks BlueCat is a dedicated DDI-only vendor based in Toronto. Founded in 2001, the company remains privately held. Its DNS and DHCP services are based on the open-source code from the ISC (BIND and DHCP). BlueCat s integrated DNS/DHCP solutions are appliance-based. The IPAM solution requires a separate product (also appliance-based). All versions of BlueCat s physical appliances are available in a virtual format for the VMware platform.

5 Proteus is a strong IPAM solution with a Web-based graphical user interface (GUI). It has several advanced features, including IP reconciliation. Proteus provides some management support from a single console for a heterogeneous DNS/DHCP environment. As an overlay solution, it can manage a Microsoft Windows DNS/ DHCP environment as well as its own appliances (but it cannot manage BIND or ISC DHCP servers). BlueCat has operated largely as a bootstrap company. It has strong financial management and has grown to be a viable competitor in the DDI market, with only a limited amount of venture capital funding. In November 2009, it raised $11 million in its first round of institutional financing. BlueCat lacks an inepensive, entry-level IPAM solution. BlueCat customers need to purchase a separate IPAM appliance, whereas several competitors bundle IPAM with their core offerings. BlueCat s sales and distribution channel is heavily weighted to direct sales, although it has been shifting toward a stronger channel focus. BlueCat needs to continue this approach to broaden its reach. BlueCat still needs to prove that it can displace incumbents Alcatel-Lucent and BT Diamond in the largest implementations (approimately 1 million IP addresses and above). Rating: Positive BT Diamond The Diamond IP solution has been part of BT since it acquired International Network Services in BT Diamond s DNS and DHCP services are based on open-source code from the ISC (BIND and DHCP). BT Diamond IP is available as software, as an appliance and in a virtual environment on the VMware platform. IPAM capabilities are embedded in BT Diamond IP at no etra charge. BT Diamond provides management support from a single console for a heterogeneous DNS/DHCP environment. As an overlay solution, it can manage BIND and Microsoft DNS. It can also manage Microsoft DHCP and ISC DHCP, as well as manage its own DDI solution. Since 2009, BT Diamond IP has offered managed DDI services. BT Diamond IP includes a strong IPAM solution with a Webbased GUI. It has several advanced features, including IP reconciliation and the ability to map IP addresses to physical LAN switch ports (some other solutions require an additional appliance to add this feature). BT Diamond is a highly scalable solution. Several of its customers manage environments with more than 1 million IP addresses. BT Diamond s sales and distribution channel is heavily weighted to direct sales. To broaden its reach, it will need to build a stronger value-added reseller channel. Currently, it does not have an adequate channel to address the midsize market. Low-profile marketing efforts have resulted in weak name recognition in the DDI market. Rating: Positive EfficientIP EfficientIP is a dedicated, DDI-only vendor based in France. Founded in 1997, it remains a small, privately funded company. Its DNS and DHCP services are based on the open-source code from the ISC (BIND and DHCP). EfficientIP s integrated DNS/ DHCP solutions are appliance-based. IPAM is delivered as an additional component (IPManager module) that can be activated on the EfficientIP DNS/DHCP appliance or installed separately on a Uni server. EfficientIP also offers a separate module, IPLocator, on its appliances that maps active IP addresses to physical switch ports. EfficientIP s solutions can run in a virtual environment on the VMware platform. EfficientIP provides management support from a single console for a heterogeneous DNS/DHCP environment. As an overlay solution, it can manage BIND and Microsoft DNS. It can also manage DHCP services from Microsoft, ISC and Cisco IOS Software, as well as manage its own DDI solution. The IPAM solution is strong and includes several advanced capabilities, including IP reconciliation (the optional IPLocator module is required for some advanced features). EfficientIP has strong channel partners in Europe, particularly in France. Several partners offer managed DDI services based on the EfficientIP solution. As a small company, EfficientIP faces sales and distribution challenges in competing with larger DDI vendors, particularly as it attempts to epand outside of Europe. EfficientIP s product differentiation and overall marketing message are weak. 5

6 6 EfficientIP has limited resources, yet it is attempting to compete in the service provider and the enterprise markets. As the enterprise DDI market matures, EfficientIP will find it more challenging to maintain a dual-market (service provider and enterprise) approach. Rating: Caution Infoblo Infoblo is a dedicated, DDI-only vendor based in Santa Clara, California. Founded in 1999, the company remains privately held. Its DNS and DHCP services are based on the open-source code from the ISC (BIND and DHCP). Infoblo s integrated DNS/DHCP solutions are appliance-based. IPAM capabilities are embedded in the DNS/DHCP appliances at no etra charge. Infoblo provides a virtualized DDI solution for Riverbed WAN optimization controllers and for Cisco Integrated Services Routers. In addition to its core DDI appliances, Infoblo offers its PortIQ appliance for mapping active IP addresses to physical switch ports. Infoblo is the DDI market share leader (as measured by annual revenue). The company enjoys strong name recognition, as it appears on the shortlists of most Gartner clients that are considering DDI solutions. Infoblo s grid technology is a differentiator in the market. All Infoblo appliances in a grid share a common database that is automatically replicated to each appliance, and includes data files, log files and configuration information. Feedback from customers indicates that the grid simplifies several operational tasks, including distributing software updates and replacing failed units. The grid also enables redundancy. If an appliance fails, then another device in the grid automatically takes over the role of providing its DNS and DHCP services. The updated IPAM solution (released in February 2009) provides strong capabilities and is much improved over previous versions. It has a Web-based GUI and includes several advanced features (although it does not automatically reclaim inactive IP addresses). An eperienced management team (mostly former NetScreen eecutives) has invested heavily in marketing during the past three to four years, which has strengthened Infoblo s name recognition and enabled it to promote awareness of appliancebased DNS/DHCP solutions. Infoblo still needs to prove that it can displace incumbents Alcatel-Lucent and BT Diamond in large implementations of approimately 1 million IP addresses and higher. The gridbased approach is currently limited to 250 appliances in the grid, which presents scalability challenges. However, Infoblo has plans to improve grid scalability. Infoblo s core IPAM solution lacks overlay capabilities. It does not manage Microsoft DNS or DHCP services, nor does it manage ISC BIND or DHCP. Infoblo does offer a dedicated appliance, IPAM WinConnect, that can manage Windows DNS/ DHCP services, although its console is separate from the core Infoblo management console. Infoblo plans to add overlay management within the Infoblo management console for Microsoft DNS and DHCP services. Rating: Strong Positive Men & Mice Men & Mice was founded in 1990 and is a privately held company based in Iceland. Its early focus was on DNS management and administration, and in 2007, it added IPAM functionality. Men & Mice s offering is strictly an overlay solution for eisting DNS and DHCP services. The product is available as a software-only solution, and also as a virtual appliance for Microsoft Hyper-V and VMware platforms. Men & Mice does not offer its own DNS or DHCP servers. Men & Mice provides strong DNS/DHCP administrative management support from a single console for a heterogeneous environment. As an overlay solution, it can manage BIND and Microsoft DNS, and it can also manage DHCP services from Microsoft, ISC and Cisco IOS. The Men & Mice solution installs easily because it is an overlay solution that organizations use to manage and administer their eisting installed base of DNS and DHCP servers. Tight integration with Microsoft Active Directory eases some operational tasks, particularly site/subnet association. Infoblo has a strong value-added reseller channel, and some partners offer managed DDI services based on Infoblo products.

7 As a small company, Men & Mice faces sales and marketing challenges in competing with larger DDI vendors with stronger distribution channels. Its sales model is heavily weighted toward direct sales, which is a liability, given the company s small sales team. Men & Mice lacks strong channel partners in North America and in the Asia/Pacific region. Men & Mice s decision to focus strictly on overlay solutions and not offer a DNS/DHCP appliance has limited its growth. Among enterprises that choose to invest in commercial DDI solutions, market momentum is overwhelmingly in favor of integrated DNS/DHCP appliance-based solutions. Men & Mice s IPAM solution falls short of its competitors solutions in several key areas. Overall, the GUI needs improvement, and several advanced configuration and administration functions require a Windows client. Important capabilities that are missing from the IPAM solution include setting thresholds for generating alerts when an IP address range approaches depletion, and autogenerating a naming policy when adding records to a DNS zone (naming conventions are common in large implementations). Men & Mice s network discovery and IP reconciliation capabilities are weak. IP addresses are discovered via ping sweeps, an approach that is blocked in many endpoint protection platforms (several DDI vendors use the more-reliable network discovery approach of reading ARP caches in Layer 3 devices). The IPAM product does not provide reports on database mismatches (i.e., differences between the network discovery database and the IPAM database), nor does it include the ability to automatically reclaim IP addresses (although a script can be written to do so). Rating: Caution Vendors Added or Dropped We review and adjust our inclusion criteria for Magic Quadrants and MarketScopes as markets change. As a result of these adjustments, the mi of vendors in any Magic Quadrant or MarketScope may change over time. A vendor appearing in a Magic Quadrant or MarketScope one year and not the net does not necessarily indicate that we have changed our opinion of that vendor. This may be a reflection of a change in the market and, therefore, changed evaluation criteria, or a change of focus by a vendor. Gartner MarketScope Defined Gartner s MarketScope provides specific guidance for users who are deploying, or have deployed, products or services. A Gartner MarketScope rating does not imply that the vendor meets all, few or none of the evaluation criteria. The Gartner MarketScope evaluation is based on a weighted evaluation of a vendor s products in comparison with the evaluation criteria. Consider Gartner s criteria as they apply to your specific requirements. Contact Gartner to discuss how this evaluation may affect your specific needs. 7

8 8 In the below table, the various ratings are defined: MarketScope Rating Framework Strong Positive Is viewed as a provider of strategic products, services or solutions: Customers: Continue with planned investments. Potential customers: Consider this vendor a strong choice for strategic investments. Positive Demonstrates strength in specific areas, but eecution in one or more areas may still be developing or inconsistent with other areas of performance: Customers: Continue planned investments. Potential customers: Consider this vendor a viable choice for strategic or tactical investments, while planning for known limitations. Promising Shows potential in specific areas; however, eecution is inconsistent: Customers: Consider the short- and long-term impact of possible changes in status. Potential customers: Plan for and be aware of issues and opportunities related to the evolution and maturity of this vendor. Caution Faces challenges in one or more areas: Customers: Understand challenges in relevant areas, and develop contingency plans based on risk tolerance and possible business impact. Potential customers: Account for the vendor s challenges as part of due diligence. Strong Negative Has difficulty responding to problems in multiple areas: Customers: Eecute risk mitigation plans and contingency options. Potential customers: Consider this vendor only for tactical investment with short-term, rapid payback.