DNS, DHCP, IP address management KILIAN KRAUSE - PowerPoint PPT Presentation

Universität Stuttgart Computing center DDI + IPAM @ Uni Stuttgart DNS, DHCP, IP address management KILIAN KRAUSE krause@tik.uni-stuttgart.de SIG NOC #1 TIK/NKS, 2015-04-08 page 1

Universität Stuttgart Computing center AGENDA 1. Motivation 2. Architecture DDI Uni Stuttgart DDI + IPAM @ Uni Stuttgart 3. Above the average... 4. Security & Orchestration What‘s next? 5. TIK/NKS, 2015-04-08 page 2

Universität Stuttgart Computing center DDI + IPAM @ Uni Stuttgart fn100525 fn100525 MOTIVATION TIK/NKS, 2015-04-08 page 3

Universität Stuttgart Computing center MOTIVATION  Mostly manual DNS config  Move to automated setup DDI + IPAM @ Uni Stuttgart  DHCP config by hand, no client self-service  IPv6 not integrated  single pane of glass for all network services DHCP/DNS/rDNS  Few workflow scripting / only partial monitoring  Move to database system and roll out systematic monitoring  Add admin self service, delegation (web frontend)  Hardware refresh  From heterogeneous to homogenous  Add DNSSEC TIK/NKS, 2015-04-08 page 4

Universität Stuttgart Computing center DDI + IPAM @ Uni Stuttgart fn100525 fn100525 ARCHITECTURE TIK/NKS, 2015-04-08 page 8

Universität Stuttgart Computing center BASIC DESIGN LAYOUT DDI + IPAM @ Uni Stuttgart Simple Network Interruption Protocol TIK/NKS, 2015-04-08 page 10

Universität Stuttgart Computing center BLUECAT KEY FEATURES  IP blocks (e.g. static routes or aggregates)  IP networks (access subnet/SVI) DDI + IPAM @ Uni Stuttgart  DNS/rDNS automagically synchronized  DHCP and DNS from same database  Web frontend with DHCP range utilization view  Custom user defined fields (shared for multi-tenant!) per object  Authentication integration with LDAP (e.g. AD), Kerberos, RADIUS and TACACS+  Automatic network discovery and reconciliation  Centralized management  Templating and workflow support  Access right delegation TIK/NKS, 2015-04-08 page 11

Universität Stuttgart Computing center REDUNDANCY / HA  Proteus (BAM) virtualized  No extra XHA config and licenses DDI + IPAM @ Uni Stuttgart  Adonis (DHCP only)  No XHA but master/slave for DHCPv4  works ok!  No Master/Slave für DHCPv6  not even stateless!  Adonis (DNS hidden master)  No XHA, since only „ zone file generator “  Runs as a VM -> fast recovery  Public DNS slaves and campus DNS recursive resolvers highly redundant on generic servers BUT: DNSSEC! TIK/NKS, 2015-04-08 page 14

Universität Stuttgart Computing center DATA IMPORT  XML (BluePrint)  CSV DDI + IPAM @ Uni Stuttgart  Script/API (Perl, Java)  manual TIK/NKS, 2015-04-08 page 15

Universität Stuttgart Computing center ADDRESSING SCHEME IPv6  Historically independent of IPv4 and network  New scheme based on distribution area and vlan ID DDI + IPAM @ Uni Stuttgart  Renumbering not yet neccessary  Fully automated workflow possible!  Network objects in BAM are still independent!  right delegation duplicated and potentially inconsistent  Vlan database still not in BAM  needs monitoring! TIK/NKS, 2015-04-08 page 16

Universität Stuttgart Computing center DDI + IPAM @ Uni Stuttgart fn100525 fn100525 ABOVE THE AVERAGE TIK/NKS, 2015-04-08 page 31

Universität Stuttgart Computing center ABOVE THE AVERAGE  DNSSEC with pre-defined policy a „ one click shop “  KSK rollover happens without DS-check! DDI + IPAM @ Uni Stuttgart  Monitoring based on database definitions (scripted via API)  SOA  WHOIS  DNSSEC  Anycast (also possible with Adonis if used as recursor)  on our recursors for both IPv4 and IPv6  Quagga (or bird, xorp) TIK/NKS, 2015-04-08 page 32

Universität Stuttgart Computing center DDI + IPAM @ Uni Stuttgart fn100525 fn100525 SECURITY & ORCHESTRATION TIK/NKS, 2015-04-08 page 33

Universität Stuttgart Computing center SECURITY  Segmentation by architecture  Database backend DDI + IPAM @ Uni Stuttgart  DNS hidden master  public servers  DMZ architecture (only required services permitted)  Rate-Limiting currently not required  Local server firewall might rate filter  No official distro package for rate limiting DNS server  No DNS filtering / manipulation (DNS64/NAT64)  No (more) public recursive resolvers  DNSSEC is said to raise amplification attack vector  BUT: EDNS usually combined with TCP!  so far not a problem for us TIK/NKS, 2015-04-08 page 34

Universität Stuttgart Computing center ORCHESTRATION  Proteus / BAM offers workflows internally  UI sometimes too overwhelming for newbies DDI + IPAM @ Uni Stuttgart  BlueCat offers TRITON as a workflow engine  Web service  Drag and drop customization  Third party APIs (SQL, LDAP etc.)  Custom API programming with SOAP  Future version shall bring REST TIK/NKS, 2015-04-08 page 35

Universität Stuttgart Computing center DDI + IPAM @ Uni Stuttgart fn100525 fn100525 WHAT‘S NEXT TIK/NKS, 2015-04-08 page 43

Universität Stuttgart Computing center WHAT‘S NEXT  Further integration with database  Monitoring (e.g. routing, firewalling) DDI + IPAM @ Uni Stuttgart  Establish deployment procedures around database(s)  Rolling out new subnets (dual-stack)  Self service for network features? Like:  Activate/remove DHCPv4 from my Vlan  Dual stack my Vlan / remove IPv4  ACL self-service  Cloud automation (VM lifecycle)  … TIK/NKS, 2015-04-08 page 44

Universität Stuttgart Computing center WHAT IPAM IS NOT  Endpoint assessment  Not even (passive) DHCP fingerprinting or SoH DDI + IPAM @ Uni Stuttgart  Can do custom DHCP vendor options based on match clauses  Threat protection (endpoint, DDoS, DHCP exhaustion)  Device registration portal (related product)  Captive portal  NAT gateway (e.g. NAT64)  Certificate authority (for device authorization/tracking etc.)  Policy framework  No RFC3118 support in Adonis  Network management (only network _address_ management!)  Wireless LAN management controller TIK/NKS, 2015-04-08 page 45

Universität Stuttgart Computing center DDI + IPAM @ Uni Stuttgart fn100525 fn100525 SUMMARY TIK/NKS, 2015-04-08 page 48

Universität Stuttgart Computing center SUMMARY  Works as designed!  DNS/rDNS synchronized DDI + IPAM @ Uni Stuttgart  DHCPv4 and stateless DHCPv6 deployed with central config  IPv6 available for all networks  DNSSEC running stable  Common web UI for all NOC and campus admins  Robust architecture according to latest standards TIK/NKS, 2015-04-08 page 49

Universität Stuttgart Computing center DDI + IPAM @ Uni Stuttgart fn100525 fn100525 QUESTIONS? TIK/NKS, 2015-04-08 page 50

Universität Stuttgart Computing center DDI + IPAM @ Uni Stuttgart THANKS fn100525 fn100525 … more questions later? Find me around here or email us: noc@tik.uni-stuttgart.de TIK/NKS, 2015-04-08 page 51