Infoblox Core Network Services solution

Transcription

1 Infoblox Core Network Services solution Table of contents: 1. INFOBLOX - AUTOMATION AND RESILIENCE FOR CORE NETWORK SERVICES 3 2. ISSUES OF CORE NETWORK SERVICES ON AD HOC PC SYSTEMS 3 Management and maintenance 4 Security concerns 4 Reliability concerns 4 Scalability issues 4 3. ADVANTAGES OF THE INFOBLOX SOLUTION 4 Simplify 4 Secure 4 Strengthen 5 Total Cost of Ownership 5 4. ADVANTAGES OF THE INFOBLOX GRID SOLUTION 5 Centralized visibility and control with streamlined workflow 5 Centralized Back-up and restore 5 Centralized monitoring and reporting 6 Automatic disaster recovery mechanisms 6 5. INTRODUCING INTEGRATED IP ADDRESS MANAGEMENT 6 6. INTRODUCING PORTIQ 8 7. FORTIFYING MICROSOFT ACTIVE DIRECTORY 9 Difficult to assign and log IP addresses in a controlled way 9

2 Limitations in the MS DNS protocol engine 9 The challenge of orphan records and scavenging 9 Propagation delay of DNS changes 10 Dependency between DNS and Active Directory 10 Infoblox as dedicated DNS/DHCP solution in support of Microsoft AD neutralizes these issues 10 USING INFOBLOX AS THE FOUNDATION FOR MANY APPLICATIONS 10 SOX-BASEL2 compliance reporting and IP Address Management THE INFOBLOX OFFERING 11

3 1. Infoblox - automation and resilience for core network services Infoblox is the pioneer and focused developer of Core Network Service Appliances for DNS, DHCP, IP Address Management, File Distribution and NTP. The Infoblox solution help companies to provide automation and resilience for these core network services. The fast growth of IP connected devices and users, together with their dynamic and mobile nature, are turning networks into an anonymous state. Infoblox core network service appliances provide the essential foundation for identity-driven networks (IDNs), delivering simple, secure, and reliable core network services including DNS, DHCP, IP Address Management, File Distribution and NTP. The integrated Infoblox approach combines the simplicity of appliances with the power of advanced distributed database technology to effectively achieve centralized control and visibility and utility grade resilience, unparalleled by conventional solutions based on legacy software. The Infoblox Grid solution provides an appliance based infrastructure that offers automation and resilience for all core network services. The Infoblox Grid solution provides core network services such as DNS, DHCP, IPAM and other related protocols like (T)FTP/HTTP file distribution and NTP in a unified solution delivered in the form of dedicated hardware under central management. Automated failover and disaster recovery mechanisms guarantee non-stop operation. This can be achieved by replacing legacy software and servers by core network service appliances, managed from one master appliance. Offering dedicated hardware with a purpose built Operating System (NIOS), the Infoblox Grid solution provides the following advantages. - A standardized core network services infrastructure for all applications throughout the network. Including centralized visibility and control, delegated administration and advanced reporting. - Better security in terms of attack mitigation, network access control and compliance reporting. - Advanced Hi-availability mechanisms with immediate and stateful hardware or service failover. - Automated Disaster Recovery mechanisms which allow easy and fast resolution in case of critical outages. 2. Issues of core network services on ad hoc PC systems While all core network services, such as DNS and DHCP, are similar (they all consist of a database and an associated access protocol) they have until now been implemented using unrelated, ad-hoc systems using various PC platforms (eg. Dell server, SUN server, ) running various general purpose operating systems (eg. Microsoft, Open BSD, Solaris, ). Traditionally core network services such as DNS, DHCP and others are deployed in an ad-hoc fashion as software applications on a mix of hardware and operating systems, managed by various consoles and people. Furthermore, the IP number plan and overview of active IP devices in the network often resides in an isolated spreadsheet. This provides challenges in terms of consistency (out of date info), sharing (how to delegate parts of the IP number plan) and reporting (real time and historic usage of IP addresses). As the demands on networks grow, network administrators spend increasingly precious and limited resources addressing the following issues and challenges:

4 Management and maintenance Provisioning, deploying and maintaining servers and updating underlying operating systems and core network service applications. No automation of tasks, no centralized visibility and control on IP devices, no easy delegation of tasks, lack of centralized reporting/audtiting. Security concerns Keeping up to date with the latest OS and application patches, responding to new attacks controlling network access, lack of auditing tools for compliance to regulations. Reliability concerns Ensuring non-stop operation and "dial-tone-like" availability for DNS/DHCP and other core network services. Scalability issues Dealing with the growth in network identity databases (IP, MAC, User, ) and the need to distribute core network services across the enterprise to minimize latency and ensure redundancy. Recognizing the urgent need for unified, manageable, secure, and scalable core network services, Infoblox is the first and only company to approach network services as a unified solution deployed and managed as an important network infrastructure. 3. Advantages of the Infoblox solution As indicated, Infoblox bundles core network services such as DNS/DHCP/IPAM and others in a unified solution delivered in the form of dedicated appliances under central management. Offering dedicated hardware with purpose built firmware, the Infoblox solution provides the following advantages: Simplify - Centralized visibility and control, with delegated administration and advanced reporting/auditing. - The Infoblox solution eases installation, configuration and maintenance. Instead of building the core network service component yourself (eg. DNS name server using BIND on Linux) which needs time and expertise, just plug in the Infoblox appliance and create your first domain name, zone or DHCP range in minutes. - Easy configuration of all aspects by using the graphical WebGUI, with build in error prevention, automation and migration tools. - Upgrading the Infoblox appliance just needs a few clicks in the GUI, including easy rollback to previous firmware versions. - Simplify and shorten learning curve for administrators (no complex BIND options to learn) - Integrated IP Address Management for the inventory of your networks and connected devices. Just create host objects, with all info you want to tie to it, and the Infoblox solution will insert the necessary entries in the DNS and DHCP configuration for you. Secure - The purpose built Infoblox firmware, called NIOS, is much less vulnerable for the many exploits that exist for general purpose operating systems or network service applications. - Infoblox has a dedicated team of security watchers that will build, test and distribute patches very quickly in case a vulnerability would be found in NIOS. - Patching the Infoblox appliance just needs a few clicks in the GUI

5 - Built in DOS attack prevention mechanisms - No unused open ports, management traffic is encrypted and authenticated - Centralised auditing allows forensic analyses of all events, such as admin changes or tracing back which IP address was used by which user/machine at what time Strengthen - The Infoblox appliance can be setup in high availability pairs for quick and statefull failover using standard VRRP (eg. DHCP failover maintaining the complete lease table). - Automated service failover for all protocols - Automated disaster recovery mechanisms across multiple physical locations Total Cost of Ownership - Together the above advantages decrease the operational costs, bringing down the overall TCO of the core network service infrastructure. Detailed cost studies show that, compared to traditional software based implementations, the Infoblox solution offers a return of investment period of 8 to 12 months. 4. Advantages of the Infoblox GRID Solution The Infoblox Grid Solution provides automation and resilience for all core network services by replacing the traditional DNS/DHCP software by dedicated core network service appliances. Infoblox offers a unique Grid concept that brings multiple Infoblox appliances under central administration. Multiple Infoblox appliances that are distributed physically over the network can be brought under the administration of a single GRID Master appliance. This concept allows central management of the IP number plan, DNS, DHCP, File Distribution, NTP and others without having to install separate management software or dedicated and expensive database systems. Hence, multiple Infoblox appliances can be joined together into a group of members under the administration of the master appliance. This allows administrators to remotely manage the configuration and data contained in multiple appliances from the GRID Master. This Infoblox GRID solution provides the following advantages: Centralized visibility and control with streamlined workflow - Centralized visibility and control with automation and delegated administration. - Configure something once and assign it to the complete Grid. With multi-appliance configuration and data entry from a single GUI interface, many operations are streamlined to save you time. For example, when adding a new DNS zone, it can be created, mapped to several appliances (as name servers), configured with specific zone parameters, and even have the contents imported from an existing DNS server, all through one dialog. This approach simplifies the initial configuration and the ongoing lifecycle management of devices, rather than having to individually setup and administer each device independently. - With the inheritance model you have the granularity to configure specifications for a group of devices, but still provide changes to an individual device for specified capabilities. - Role based administration and unified management of administrator accounts allows delegation and management according to your organization. Centralized Back-up and restore - As all configuration information for the is available at the master level, easy singl-point, backup and restore is possible. - Facilitates versioning and roll back to previous configuration versions.

6 Centralized monitoring and reporting - Operational reports: The real time monitor gives instant information about the health of your Infoblox appliances and services - NAC reports: All members forward their system events to the master allowing one-touch investigation and analysis of IP, MAC, user activity. - Audit reports: auditing and reporting are available from one point to track administrator activities at all times. This includes an Undo function to recover from configuration mistakes. Automatic disaster recovery mechanisms - Statefull failover of the Infoblox GRID master to a candidate GRID master - In case a link fails between the GRID master and a member, the member will continue its services and will automatically resynchronize with the master when the link is restored - Should an individual appliance in a remote location suffer a hardware failure, recovery is as fast as swapping in an empty replacement unit, giving it the same IP address and tell it which GRID to join. The empty appliance will contact the Grid Master and will pull down his configuration automatically. 5. Introducing Integrated IP Address Management IP Address management is about keeping the information about all your IP Networks and its connected devices in one place. This IPAM inventory keeps information about things like available networks, available IP addresses, used IP addresses, static hosts and dynamic hosts with their name, MAC address, location, owner, asset tag number, etc. This inventory is often kept isolated from the DNS/DHCP configurations in a separate Excel file or database which is not always up to date. When in need of a new IP address assignment, an administrator always needs to check the separate IPAM inventory first, followed by a DNS configuration in another console and a DHCP configuration in yet another console. When the IP address is finally assigned to a device and configured, the administrator still needs to update the separate inventory including the extra information of the assignment including which devicetype (eg. webserver), location (eg. Brussels, Floor 2, Rack 3), telephone number, etc. Having this information and related DNS/DHCP configurations in separate disconnected locations imposes some fundamental challenges: -Inconsistency of the DNS/DHCP configuration. For example DNS configuration was done, but the IP was not reserved in the DHCP service, leading to duplicate IP addresses. -The separate IPAM inventory is just a snapshot of a certain moment and never reflecting the real time situation. For example the separate IPAM inventory only show the ranges used by DHCP but doesn t teel anything about the usage of these ranges and the hosts using these ranges. -Auditing of the network identity aspects becomes difficult. For example, show me which printers I have on that location or show me the DHCP history of a certain host or user. Infoblox has recognized these challenges and has developed built-in IP Address Management (IPAM) as an integral part of the solution. Infoblox has combined today s state-of-the-art technology for data management a semantic database and today s state-of-the-art vehicle for network services delivery purpose-built appliances to deliver the first integrated DNS, DHCP, and IPAM appliance. Unlike both new and legacy IPAM systems that are add-ons to a data delivery infrastructure, the Infoblox approach to IPAM can be best summed up as, built-in, not built-on. Infoblox provides the key IPAM features required by the majority of networked organizations, including managing DNS and IP address data, real-time and historical reporting on address usage, role-based access control, and delegated administration. All this is managed from one central web based GUI.

7 In stead of doing DNS/DHCP configurations separately, the admin can create a host object which consolidates and synchronizes all data related to an IP-addressed device (e.g. name, IP address, MAC address, forward and reverse records, and aliases,) into a single logical object. This ensures synchronization of the data over the life of the device and eliminates the tendency for outdated or orphaned records to accumulate. Furthermore, extra information can be tied to this object such as device-type, location, asset tag number, etc. This allows easy investigation and auditing of all IP connected devices in a network. The Infoblox integrated IPAM solution allows automation and delegation of all phases in the IPAM lifecycle including architecture, daily operations and insight. - In terms of architecture, Infoblox includes the following IP Address Management features to plan and allocate IP and name space Graphical Network Maps Management of overlapping Networks Role-based administration with admin roles and admin groups Granular administration rights down to the individual object level Name Server Groups and templates Split networks and Join networks in an easy way Network Templates, Range/Scope templates and Fixed address templates - In terms of daily operations, the solution include the following IP Address Management features to provision and manage the IP and name space Graphical IP Maps Bookmarks Smart Folders to group objects based on IPAM info fields Customizable Web Console with built-in workflow Wizards for popular IPAM tasks Next Available IP Scheduled Changes Recycle Bin with undo function DNS Hostname Templates Zone Locking - In terms of insight, Infoblox offers the following IP Address Management features to analyze and track the IP and name space Discovery of IP devices and reconciliation with IP number plan Customizable Dashboard with links into favorite tasks and GUI panels Audit history with reporting IP address history reports IPAM extensible attributes (IPAM info fields) CSV export Alerts for IP space usage Global search Customizable reporting server with predefined and custom reports

8 6. Introducing PortIQ The Infoblox PortIQ appliance provides complete visibility into switch port usage for port capacity planning, security audits and ease of troubleshooting. With Infoblox PortIQ appliances, network administrators can quickly identify the location of all connected devices and get reports on how often network ports are used. With this visibility, IT departments can better plan switch purchases by utilizing existing ports before making additional purchases and by understanding historical port usage trends to predict when they will need additional hardware. In addition, the ability to quickly locate where devices are connected increases security and eases troubleshooting efforts. The PortIQ appliance uses network discovery to obtain switching infrastructure information in a fast, non-intrusive way. It uses multiple protocols (like SNMP, CDP, LLDP, STP, etc), and methods to gather the information and works with multiple switch vendors (Cisco, HP, Extreme, 3Com, etc.). With PortIQ appliances in your network you can: Gain comprehensive insight into what is connected to your network Optimize the utilization of your switch infrastructure Improve security by quickly identifying the physical location of devices connected to the network. The Port IQ appliance discovers network information and adds it to the Infoblox IPAM database. Combined with an Infoblox Grid, the Infoblox PortIQ appliance brings powerful new data into the Infoblox IPAM system. The PortIQ appliance adds the following information to the Infoblox IPAM database for each IP address: Switch Name, Switch Port, VLAN Name, VLAN Number, Switch status, Port Speed/Duplex, Port/Link status, First seen and Last seen. Armed with this additional information, network engineers can quickly associate an IP address with a VLAN and switch to pinpoint trouble spots and resolve problems. This has many applications, including quickly shutting infected devices off the networks when virus or worm attacks occur; removing an unauthorized device from the network when discovered by Infoblox discovery process etc.

9 7. Fortifying Microsoft Active Directory Microsoft Active Directory is a central data store holding information about the Microsoft Users in a network (name, user-group, credentials, etc.). It is often used as an inventory to authorize access to various applications (e.g. file shares). In a Microsoft environment the Domain Controller (DC) is the component storing and providing Active Directory information. In order for Active Directory to operate, the DNS and DHCP service need to function properly. When a host (e.g. laptop) is plugged into a network where Active Directory is running, a few things, related to DNS and DHCP happen: -The host asks for an IP address and correct options (e.g. which DNS server to use). The assignment of the IP address and correct options is done by the DHCP service. -Next, the host will look for his Domain Controller (DC) to logon to the MS Windows domain (AD). The host does this by asking the DNS for the name and IP address of the DC. This is information is present in the DNS in the form of SRV records. These SeRVice records in DNS advertise where which service lives in a network, including Microsoft AD services, print services, etc. -The host will contact the Microsoft DC and logon to the companies Microsoft domain. -Finally, the host will also be registered in the DNS via a Dynamic DNS update (DDNS). The DDNS update will register the current name to IP mapping of the host in DNS (e.g. laptop1.company.corp > IPaddress ). This way every host can be found on the basis of its name in the DNS, even if the address is assigned dynamically via DHCP. Historically, many organizations have turned on DNS and DHCP services on the Microsoft Domain Controller itself. In many cases because there was no alternative, or because it was the default setting when installing a DC. While this might seem the easy way, however, over time, some challenges and limitations were introduced that started to threat the well-being of the Active Directory service itself and many other applications in need of a solid DNS/DHCP operation. Microsoft and Infoblox started a partnership to overcome the following limitations: Difficult to assign and log IP addresses in a controlled way The MS DHCP service is anonymous making it difficult to control the assignment of IP addresses based on access control mechanisms. Furthermore, it s not always easy to investigate MS DHCP events/logs or trace back which device or user was behind a particular IP address at a given moment. Limitations in the MS DNS protocol engine The MS DNS protocol engine was developed with Active Directory in mind making it sometimes insufficient for other applications or functions. As an example, it is hard to restrict who can query the DNS (ACL s), difficult to delegate isolated tasks to multiple people in a controlled way, no support for special DNS features such as views, difficult to do audit, etc. Unfortunately, as a result of these limitations, many organizations are obliged to deploy a mix of MS DNS and UNIX DNS. The challenge of orphan records and scavenging Orphan records are illegal outdated name to IP-address mappings in the DNS. The name to IPaddress mapping of a host is registered in the DNS by means of a DDNS update (Dynamic DNS). When hosts are mobile, moving continuously in the network (e.g. Wireless, from desk to meeting room, etc.), it will continuously change its IP address. As a result the host will register multiple times in DNS. However, old DDNS updates tend to stay in the Microsoft DNS, polluting and possibly making it inconsistent. A workaround for this is to have a frequent scavenging process on every DC in an attempt to clean out the illegal orphan records from DNS. However, practice learns that this scavenging process might be cumbersome and inefficient.

10 Propagation delay of DNS changes When the Microsoft DNS is running on the DC as part of active directory (AD integrated), all changes in the DNS content are propagated to the other DNS servers using the AD replication cycle. This means that all changes in the DNS are depending on the AD replication cycle to be communicated throughout the network. Depending on the configuration, in practice the AD replication cycle can take some time. When users start to be mobile in a network, the replication traffic and delay can become a challenge Dependency between DNS and Active Directory In an AD integrated DNS environment DNS and Active Directory are intertwined and completely dependent on each other. Through the DNS service AD controllers can find each other and through AD replication DNS information can be exchanged. This means that a degradation in one of these services triggers a chain reaction that can lead to total outages. If the DNS service degrades, AD services are affected that on its turn brings down DNS, etc. By separating DNS from Active Directory, these dependencies can be easily neutralized. Infoblox as dedicated DNS/DHCP solution in support of Microsoft AD neutralizes these issues In order to overcome the above challenges and limitations, Microsoft started a partnership with Infoblox to offer a Microsoft certified DNS/DHCP solution that can be used as a dedicated component in support of Active Directory, and all the other applications. By offloading DNS and DHCP from the Microsoft DC to the Infoblox technology, the limitations described above can be neutralized and the following advantages can be achieved: -Controlled assignment of IP addresses based on access control mechanisms. -No limitations in the DNS protocol engine. All features to use DNS at its full potential for all applications are available in the Infoblox solution (ACL s, RBA, views, auditing, etc.). -No Orphan records. The Infoblox ID grid concept has built-in intelligence to make sure that new DDNS updates from the same host replace old ones. Also when the lease of the host s IP address expires or is disabled, the DDNS registration will be removed. This means, that there is also no need for scavenging. Furthermore, all mechanisms to support secure dynamic DNS updates are available including Microsoft s GSS-TSIG concept. -Real time propagation of changes in DNS. As the Infoblox ID grid concept makes sure that DNS changes are propagated in real time amongst all member appliances, DNS info is always consistent across the complete network. -All other Infoblox advantages improving simplicity, security and reliability can also be applied the DNS/DHCP service in support of the Active Directory environment. Using Infoblox as the foundation for many applications The Infoblox solution provides a simple, secure and reliable network identity infrastructure that can be used for many applications in a network. Next to IP Address Management, network access control and fortifying the Microsoft AD environment, the Infoblox solution can be used for many other applications. These applications include: SOX-BASEL2 compliance reporting and IP Address Management As described in section 5, the Infoblox IPAM feature allows you to manage and monitor your IP address space. It answers critical questions like, which host and user at which location is currently on the network? What is the history of a certain source IP address? Which IP addresses have been assigned over time to a certain user? Government regulation translated in laws like Sarbanes-Oxley (US), Basel2 (EMEA), HIPAA (health care) stipulate and enforce that compliance reporting answering these questions need to be in place. If not, the IT Manager himself might be held personally responsible in case of incidents that cannot be traced or investigated.

11 8. The Infoblox Offering Infoblox offers purpose-built core network service appliances. Built on a proprietary technology platform with more than 20 patents pending, our technology provides a simple, secure and reliable solution for enabling nonstop network identity services that are integral to successfully running all IP applications. Our current products and technologies include: Infoblox-250, -550, -1050, -1550, and Infoblox-2000 Appliances These purpose-built, high-performance appliances serve as the foundation of Infoblox solutions. They run the proprietary, security-hardened Infoblox NIOS network identity operating system. Both can be deployed individually or in high-availability (HA) pairs for optimal core network services infrastructure resiliency. Multiple Infoblox appliances can participate in an Infoblox GRID and be managed from one single point of administration. Infoblox NIOS Network Identity Operating System A hardened, high-performance, proprietary operating system that powers all Infoblox core network service appliances. The operating system supports both database-level and networklevel failover for nonstop operation. It combines all network identity information into a single bloxsdb semantic database, and the object-oriented API enables easy data migration and supports custom front-ends and integration with enterprise applications. Infoblox NIOS software Infoblox NIOS software, running on Infoblox appliances, delivers nonstop core network services including DNS, DHCP, IPAM, HTTP, FTP, TFTP, NTP and others that are critical to the operation of all IP-based networks. Appliance delivery of these services has become a recommended industry best practice for any size organization, because appliances are inherently more reliable, manageable, scalable, and secure than software on general-purpose servers. For large organizations, distributed Infoblox appliances can be connected into unified Grids that provide unparalleled management, control, visibility, and service resiliency. Infoblox NIOS software is a security-hardened, real-time operating system that includes a built-in, zero-administration database, extensive support for high-availability operation, and comprehensive capabilities that automate appliance deployment and maintenance and simplify data management. Infoblox NIOS supports a series of modules provide a range of network services, including: Naming services via Domain Name System (DNS); Addressing services via Dynamic Host Configuration Protocol (DHCP); Network visibility and control via IP address management (IPAM); Network access control services via the NAC Foundation module and captive portal; File delivery services via File Transfer Protocol (TFTP), FTP and HTTP; Time synchronization services via Network Time Protocol (NTP); Logging services via Syslog

12 Infoblox NIOS software also supports several additional modules that provide unique capabilities: The Grid module which provides patented Infoblox technology for linking distributed appliances into an Infoblox Grid: unified, centrally managed system of appliances sharing a common, real-time distributed database. The Infoblox Grid uses a secure SSL-based VPN among appliances and also uses sophisticated transaction management technology to maintain data integrity. This ensures that all appliances in the Grid have the timely and accurate data and that the Grid continues to deliver services without data loss or corruption in the face of device or WAN failures. Infoblox Grid technology also supports intelligent data replication to minimize the use of bandwidth in the Grid and to enable right-sized appliances to be deployed at each location.

13